Health Software — Part 1: General Requirements for Product Safety
The IEC product-level safety standard for health software placed on the market without dedicated hardware — software products running on general computing platforms (Edition 1.0, 2016). Where IEC 62304 governs the development process of software inside or as a device, 82304-1 governs the software product: product requirements, validation of the product against its use requirements, accompanying documents and instructions for use, and post-market activities through to decommissioning.
What this does not cover
stated in the document's own scope- Covers health software products placed on the market without dedicated hardware; software embedded in or controlling a physical medical device is addressed through IEC 62304 within the device's own standards.
- A product standard: the development life-cycle processes it requires are defined by IEC 62304, not duplicated within it.
- Addresses product safety and fitness for use; whether a given health software product legally qualifies as a medical device is a regulatory classification question outside the standard.
Always verify against the current published text before relying on it for a submission or inspection.
Overview
IEC 82304-1 is the product safety standard for health software placed on the market without dedicated hardware — software products that run on general computing platforms, from software qualifying as a medical device to health software below the device threshold. Published in 2016, it addresses the software as a product across its whole life: establishing health software product requirements including intended use and use requirements, developing the software using the life-cycle processes of IEC 62304, validating the product against its use requirements, providing identification and accompanying documents for the user, and managing post-market activities through maintenance, revalidation, and decommissioning. Where IEC 62304 asks whether the software was engineered properly, 82304-1 asks whether the marketed product is safe and fit for its stated use.
Scope & applicability
Manufacturers of health software products intended to run on general computing platforms and placed on the market without dedicated hardware — including software qualifying as a medical device (SaMD) and health software below the device threshold. Embedded device software remains the province of IEC 62304 within its device context.
Legal basis & how it acquires force
An international consensus standard published as IEC 82304-1:2016 (Edition 1.0), a joint IEC/ISO health-software publication. It is voluntary until invoked through regulation or procurement: manufacturers use it to demonstrate product-level safety of standalone health software, and it operates alongside the harmonised device standards where the software qualifies as a medical device.
Document structure
| Part | Covers |
|---|---|
| Health software product requirements | Intended use, use requirements, and the system-level requirements for the software product |
| Software life cycle processes | Design and development of the software using IEC 62304 processes |
| Product validation | Validation of the health software product against its use requirements |
| Identification and accompanying documents | Product identification, instructions, and information provided to the user, including installation and security information |
| Post-market activities | Maintenance, revalidation on change, and end-of-life including decommissioning |
Key requirements
- Health software product requirements established, including intended use and use requirements
- The software life-cycle processes of IEC 62304 applied for design and development
- Product validation demonstrating the software meets its use requirements
- Accompanying documents and information for the user, including installation and security information
- Post-market activities covering maintenance, revalidation on change, and end-of-life/decommissioning
Implementation tips
- Use 82304-1 as the wrapper and 62304 as the engine: the product standard tells you what must be true of the marketed product; the process standard tells you how the software inside it is developed
Revision notes
Edition 1.0 published 2016; it delegates the development life cycle to IEC 62304 and is complemented on security by IEC 81001-5-1.
Where this control fails
live FDA enforcementLive FDA recalls SPEQ maps to this standard’s topics — a SPEQ interpretation, not an FDA classification.
International alignment
The standard wraps IEC 62304: it delegates design and development to the 62304 life-cycle processes and adds the product-level obligations — use requirements, product validation, user information, post-market management — that a process standard does not carry. Security activities across the same life cycle are supplied by IEC 81001-5-1, and risk management runs on ISO 14971. For software qualifying as SaMD, the IMDRF framework (N10/N12) provides the regulatory vocabulary while 82304-1 provides the product-engineering skeleton.
IEC 82304-1:2016: frequently asked questions
Quick answers to common questions about IEC 82304-1:2016.
What is IEC 82304-1?
The international standard for the safety of health software products placed on the market without dedicated hardware — standalone software running on general computing platforms. Published in 2016, it covers product requirements, development per IEC 62304, product validation, user information, and post-market activities.
How does IEC 82304-1 differ from IEC 62304?
62304 is a process standard for developing medical-device software; 82304-1 is a product standard for marketed health software. 82304-1 uses 62304 for the development work and adds what the process standard lacks: product-level validation against use requirements, accompanying documents, and end-of-life management.
Does IEC 82304-1 apply only to medical devices?
No. Its scope is health software generally — including products that qualify as software as a medical device and health software that falls below the device threshold. Regulatory classification determines which legal regime applies; the standard's product-safety framework serves both.
What post-market obligations does IEC 82304-1 include?
Maintenance of the marketed product, revalidation when the software changes, and managed end-of-life — including decommissioning and the information users need when support ends.
This standard in practice
Recall domain is a SPEQ mapping of this standard’s topics, not an FDA classification.