Written and maintained by CASRAI Editorial Board
Last updated
Engineers and regulatory affairs teams building Software as a Medical Device (SaMD) or embedded firmware frequently compare IEC 62304 vs. ISO 13485 (alongside ISO 14971) when structuring their Quality Management System and technical documentation. Rather than competing standards, IEC 62304:2006+AMD1:2015, ISO 13485:2016, and ISO 14971:2019 operate as three nested layers of medical device software compliance: ISO 13485 governs the organization-wide Quality Management System (QMS), ISO 14971 governs product risk management, and IEC 62304 serves as the specialized software engineering plug-in that satisfies ISO 13485 Clause 7.3 (Design and Development) for source code.
What Is the Difference Between IEC 62304 and ISO 13485 (and ISO 14971)?
Each standard answers a distinct regulatory question during an FDA inspection (under the 21 CFR Part 820 Quality Management System Regulation, QMSR), MDSAP audit, or EU MDR (Regulation (EU) 2017/745) Notified Body technical documentation review:
- ISO 13485:2016 (The Company-Wide QMS Umbrella): Specifies how the medical device organization operates as a regulated entity—document and record controls (Clause 4.2), management review (Clause 5.6), personnel competence and training (Clause 6.2), purchasing and supplier evaluation (Clause 7.4), high-level Design and Development controls (Clause 7.3), complaint handling and regulatory vigilance reporting (Clause 8.2), and Corrective and Preventive Action (CAPA, Clause 8.5). Because ISO 13485 applies equally to latex gloves, orthopedic implants, and cloud AI software, it intentionally omits software-specific rules such as source-code unit testing or third-party library management.
- IEC 62304:2006+AMD1:2015 (The Software Development Life Cycle Engine): Specifies the granular engineering lifecycle processes for medical device software: Software Development Process (Clause 5), Software Maintenance Process (Clause 6), Software Risk Management Process (Clause 7), Software Configuration Management Process (Clause 8), and Software Problem Resolution Process (Clause 9), including management of Software of Unknown Provenance (SOUP).
- ISO 14971:2019 (The Risk Management Backbone): Specifies how the manufacturer identifies hazards and hazardous situations, estimates and evaluates risks, implements risk control measures following the inherent-safety / protective-measures / information-for-safety hierarchy, and monitors production and post-production information.
How Do ISO 13485, ISO 14971, and IEC 62304 Interlock? (Annex C Crosswalk Table)
Annex C of IEC 62304 (and AAMI TIR45:2023 for Agile software teams) maps how each software process in IEC 62304 and risk activity in ISO 14971 directly fulfills the corresponding clause of ISO 13485:2016:
| ISO 13485:2016 Clause (QMS & Design Controls) | IEC 62304:2006+AMD1:2015 Clause (Software Lifecycle) | ISO 14971:2019 Clause (Risk Management) | Required Deliverable in the Design History File (DHF) |
|---|---|---|---|
| Clause 4.1 & 4.2 (General QMS & Documentation) | Clause 4.1 (Quality Management System prerequisite) | Clause 4.1 & 4.5 (Risk Management Process & RMF) | Quality Manual, SDLC SOP, and Risk Management SOP |
| Clause 7.1 & 7.3.2 (Planning of Product Realization & Design Planning) | Clause 4.3 & 5.1 (Software Safety Classification & Development Planning) | Clause 4.4 (Risk Management Plan) | Software Development Plan (SDP), Risk Management Plan (RMP), and Safety Class (A/B/C) Justification |
| Clause 7.3.3 (Design and Development Inputs) | Clause 5.2 & 7.2 (Software Requirements Analysis & Risk Control Measures) | Clauses 5, 6 & 7.1 (Hazard Analysis, Risk Evaluation & Risk Control Option Analysis) | Software Requirements Specification (SRS) traced to User Needs and ISO 14971 Hazard Analysis / sFMEA |
| Clause 7.3.4 (Design and Development Outputs) | Clauses 5.3, 5.4 & 5.5 (Architectural Design, Detailed Design & Unit Implementation) | Clause 7.2 (Implementation of Risk Control Measures, including hardware/software segregation) | Software Architecture Document (SAD), Detailed Design Spec (Class B/C), SOUP List & Source Code |
| Clause 7.3.6 (Design and Development Verification) | Clauses 5.5.5, 5.6 & 5.7 (Unit Verification, Integration Testing & Software System Testing) | Clause 7.2 & 7.3 (Verification of Risk Control Implementation & Effectiveness; Residual Risk) | Unit Test Reports (Class B/C), Integration & System Verification Protocols/Reports, and Traceability Matrix |
| Clause 7.3.7 (Design and Development Validation) | Out of scope of IEC 62304 (Covered by IEC 82304-1 Clause 4.2/4.3 for standalone SaMD) | Clause 8 (Evaluation of Overall Residual Risk and Benefit-Risk Analysis) | Clinical Evaluation Report, Summative Human Factors Validation (IEC 62366-1), and Risk Management Report |
| Clause 7.3.9 & 8.5 (Control of Design Changes & CAPA) | Clauses 6, 8 & 9 (Software Maintenance, Configuration Management & Problem Resolution) | Clause 10 (Production and Post-Production Activities) | Release Notes (Clause 5.8), Git Configuration Logs, Issue Tracker / Problem Reports, and Change Impact Analysis |
How ISO 14971 Hazard Severity Determines IEC 62304 Software Safety Classes (A, B, and C)
One of the most important intersections between ISO 14971 and IEC 62304 occurs in IEC 62304 Clause 4.3 (as updated by Amendment 1:2015). Every software system—and any decomposed software item isolated by verified architectural segregation—must be assigned a Software Safety Class (Class A, Class B, or Class C) based on the worst-case severity of harm in the ISO 14971 Risk Management File if the software item fails to behave as specified (after accounting for external hardware or healthcare-process risk control measures):
- Class A: No injury or damage to health is possible (requires SDP, SRS, Software System Testing, Configuration Management, Problem Resolution, and Release documentation; exempt from formal Architectural/Detailed Design and unit testing mandates).
