Written and maintained by CASRAI Editorial Board
Last updated
Software of Unknown Provenance (SOUP) is a foundational regulatory and software engineering classification defined in IEC 62304 (Medical device software — Software life cycle processes) to govern third-party libraries, operating systems, machine learning frameworks, and legacy code modules integrated into Software as a Medical Device (SaMD) or embedded medical device systems (SiMD). Because modern clinical AI and diagnostic software rely extensively on external packages such as PyTorch, TensorFlow, OpenSSL, Linux kernels, and HL7 FHIR parsers that were not developed under an ISO 13485 quality management system, manufacturers must reconcile IEC 62304 SOUP lifecycle controls with FDA Off-The-Shelf (OTS) software guidance, ISO 14971 / ISO/TR 24971 risk management, and mandatory Software Bill of Materials (SBOM) reporting under FDA premarket cybersecurity requirements.
What Is Software of Unknown Provenance (SOUP) under IEC 62304?
Under IEC 62304:2006+AMD1:2015 Clause 3.25, Software of Unknown Provenance (SOUP) encompasses two distinct categories of software items incorporated into a medical device software system:
- Third-Party, Commercial, and Open-Source Software: Software items that are already developed and generally available on the market or in open-source repositories, and that were not specifically engineered under a medical device lifecycle process for incorporation into the subject medical device (for example, C/C++ standard libraries, Python scientific computing packages like NumPy/SciPy, relational database engines, RTOS kernels, and networking stacks).
- Legacy In-House Software Without Adequate Development Records: Software components previously developed by the manufacturer itself (for example, inside an earlier research prototype or non-regulated laboratory instrument) for which complete IEC 62304 design, verification, and traceability records are unavailable.
Crucially, IEC 62304 treats the provenance of the software development process as “unknown” even when the open-source source code is publicly readable on GitHub, because the medical device manufacturer does not control or audit the external project’s requirement traceability, unit-testing coverage, or defect-tracking rigor.
What Are the IEC 62304 Requirements for Specifying, Verifying, and Monitoring SOUP?
Under IEC 62304, the rigor of SOUP documentation scales with the software safety classification (Class A: no injury or damage to health possible; Class B: non-serious injury possible; Class C: death or serious injury possible) assigned to the software architecture module containing the SOUP item:
- Unique Identification and Configuration Management (Clause 8.1.2): For all safety classes (A, B, and C), the manufacturer must uniquely identify each SOUP item by recording its title, manufacturer/maintainer, and exact version designation (e.g., semantic version and commit hash). Wildcard dependency specifiers in package manifests are prohibited in release builds.
- Functional, Performance, and Hardware/Software Requirements (Clauses 5.3.3 & 5.3.4): For Class B and Class C software architectures, the manufacturer must specify the exact functional and performance capabilities required from the SOUP item for its intended use in the device, as well as the hardware and software environment requirements (memory allocation, processor architecture, OS kernel version, or driver interfaces) imposed by the SOUP item to operate safely.
- Segregation and Architectural Isolation (Clause 5.3.5): If a manufacturer wants to prevent a high-complexity SOUP component (such as a third-party graphics engine or machine learning runtime) from inheriting a Class C safety classification, the software architecture must implement verified hardware or software segregation mechanisms (memory protection units, container sandboxing, watchdog timers, and independent plausibility checks) so that a failure of the SOUP component cannot propagate into a Class C hazardous situation.
- SOUP Risk Management & Known Anomaly Evaluation (Clauses 7.1.2 & 7.1.3): For Class B and C systems, engineers must review the SOUP maintainer’s published list of known bugs, errata, and Common Vulnerabilities and Exposures (CVEs) relevant to the exact version in use, evaluate whether any known anomaly could contribute to a hazardous situation, and implement verifiable risk control measures.
- Post-Market Maintenance & Continuous Monitoring (Clause 6.1): Throughout the device’s commercial lifecycle, the manufacturer must monitor new SOUP bug reports, security advisories, and end-of-life (EOL) obsolescence notices, evaluating upgrade impacts under formal change control.
