What does an auditor check for IEC 62304?

EN 62304:2006 + A1:2015 · What the EU MDR requires for software life-cycle processes — and where the standard stands under the MDR

What the Regulation itself asks of your software

• Development according to the state of the art, taking into account development life cycle, risk management including information security, verification and validation — Section 17.2 of Chapter II of Annex I
• A risk management system that covers the software — established, implemented, documented and maintained as described in Section 3 of Chapter I of Annex I — Article 10(2)
• Minimum requirements for the environment your software runs in — hardware, IT networks characteristics and IT security measures, including protection against unauthorised access, necessary to run the software as intended, set out by the manufacturer — Section 17.4 of Chapter II of Annex I
• Classification against the rule that applies — for software Rule 11 in Section 6.3 of Chapter III of Annex VIII; the risk class and the justification for the classification rule(s) applied are part of the technical documentation (point (f) of Section 1.1 of Annex II)
• The standards you applied, named in the technical documentation — Section 4 (c) of Annex II lists the harmonised standards, common specifications or other solutions applied to demonstrate conformity; if you apply EN 62304, that is where it is named, and the evidence documents are identified under point (d)

Frequently asked questions

Does the MDR require me to apply IEC 62304?

No. The Regulation requires the outcome Section 17.2 of Chapter II of Annex I describes — a life-cycle process, risk management, verification and validation according to the state of the art — not a named standard. A harmonised standard whose reference is published in the Official Journal gives you a presumption of conformity for the requirements it covers (Article 8(1); restated in recital 1 of Implementing Decision (EU) 2022/757); EN 62304 is not on that list as of 17 June 2026. You can apply it — and name it under Section 4 (c) of Annex II — but the evidence that Section 17.2 is met stays yours to argue in your own file.

Where does software come up in a notified body assessment?

In two places the Regulation names. Under the Annex IX route, the notified body audits your quality management system against its documentation — and where you apply a harmonised QMS standard, it assesses conformity with that standard (Section 2.3 of Annex IX); EN ISO 13485:2016 is on the Official Journal list under the MDR (entry no. 10). And the technical documentation assessment covers, among other things, risk management and the benefit-risk determination (Sections 4.4 to 4.7 of Annex IX) — for software, that is where Section 17.2 and your classification rationale are read. Surveillance audits at least every twelve months and unannounced audits at least every five years are requirements on the notified body (Sections 3.3 and 3.4 of Annex IX; Section 4.10 of Annex VII).

Where do I find what a notified body will focus on for IEC 62304?

Not on this site. What any one notified body will focus on in an audit is not something we will tell you — we do not know it. What the standard requires clause by clause, and for which software safety class, is something we will only tell you once we have read it; until then, your licensed copy is the only record list that counts. What the Regulation names as consequences of non-conformity is written down: a certificate can be suspended, withdrawn or restricted (Section 3.7 of Annex IX).