- Class B: Non-serious injury is possible (adds mandatory Software Architectural Design [Clause 5.3], SOUP functional/hardware/risk documentation, software unit acceptance criteria [Clause 5.5.2/5.5.5], and Software Integration Testing [Clause 5.6]).
- Class C: Death or serious injury is possible (adds formal Detailed Design for every software unit [Clause 5.4.2–5.4.4], additional unit verification criteria [Clause 5.5.3–5.5.4], and complete bidirectional traceability down to the source-code unit level).
Can a SaMD Manufacturer Achieve IEC 62304 Compliance Without an ISO 13485 QMS?
No. A frequent misconception among software startups is that implementing an IEC 62304-compliant Git/Jira workflow eliminates the need for an ISO 13485 Quality Management System. That approach fails regulatory review for three structural reasons:
- Normative Prerequisite in IEC 62304 Clause 4.1: IEC 62304 Clause 4.1 states that the manufacturer shall demonstrate the ability to provide medical device software through a Quality Management System (explicitly pointing to ISO 13485).
- Missing Design Validation (ISO 13485 Clause 7.3.7): IEC 62304 deliberately stops at Software System Testing (Clause 5.7 — verifying that the code meets its written Software Requirements Specification). It does not cover Design Validation—proving that the complete device meets clinical user needs and intended uses in real or simulated clinical environments (which is governed by ISO 13485 Clause 7.3.7, IEC 82304-1 for standalone health software, and IEC 62366-1 for usability engineering).
- Product Software vs. Non-Product QMS Software (ISO 13485 Clause 4.1.6): IEC 62304 applies only to the medical device software delivered to or used for patients. Validation of the internal software tools used to run the company—such as the electronic QMS, CI/CD test runners, static analyzers, and complaint databases—is governed by ISO 13485 Clause 4.1.6 (and ISO/TR 80002-2 / FDA Computer Software Assurance guidance).
Frequently Asked Questions
What is the difference between IEC 62304 and ISO 13485 for medical device software?
ISO 13485:2016 is the organization-wide Quality Management System (QMS) standard covering document control, management responsibility, supplier management, high-level Design Controls (Clause 7.3), CAPA, and post-market surveillance across all medical devices. IEC 62304:2006+AMD1:2015 is the technical engineering standard specifically for medical device software (SaMD and SiMD) that details how to execute software development (Clause 5), maintenance (Clause 6), software risk management (Clause 7), configuration management (Clause 8), and problem resolution (Clause 9) across Software Safety Classes A, B, and C.
How do ISO 13485, ISO 14971, and IEC 62304 interlock across design controls, risk management, and software lifecycle clauses?
The three standards form an interlocked regulatory triad documented in IEC 62304 Annex C: (1) ISO 13485 Clause 7.3 mandates formal design planning, inputs, outputs, verification, validation, and change control; (2) ISO 14971 (invoked by ISO 13485 Clause 7.1 and IEC 62304 Clause 4.2/Clause 7) evaluates device hazards and severity of harm, which determines the IEC 62304 Software Safety Class (A, B, or C); and (3) IEC 62304 Clauses 5–9 provide the concrete software engineering deliverables (SRS, Architecture, Detailed Design, SOUP evaluation, Unit/Integration/System testing) that populate the ISO 13485 Design History File (DHF).
Can a SaMD manufacturer achieve IEC 62304 compliance without an ISO 13485 Quality Management System?
No. Clause 4.1 of IEC 62304 explicitly requires the manufacturer to demonstrate the ability to provide medical device software consistently meeting customer and regulatory requirements through an established Quality Management System, citing ISO 13485 (or an equivalent national regulation such as FDA 21 CFR Part 820 QMSR). Furthermore, IEC 62304 does not include final Design Validation in the clinical use environment, which must be satisfied through ISO 13485 Clause 7.3.7 and IEC 82304-1.
Sources
- International Electrotechnical Commission (IEC). IEC 62304:2006+AMD1:2015 — Medical device software — Software life cycle processes (Clause 4.1, Clause 4.3, Clauses 5–9, and Annex C).
- International Organization for Standardization (ISO). ISO 13485:2016 — Medical devices — Quality management systems — Requirements for regulatory purposes (Clauses 4.1.6, 7.3, and 7.5.6).
- International Organization for Standardization (ISO). ISO 14971:2019 — Medical devices — Application of risk management to medical devices.
