ISO 13485 and IEC 62304 Integration
ISO 13485 and IEC 62304 integration means integrating IEC 62304 into ISO 13485 QMS processes, so manufacturers can control software development, maintenance and risk management within one quality system. ISO 13485 and IEC 62304 are two key standards relevant to the design, development, verification and maintenance of software medical devices. While they address different aspects of the medical device lifecycle, they are closely related and complementary in ensuring the quality and safety of software medical devices.
How Do ISO 13485 and IEC 62304 Work Together?
IEC 62304 sets requirements for software life cycle processes, including development planning, requirements analysis, architectural design, implementation, testing, verification and maintenance. It does not cover overall medical device validation, which is handled under the wider quality system. ISO 13485 outlines the requirements for establishing and maintaining a medical device quality management system, including management responsibility, resource management, product realisation, measurement, analysis, and improvement.
Organisations developing software medical devices must integrate the requirements of IEC 62304 into their quality management system established according to ISO 13485:2016. This integration ensures that software development processes are aligned with the organisation’s quality objectives and comply with regulatory requirements.
Both standards emphasise the importance of risk management in the development and maintenance of medical devices. While IEC 62304 provides specific guidance on software risk management, ISO 13485 requires organisations to establish processes for identifying, evaluating, and mitigating risks throughout the product lifecycle, including those related to software.
What Does a Software QMS Add to ISO 13485?
A software QMS is an ISO 13485 quality system extended with the processes that IEC 62304 requires: software development planning, requirements, architecture, unit and integration verification, release, maintenance, configuration management and problem resolution. It applies to standalone software (SaMD), firmware and software in a medical device, and to IVD software.
In practice the extension is done inside existing procedures rather than beside them. Design and development control (ISO 13485 clause 7.3) gains software-specific inputs, outputs and verification steps; risk management (7.1) gains the software hazard analysis of IEC 62304 Clause 7; identification and traceability (7.5.8 and 7.5.9) gain configuration management; CAPA (8.5) gains software problem resolution.
The result is one document set that an ISO 13485 auditor, a Notified Body reviewer and an FDA reviewer can each follow without a separate software manual.
Which ISO 13485 Clauses Map to IEC 62304?
The table lists the 43 procedures in a typical ISO 13485:2016 quality system and shows, for each one, the IEC 62304 clause that it must also satisfy when the device contains software. Where the IEC 62304 column says “QMS only”, the procedure is a quality-system requirement with no software-specific counterpart. Eight of the 43 procedures carry software requirements; the heaviest is Design and Development (7.3), which absorbs the whole of IEC 62304 Clause 5 and the maintenance process in Clause 6.
| Sl.No | Cl. 13485 | Title of the Procedure | Cl. 62304 | Title of the Procedure |
|---|---|---|---|---|
| 01 | 4.1.5 | Outsourced Process | – | QMS only |
| 02 | 4.1.6 | Validation of the application of software used in QMS | – | QMS only |
| 03 | 4.2.4 | Control of Documents | – | QMS only |
| 04 | 4.2.5 | Control of Records | – | QMS only |
| 05 | 5.6 | Management Review | – | QMS only |
| 06 | 6.2 | Human Resources | – | QMS only |
| 07 | 6.3 | Infrastructure | – | QMS only |
| 08 | 6.3 | Maintenance Activities | – | QMS only |
| 09 | 6.4.1 | Control of Work Environment | – | QMS only |
| 10 | 6.4.1 a | Health, Cleanliness and Clothing | – | QMS only |
| 11 | 6.4.2 | Control of Contaminated or Potentially Contaminated Product | – | QMS only |
| 12 | 6.4.2 | Contamination Control for Sterile Medical Devices | – | QMS only |
| 13 | 7.1 | Risk Management | 7 | Software Risk management process |
| 14 | 7.3 | Design and Development | 5.1 | Software Development Planning |
| 5.2 | Software requirements analysis | |||
| 5.3 | Software architectural design | |||
| 5.4 | Software detailed design | |||
| 5.5 | Software unit implementation and verification | |||
| 5.6 | Software integration and integration testing | |||
| 6 | Software maintenance process | |||
| 6.3 | Modification implementation | |||
| 15 | 7.3.7 | Clinical Evaluation | – | QMS only |
| 16 | 7.3.8 | Design & Development Transfer | 5.8 | Software Release |
| 17 | 7.3.9 | Design & Development Changes | 6.2.3 6.2.4 6.2.5 |
Analyse change requests Change request approval Communicate to users and regulators |
| 5.7.1 | Establish tests for software requirements | |||
| 5.7.3 | Retest after changes | |||
| 18 | 7.4 | Purchase Process | – | QMS only |
| 19 | 7.5.2 | Cleanliness of the Product | – | QMS only |
| 20 | 7.5.3 | Installation and Acceptance Criteria | – | QMS only |
| 21 | 7.5.4 | Servicing Activities | – | QMS only |
| 22 | 7.5.6 | Validation of processes for production and service provision | – | QMS only |
| 23 | 7.5.6 | Validation of the software used in production. | – | QMS only |
| 24 | 7.5.7 | Validation of processes for sterilization and sterile barrier systems | – | QMS only |
| 25 | 7.5.8 | Product Identification | 8 | Software configuration management process |
| 26 | 7.5.8 | Identification of returned medical device | – | QMS only |
| 27 | 7.5.9 | Traceability | 8 | Software configuration management process |
| 28 | 7.5.11 | Product Preservation | – | QMS only |
| 29 | 7.6 | Monitoring and measuring | – | QMS only |
| 30 | 7.6 | Calibration | – | QMS only |
| 31 | 7.6 | Validation of Software used for Monitoring and Measurement | – | QMS only |
| 32 | 8.2.1 | Feedback process | 6.2 | Problem and modification analysis |
| 33 | 8.2.1 | Post Market Surveillance | – | QMS only |
| 34 | 8.2.1 | Post Market Clinical Follow up | – | QMS only |
| 35 | 8.2.2 | Handling of Customer Complaints | – | QMS only |
| 36 | 8.2.3 | Notifying the regulatory authorities | – | QMS only |
| 37 | 8.2.4 | Internal audit | – | QMS only |
| 38 | 8.2.6 | Monitoring & Measurement of Product | – | QMS only |
| 39 | 8.3 | Nonconforming product | – | QMS only |
| 40 | 8.3.3 | Advisory Notice | – | QMS only |
| 41 | 8.3.4 | Rework | – | QMS only |
| 42 | 8.4 | Analysis of Data | – | QMS only |
| 43 | 8.5.2, 8.5.3 | Corrective and Preventive Action | 9 | Software Problem Resolution Process |
Procedures
Do You Need ISO 13485 Certification to Comply with IEC 62304?