How Does IEC 62304 SOUP Compare to FDA Off-The-Shelf (OTS) Software and SBOM Requirements?
When preparing a 510(k), De Novo, or Premarket Approval (PMA) submission for the U.S. Food and Drug Administration (FDA), regulatory engineers map IEC 62304 SOUP artifacts to FDA’s August 2023 final guidance on Off-The-Shelf Software Use in Medical Devices and Section 524B of the Federal Food, Drug, and Cosmetic (FD&C) Act:
| Regulatory Dimension | IEC 62304 SOUP | FDA Off-The-Shelf (OTS) Software (2023 Guidance) | FDA Section 524B SBOM Mandate |
|---|---|---|---|
| Scope of Covered Software | Commercial, open-source, third-party libraries, OS, plus legacy internal code lacking lifecycle records | Universal software components (COTS, open-source, freeware) for which the device manufacturer cannot claim complete software life cycle control | All commercial, open-source, and off-the-shelf software components and transitive dependencies in a “cyber device” |
| Documentation Tiering | Safety Class A, Class B, and Class C architectural allocation | Basic Documentation vs Enhanced Documentation Levels (aligned with 2023 FDA Premarket Software Guidance) | Machine-readable inventory (NTIA Minimum Elements in SPDX or CycloneDX format) |
| Defect & Vulnerability Tracking | Evaluation of published SOUP anomaly lists (Clause 7.1.3) and Clause 6.1 maintenance | Description of OTS failure modes, risk mitigations, and maintenance/obsolescence plan | Disclosure of known vulnerabilities (CVEs/CISA KEV), support status, and end-of-support dates |
| Non-Device Quality System Software | Excluded from IEC 62304 (covered under ISO 13485 Clause 4.1.6) | Governed separately under FDA Computer Software Assurance (CSA) guidance | Applies to product software shipped in or as the medical device |
Frequently Asked Questions
What is Software of Unknown Provenance (SOUP) under IEC 62304?
Under IEC 62304 Clause 3.25, Software of Unknown Provenance (SOUP) is defined as a software item that is already developed and generally available and that has not been developed for the purpose of being incorporated into the medical device, or software previously developed for which adequate records of the development processes are not available.
What are the IEC 62304 requirements for specifying, verifying, and monitoring SOUP?
IEC 62304 requires manufacturers to record each SOUP item’s title, manufacturer, and unique version identifier (Clause 5.1.12), specify functional/performance and hardware/software requirements imposed by the SOUP (Clauses 5.3.3–5.3.4), evaluate published SOUP anomaly lists against ISO 14971 risk controls (Clauses 7.1.2–7.1.3), and continuously monitor new vulnerabilities and obsolescence during post-market maintenance (Clause 6.1).
How does IEC 62304 SOUP compare to FDA Off-The-Shelf (OTS) software and SBOM requirements?
IEC 62304 SOUP and FDA Off-The-Shelf (OTS) software cover the same third-party, commercial, and open-source libraries, plus legacy in-house code lacking full lifecycle traceability in SOUP. Under FD&C Act Section 524B, the IEC 62304 SOUP list feeds directly into the machine-readable Software Bill of Materials (SBOM) in SPDX or CycloneDX format required for FDA premarket cybersecurity submissions.
Sources
- International Electrotechnical Commission (IEC). IEC 62304:2006+AMD1:2015 CSV — Medical device software – Software life cycle processes. https://webstore.iec.ch/en/publication/22794
- U.S. Food and Drug Administration (FDA). Off-The-Shelf Software Use in Medical Devices — Guidance for Industry and Food and Drug Administration Staff (August 2023). https://www.fda.gov/regulatory-information/search-fda-guidance-documents/shelf-software-use-medical-devices
- U.S. Food and Drug Administration (FDA). Cybersecurity in Medical Devices: Quality System Considerations and Content of Premarket Submissions (September 2023). https://www.fda.gov/regulatory-information/search-fda-guidance-documents/cybersecurity-medical-devices-quality-system-considerations-and-content-premarket-submissions
