IEC 62304 edition 2 update

IEC 62304 edition 2, what should manufacturers know?

The second edition of the IEC 62304 standard is currently being revised. The revision is not a minor facelift, but rather a re-examination of the scope of the standard, the risk-based process and software development practices in many respects.

One of the most significant fundamental change will be the expansion of the scope from medical device software to health software more generally. This includes, for example, software included in a medical device, Software as a Medical Device (SaMD), and certain stand-alone healthcare software products.

Another major change is the replacement of the current software safety classes A, B and C with two Software Process Rigor Levels I and II. Level I applies to situations where a software defect cannot cause significant harm or where a risk management measure external to the software prevents harm. Other software falls under Level II.

The original draft had a broad, normative AI planning section. Contrary to previous information, the normative AI planning section has been removed and AI guidance is mainly left to the informative Annex E and supplementary AI and data management standards. In practice, software utilizing artificial intelligence is handled according to the normal software processes of IEC 62304, and there does not appear to be a separate parallel process for AI development in the standard.

At the same time, the position of quality and risk management will be strengthened. A quality management system will be required. The requirement does not necessarily mean that all health software manufacturers' systems should be certified in accordance with ISO 13485, but software development must take place within a controlled quality system. The use of an appropriate product-level risk management process will also be required for all software covered by the standard.

Other changes that are important from a practical perspective include mandatory static code analysis of Level II software, identification of typical failure classes related to programming technology, strengthening of the maintenance process, and the requirement for controlled shutdown of cloud and software services operated by the manufacturer. Annex G will offer the gap analysis method as an informative recommendation for the assessment of legacy software.

The final content of the standard has therefore not yet been locked.

Although the standard is still a couple of years away from publication, manufacturers should still prepare now. In particular, software classification criteria, architecture separation solutions, risk traceability, SOUP management, static code analysis, and maintenance and service termination processes should be assessed well in advance. At the time of publication of the standard, it is too late to notice that the development process needs a major overhaul, as standards rarely wait politely behind the door.

Karkinen Consulting follows the development of IEC 62304 Edition 2 and offers organizations training, gap assessments, and practical support for updating software lifecycle processes.

Quality and Regulatory Consulting

Expert services in medical device regulation and quality compliance.

contact information

Karkinen Consulting Oy, Helsinki, Finland
Business ID: 3103786-9
info@karkinen.com

© 2026. All rights reserved.