No. IEC 62304 assumes that software is developed inside a controlled quality system such as ISO 13485, but certification to ISO 13485 is not a condition for implementing the standard. IEC 62304 is not legally mandatory in itself either: the FDA recognises it as a consensus standard, and using consensus standards in premarket submissions is voluntary.
What regulators do require is a controlled software life cycle. In the EU, MDR Annex I Section 17.2 and IVDR Annex I Section 16.2 ask for software developed and validated according to the state of the art, and a Notified Body audits the quality system under Annex IX whether or not an ISO 13485 certificate is held. In the US, FDA’s QMSR (21 CFR Part 820) incorporates ISO 13485:2016 by reference and FDA inspects against it. See our software CE marking service for the full EU route.
IEC 62304 therefore sets the software life cycle requirements, while ISO 13485 defines the quality management framework around them: design control, risk management, configuration control and maintenance. Procedures that satisfy both should be written once, for your organisation, and maintained inside the QMS rather than as a separate software manual.
Which IEC 62304 Clauses Apply to Class A, B and C?
IEC 62304 aims to standardize the software development lifecycle (SDLC) processes specifically tailored for medical device software (firmware and standalone software). It establishes a set of requirements that help organizations manage the complexities and risks associated with medical software development, ensuring that the final product meets necessary safety and performance criteria. The table below shows which activities apply to each class. Software safety classes are A (no injury or damage to health possible), B (non-serious injury possible) and C (death or serious injury possible). SOUP means software of unknown provenance.
| IEC 62304 activity | Class A | Class B | Class C |
|---|---|---|---|
| Development planning (5.1), requirements analysis (5.2), unit implementation (5.5.1), software system testing (5.7), release (5.8) | Required | Required, plus planning items 5.1.5, 5.1.10 and 5.1.11, unit verification 5.5.2, 5.5.3 and 5.5.5, release records 5.8.1 to 5.8.8 | As Class B, plus 5.1.4 and 5.5.4 |
| Architectural design (5.3), detailed design (5.4), integration and integration testing (5.6) | Not required | Required | Required, plus 5.3.5 and 5.4.2 to 5.4.4 |
| Maintenance (6), risk management (7), configuration management (8), problem resolution (9) | Required; in Clause 7 only 7.4.1 applies; 6.2.3 not required | Required | Required |
Amendment 1 (2015) extended software system testing (5.7) to Class A; only 5.7.2 remains limited to Classes B and C. The full clause-by-clause split across all 16 procedures, with who does what, is on our IEC 62304 Consultants page.
Work with I3CGLOBAL
Integrated ISO 13485 and IEC 62304 Procedures from I3CGLOBAL
We support SaMD companies with documentation, SOP and risk management.
Request your proposal
Contact our team about ISO 13485 and IEC 62304 integration for your software medical device.
FAQs
ISO 13485 and IEC 62304: Frequently Asked Questions
How long does it take to integrate IEC 62304 into an existing ISO 13485 QMS?
Many projects take around 3 to 4 months. When the ISO 13485 system is already certified, only the eight procedures that carry software requirements change, so the work is shorter; building both systems from scratch takes longer. The software safety class and the amount of existing design history drive the difference.
Do I need ISO 13485 certification to use IEC 62304?
No. IEC 62304 assumes software is developed inside a quality system but does not require a certificate. For the EU, a Notified Body audits your QMS under MDR Annex IX whether or not you hold an ISO 13485 certificate; for the US, the QMSR incorporates ISO 13485:2016 by reference and FDA inspects against it. Certification is the usual way to show conformity, not a legal condition.
Can one SOP cover both ISO 13485 clause 7.3 and IEC 62304 Clause 5?
Yes, and most manufacturers do it this way. A single design and development procedure can carry the ISO 13485 stages (inputs, outputs, review, verification, validation, transfer and changes) and add the IEC 62304 activities as software-specific steps inside each stage. Auditors accept this as long as every IEC 62304 clause that applies to your safety class can be traced to a step and a record.
How does I3CGLOBAL support ISO 13485 and IEC 62304 integration?
We provide gap analysis, process implementation, documentation help and compliance assessment. We use a clause mapping like the integration table on this page to connect software lifecycle procedures with your quality management system.
Which version of IEC 62304 applies?
The current version is IEC 62304:2006 with Amendment 1:2015. A second edition (retitled “Health software – software life cycle processes”) is still a committee draft; as of November 2026 the IEC forecasts publication in 2028, so Edition 1.1 remains the version to apply and the one recognised by the FDA.
Can IEC 62304 also be integrated with FDA QMSR or MDSAP?
Yes. Our services cover integration with EN ISO 13485:2016, FDA QMSR (21 CFR Part 820), a combined ISO 13485 and QMSR system, and MDSAP. The right scope depends on your target markets.