What does an auditor check for IEC 81001-5-1?
IEC 81001-5-1 · What the EU MDR requires for software security — and where the standard stands under the MDR
Key point
The requirement is in the Regulation: Section 17.2 of Chapter II of Annex I of Regulation (EU) 2017/745 requires software, whether it is part of a device or a device in itself, to be developed and manufactured in accordance with the state of the art, taking into account the principles of development life cycle, risk management, including information security, verification and validation. IEC 81001-5-1 — "Health software and health IT systems safety, effectiveness and security - Part 5-1: Security - Activities in the product life cycle" — is the standard the Commission asked CEN and CENELEC to draw up for that (standardisation request C(2021) 2406, Annex I, Table 2, no. 27, deadline 27 May 2024). As of 17 June 2026 it is not cited in the Official Journal under the MDR, so applying it gives no presumption of conformity. What it gives you is a documented set of security activities; what those are, only the licensed text says.
What the Regulation itself asks of your software
- Development according to the state of the art, taking into account development life cycle, risk management including information security, verification and validation — Section 17.2 of Chapter II of Annex I
- Risk management that covers information security — the risk management system under Article 10(2) and Section 3 of Chapter I of Annex I does not stop at patient-safety hazards; Section 17.2 names information security as part of it
- Minimum requirements for the environment your software runs in — hardware, IT networks characteristics and IT security measures, including protection against unauthorised access, necessary to run the software as intended, set out by the manufacturer — Section 17.4 of Chapter II of Annex I
What has to reopen your risk file after release is not specific to security: what post-market surveillance finds has to be evaluated for its impact on hazards, risks and the benefit-risk determination, and the risk control measures adapted where necessary (Section 3 (e) and (f) of Chapter I of Annex I; Article 83(3)). A vulnerability you learn about after release is such a finding.
What any one notified body will focus on in an audit is not something we will tell you — we do not know it. What the standard requires clause by clause is something we will only tell you once we have read it; until then, your licensed copy is the only checklist that counts.