Overview
IEC 82304-1:2016 - Health software - Part 1: General requirements for product safety - is an international joint IEC/ISO standard that defines safety and security requirements for software-only health products intended to run on general computing platforms (i.e., without dedicated hardware). The standard focuses on manufacturer responsibilities across the entire software lifecycle: design, development, validation, installation, maintenance and disposal. It clarifies scope (software-only products), limits (embedded software in dedicated medical devices is out of scope), and the need for documented processes to assure product safety.
Key topics and technical requirements
- Risk management: All health software requires a risk management process; software that can contribute to hazardous situations must have risk controls to prevent or reduce harm.
- Software life-cycle processes: Requirements reference and build on established software development practices (see IEC 62304) to ensure consistent development, verification and maintenance.
- Verification and validation (V&V): The standard requires plans, documented verification of requirements, and validation of intended use, including validation reports and re-validation after significant changes.
- System and use requirements: Manufacturers must define and verify product use requirements, system requirements, and manage updates and changes.
- Identification and accompanying documentation: Products must include identification, instructions for use, and technical descriptions to support safe deployment.
- Post-market activities: Obligations include software maintenance, post-market communication, re-validation, decommissioning and disposal processes.
- Security and safety alignment: Emphasis on safety and security as complementary requirements for health software products placed on the market.
Practical applications
- Use IEC 82304-1 when developing, releasing or maintaining health-related software products such as clinical decision-support apps, patient self-care apps, telehealth software, and software-as-a-medical-service offerings that run on standard PCs, tablets, or smartphones.
- Apply the standard to create compliant development policies, V&V plans, risk assessments, user instructions, and post-market surveillance programs.
- Helpful for preparing technical documentation for regulators, purchasers, or certification bodies and for aligning product development with recognized safety expectations.
Who should use this standard
- Software manufacturers and product managers of health apps and clinical software
- Software engineers, QA and validation teams
- Regulatory affairs, clinical safety officers, procurement specialists and conformity assessment bodies
- Engineers integrating third‑party health software into care pathways
Related standards
- IEC 62304 (software life-cycle processes) - referenced for development processes
- IEC 60601 series - for combined products where software is part of a physical medical device
Keywords: IEC 82304-1, health software, medical device software, software lifecycle, risk management, product safety, software validation, post-market surveillance, IEC 62304.
