Written and maintained by CASRAI Editorial Board
Last updated
IEC 82304-1:2016 (Health software — Part 1: General requirements for product safety) is the international product-level safety and security standard for standalone health software designed to operate on general-purpose computing platforms (smartphones, desktop computers, tablets, and cloud infrastructure) and placed on the market without dedicated medical hardware. Developed jointly by IEC Subcommittee 62A and ISO Technical Committee 215 and recognized by the U.S. Food and Drug Administration (FDA Consensus Standard Recognition Number 13-97), IEC 82304-1 closes the system-level validation and lifecycle gap left by IEC 62304 for Software as a Medical Device (SaMD), clinical information systems, and standalone health applications.
What Is IEC 82304-1 and How Does It Differ from IEC 62304?
IEC 62304 is a software engineering process standard that stops at software system verification testing, whereas IEC 82304-1 is a complete product safety standard that wraps around IEC 62304 to govern user requirements, clinical validation in the target environment, labeling, cybersecurity, and post-market decommissioning.
When IEC 62304 (Medical device software — Software life cycle processes) was drafted, it assumed that software would be embedded inside physical electromedical hardware governed by product standards such as IEC 60601-1. Consequently, IEC 62304 explicitly excluded final product validation—confirming that the finished product meets user needs in its intended use environment—expecting the overarching hardware standard to cover it.
For standalone health software running on off-the-shelf consumer hardware or cloud servers, no physical hardware standard applies. IEC 82304-1:2016 fills that structural role. Rather than replacing IEC 62304, Clause 5 of IEC 82304-1 normatively calls and mandates compliance with Clauses 4.2, 4.3, 5, 6, 7, 8, and 9 of IEC 62304 for software development, risk management, configuration management, problem resolution, and maintenance.
| Dimension | IEC 62304:2006+AMD1:2015 | IEC 82304-1:2016 | ISO/TS 82304-2:2021 (IEC/TR 82304-2) |
|---|---|---|---|
| Standard Type | Software development process standard | Product safety & system lifecycle standard | Quality & reliability assessment specification |
| Target Scope | Embedded medical device software (SiMD) and SaMD engineering | Standalone health software on general IT platforms (SaMD + health IT) | Consumer-facing and clinical health & wellness mobile/web apps |
| Verification vs. Validation | Covers unit, integration, and software system verification testing | Requires full product validation in the intended use environment (Clause 6) | Evaluates clinical evidence, usability testing, and technical robustness |
| Accompanying Documents | Not covered (deferred to product standard) | Mandates IFU, technical description, and platform/security specs (Clause 7) | Requires transparent app store disclosures and health app quality label |
| Decommissioning | Covered only as retirement planning within maintenance | Mandates post-market decommissioning and secure data migration/disposal (Clause 8) | Assesses data portability and retention policies |
Why Do Standalone SaMD Products Need IEC 82304-1 System-Level Validation in Addition to IEC 62304?
Standalone SaMD products require IEC 82304-1 because passing IEC 62304 software verification only proves that code modules match software specifications (“built the software right”), whereas IEC 82304-1 Clause 6 proves that the complete software product safely achieves its intended clinical or health purpose on real-world operating systems, networks, and user interfaces (“built the right software”).
Unlike embedded firmware running on locked, manufacturer-controlled microcontrollers, standalone health software runs on heterogeneous computing environments that the manufacturer does not control. Operating system updates, screen resolution differences, browser rendering engines, cloud latency, network packet loss, and third-party background processes introduce system-level hazards that code-level unit testing cannot detect.
Under IEC 82304-1, manufacturers of standalone health software—including diagnostic clinical AI and SaMD tools and research informatics platforms—must address five core lifecycle pillars:
- Clause 4 (Health Software Product Requirements): Defines use requirements across target patient/clinician populations, physical and IT environments, interoperability interfaces, immune/security controls (confidentiality, integrity, availability, authenticity, non-repudiation), and ISO 14971 risk management.
