Software that analyzes patient data for diagnostic purposes is frequently a medical device in its own right. Genomics interpretation platforms, digital pathology tools and clinical decision support are common examples. ISO 13485 applies, together with a family of software-specific standards.
The key standards
| Standard | Topic |
|---|---|
| IEC 62304 | Software lifecycle: development, maintenance, configuration, problem resolution and risk management for medical device software |
| IEC 62366-1 | Usability engineering, including use-related risk analysis and summative usability validation |
| IEC 82304-1 | Product-level requirements for standalone health software |
| IEC 81001-5-1 | Cybersecurity activities across the health software lifecycle |
| ISO 14971 | Risk management, applied to software hazards such as incorrect output or data loss |
IEC 62304 in brief
IEC 62304 assigns each software system a safety class (A, B or C) based on the harm that could result from failure. The class determines how much documentation and testing is required, from basic requirements and release procedures for Class A to detailed architecture, unit verification and integration testing for Class C. Third-party components, called SOUP (software of unknown provenance), must be identified, risk-assessed and monitored.
Cybersecurity
Regulators now treat cybersecurity as a safety issue. Expect to show threat modeling, secure design, a software bill of materials, vulnerability monitoring, a patching process and coordinated disclosure. For cloud-based products, data protection under GDPR and HIPAA must be designed in from the start.
Artificial intelligence
AI-enabled devices raise additional questions: how training and test data were selected and managed, how bias was assessed, how performance is monitored after release, and how model updates are controlled. In Europe, the AI Act adds requirements for high-risk AI systems, which include many AI-enabled medical devices and IVDs that need notified body review; these obligations are being phased in over the coming years. A well-built ISO 13485 system with strong data management and change control is the best foundation.
Practical tips for software companies
- Integrate quality into the development toolchain instead of running a parallel paper process
- Automate verification and keep traceability in your issue tracker
- Define clearly what counts as a significant change, and get regulatory input before major releases
- Separate research or RUO versions from clinical versions with clear labeling and configuration control
- Validate the tools used in the QMS itself, such as eQMS and issue tracking software
ISO 13485 guide
Overview · Understanding the Standard · Design and Development Controls · Risk Management (ISO 14971) · CAPA, Complaints and Feedback · Suppliers and Outsourcing · Software, Cybersecurity and AI · The Certification Roadmap · ISO 13485 and the FDA QMSR
Need help? Salto Partners guides diagnostics, genomics and medical device companies through ISO 13485 and IVDR. Send us an email and we will set up a conversation.
For general information only; not legal or regulatory advice. Regulations and deadlines change, so confirm current requirements with your notified body or regulatory counsel. Last updated October 2026.