Does IEC 62304 apply to my product?
IEC 62304:2006 + AMD1:2015 · Scope clause 1
The short answer
IEC 62304 applies to software that is itself a medical device (SaMD) and to software that is embedded in or controls a hardware medical device. The trigger is whether the software performs actions beyond storage for an individual patient with a medical intended purpose.
Two types of medical device software
- SaMD (Software as a Medical Device): Standalone software with a medical intended purpose — runs on general-purpose hardware (phones, tablets, servers, cloud). Examples: ECG analysis app, retinal image AI, insulin dosing decision support
- Software in a medical device (embedded / firmware): Software that controls or drives a hardware medical device. Examples: infusion pump firmware, MRI scanner control software, ventilator control system
Qualification decision table
| Question | Answer | Outcome |
|---|---|---|
| Does the software perform actions on data beyond simple storage, archival, or lossless compression? | No | IEC 62304 does not apply |
| Is the output of the software intended to benefit individual patients (not just population-level statistics)? | No | IEC 62304 does not apply |
| Does the software have a medical intended purpose (diagnosis, prevention, monitoring, prediction, treatment)? | Yes | IEC 62304 applies |
Examples that DO trigger IEC 62304
- ECG analysis app that detects arrhythmia and flags for physician review
- Infusion pump firmware that calculates and delivers drug dosing
- Retinal image analysis algorithm that identifies diabetic retinopathy
- Insulin dosing decision support that recommends a bolus dose
- Radiation treatment planning software
- Software that controls a surgical robot
Examples that do NOT trigger IEC 62304
- Hospital scheduling system (no individual patient clinical output)
- General data visualisation dashboard without medical claims
- Fitness tracker with no medical claims or intended purpose
- Pure PACS archive software (storage only; no processing of clinical significance)
- Billing and EHR administrative modules
Regulatory frameworks that reference IEC 62304
| Framework | IEC 62304 reference |
|---|---|
| EU MDR / IVDR | De facto via GSPR requirement 17; harmonised standard EN 62304 satisfies this requirement |
| FDA (CDRH) | Recognised consensus standard; referenced in FDA guidance on software in medical devices |
| UK UKCA | Referenced via UK harmonised standard BS EN 62304 |
| Canada Health Canada | Referenced in SaMD guidance |
| Japan PMDA | Referenced in software guidelines for medical devices |
SOUP and AI/ML components
IEC 62304 Amendment 1 (2015) significantly strengthened requirements for SOUP (Software of Unknown Provenance) — third-party libraries, open-source components, and commercial off-the-shelf software. AI/ML frameworks (TensorFlow, PyTorch, scikit-learn) used as components in a medical device software system are SOUP and require specific management activities under IEC 62304.
Frequently asked questions
Does pure storage or archival software need IEC 62304?
If the software only stores, archives, or retrieves clinical data without performing any computation or transformation of clinical significance, it is outside the IEC 62304 scope. However, if the same system also provides viewing, measurement tools, or analysis features, those functional components are in scope.
Can a startup apply IEC 62304 progressively?
IEC 62304 does not prescribe when in the product lifecycle compliance must begin, but requirements apply before placing the device on the market. Starting IEC 62304-aligned processes from the beginning of development is strongly recommended — retrofitting documentation and process gaps late in development is significantly more expensive.
Does a CI/CD pipeline tool need to comply with IEC 62304?
Build tools, CI/CD systems, and automated test frameworks are not themselves medical devices and do not need to comply with IEC 62304. However, if they are part of the automated software release process, they must be managed within your configuration management and software validation framework as development tools.
Is an AI model subject to IEC 62304?
Yes. An AI or ML model that is part of a medical device software system is subject to IEC 62304. The model architecture and training pipeline are considered software items. Pre-built frameworks (TensorFlow, PyTorch) used to implement the model are SOUP. Both require IEC 62304 lifecycle controls.