- Clause 5 (Software Life Cycle Processes): Incorporates IEC 62304 Clauses 4.2 through 9 by reference, assigning software safety classes (Class A, B, or C) based on the severity of potential harm.
- Clause 6 (Health Software Product Validation): Requires an independent validation plan, execution of validation testing with representative users in the intended operating environment (connecting to IEC 62366-1 usability engineering), and a formal validation report signing off on residual risks.
- Clause 7 (Product Identification and Accompanying Documents): Requires unambiguous electronic product identification (versioning, UDI compatibility), Instructions for Use (IFU), and a Technical Description specifying minimum hardware, operating system versions, network bandwidth, firewall ports, and cybersecurity hardening instructions.
- Clause 8 (Post-Market Activities): Governs post-deployment monitoring, software updates, vulnerability patching, and end-of-life product decommissioning—ensuring health data is safely archived, exported in interoperable formats, or cryptographically erased when a product is retired.
IEC 82304-1 Audit and Compliance Checklist for Clinical Software Teams
Research software engineering teams and digital health sponsors preparing FDA premarket submissions or EU MDR Technical Documentation (where EN IEC 82304-1:2017 supports General Safety and Performance Requirements under Annex I) use a structured traceability checklist alongside Computer Software Assurance (CSA) and Computer System Validation (CSV) artifacts:
- Intended Use & Use Requirements Specification (Clause 4.1–4.2): Document target users, clinical context, contraindications, accessibility needs, and language locales.
- System & Cybersecurity Requirements Traceability (Clause 4.3–4.6): Map every use requirement and ISO 14971 hazard control measure to verifiable system requirements, including encryption in transit/at rest, role-based access control, and audit logging.
- IEC 62304 Process Evidence (Clause 5): Verify complete Software Development Plan, architecture design, SOUP (Software of Unknown Provenance) bill of materials, and verification test logs per safety class.
- Product Validation Report (Clause 6): Confirm validation testing was executed on the exact minimum and recommended OS/browser/hardware configurations listed in the Technical Description, with independence documented for safety classes B and C.
- IFU and Technical Description Completeness (Clause 7): Verify that administrator guides disclose all required IT security settings, backup procedures, and interoperability dependencies.
- Decommissioning & Data Retention SOP (Clause 8.4): Verify documented procedures for notifying users prior to end-of-support and migrating or sanitizing protected health data.
What Does IEC/TR 82304-2 (ISO/TS 82304-2:2021) Cover for Health and Wellness Apps?
Published in July 2021 as ISO/TS 82304-2:2021 (and frequently referenced in IEC work items as IEC/TR 82304-2 or CEN/ISO/TS 82304-2), Part 2 establishes an 81-question quality and reliability assessment framework and a visual consumer/clinician quality label for mobile and web-based health and wellness applications.
Whereas Part 1 (IEC 82304-1) is an engineering safety standard written for software manufacturers and regulatory auditors, Part 2 was commissioned by ISO/TC 215 and CEN/TC 251 (and tested through the European Horizon Europe Label2Enable initiative) to help clinicians, health technology assessment (HTA) bodies, app stores, and patients evaluate digital health apps—including lifestyle, chronic disease self-management, and clinical trial ePRO apps that may fall outside strict medical device classification.
ISO/TS 82304-2:2021 scores applications across four graded quality pillars and displays the result on a nutrition-style Health App Quality Label (graded A through E):
- Healthy and Safe: Evaluates clinical accuracy, involvement of healthcare professionals in design, health risks, ethical disclosures, and peer-reviewed or regulatory evidence supporting claimed health benefits.
- Easy to Use: Evaluates accessibility standards (WCAG alignment), readability, user-centered design testing, and clear onboarding instructions.
- Secure Data: Evaluates privacy policy transparency, GDPR/HIPAA data minimization, authentication strength, encryption, and third-party data sharing controls.
- Robust Build: Evaluates technical stability, interoperability standards (such as HL7 FHIR), maintenance frequency, and compliance with IEC 82304-1 and IEC 62304 engineering principles.
