IEC 82304-1:2016

Overview

IEC 82304-1:2016 - Health software - Part 1: General requirements for product safety - is an international joint IEC/ISO standard that defines safety and security requirements for software-only health products intended to run on general computing platforms (i.e., without dedicated hardware). The standard focuses on manufacturer responsibilities across the entire software lifecycle: design, development, validation, installation, maintenance and disposal. It clarifies scope (software-only products), limits (embedded software in dedicated medical devices is out of scope), and the need for documented processes to assure product safety.

Key topics and technical requirements

• Risk management: All health software requires a risk management process; software that can contribute to hazardous situations must have risk controls to prevent or reduce harm.
• Software life-cycle processes: Requirements reference and build on established software development practices (see IEC 62304) to ensure consistent development, verification and maintenance.
• Verification and validation (V&V): The standard requires plans, documented verification of requirements, and validation of intended use, including validation reports and re-validation after significant changes.
• System and use requirements: Manufacturers must define and verify product use requirements, system requirements, and manage updates and changes.
• Identification and accompanying documentation: Products must include identification, instructions for use, and technical descriptions to support safe deployment.
• Post-market activities: Obligations include software maintenance, post-market communication, re-validation, decommissioning and disposal processes.
• Security and safety alignment: Emphasis on safety and security as complementary requirements for health software products placed on the market.

Practical applications

• Use IEC 82304-1 when developing, releasing or maintaining health-related software products such as clinical decision-support apps, patient self-care apps, telehealth software, and software-as-a-medical-service offerings that run on standard PCs, tablets, or smartphones.
• Apply the standard to create compliant development policies, V&V plans, risk assessments, user instructions, and post-market surveillance programs.
• Helpful for preparing technical documentation for regulators, purchasers, or certification bodies and for aligning product development with recognized safety expectations.

Who should use this standard

• Software manufacturers and product managers of health apps and clinical software
• Software engineers, QA and validation teams
• Regulatory affairs, clinical safety officers, procurement specialists and conformity assessment bodies
• Engineers integrating third‑party health software into care pathways

Related standards

• IEC 62304 (software life-cycle processes) - referenced for development processes
• IEC 60601 series - for combined products where software is part of a physical medical device

Keywords: IEC 82304-1, health software, medical device software, software lifecycle, risk management, product safety, software validation, post-market surveillance, IEC 62304.