Medical device software development standards in 2026 rely on two foundational pillars: IEC 62304 for software lifecycle processes and ISO 13485 for quality management systems (QMS). IEC 62304 defines how healthcare software is classified, designed, verified, and maintained based on potential patient harm, while ISO 13485 establishes organizational governance, documentation, and design controls.
A rejected technical file under the EU Medical Device Regulation (MDR) or an incomplete FDA submission can delay market entry by 6 to 12 months due to notified body backlogs, consuming funding rounds for growing HealthTech startups. Establishing full traceability from user requirements to test execution from sprint one prevents expensive architectural retrofits and regulatory rejections.
For European companies targeting global markets, exploring our guide on custom healthcare software development helps align software architecture with EU compliance mandates.
What Does IEC 62304 Require From Your Engineering Team?
IEC 62304 establishes software safety classes based on potential risk of harm:
-
Class A: Cannot cause harm or injury.
-
Class B: Can cause non-serious injury.
-
Class C: Can cause serious injury or death.
The software safety class dictates your documentation and verification burden, ranging from high-level testing plans in Class A to full unit-level verification and architectural traceability in Class C.
SOUP & Traceability Management
Third-party libraries and frameworks are classified as SOUP (Software of Unknown Provenance). A modern SaMD (Software as a Medical Device) codebase utilizing open-source dependencies requires a managed SOUP register documenting version locking, functional rationale, vulnerability scanning, and risk evaluations.
Every system requirement must link to a specific architectural module, code unit, test case, and test execution result. Teams delivering Class C software typically allocate 20% to 30% of total engineering capacity to verification and documentation rigor.
Building an ISO 13485-Ready Development Process
ISO 13485 governs organizational quality management and design controls. For software engineering teams, compliance centers on structured design phases:
-
Document & Record Control: Version-controlled specifications, code reviews, and test outputs backed by formal approval workflows.
-
Phase-Gate Design Reviews: Scheduled formal reviews verifying design inputs match design outputs prior to milestone progression.
-
Toolchain Validation: Documented proof that critical development tools (Git, Jira, CI/CD deployment pipelines) operate reliably for their intended use.
-
Risk Management & CAPA: ISO 14971 risk management integration paired with Corrective and Preventive Action (CAPA) tracking for post-release defects.
EU MDR Rule 11 and FDA SaMD Regulations in 2026
Under EU MDR Rule 11, most diagnostic or therapeutic software falls into Class IIa or higher, requiring notified body review rather than self-declaration. Teams targeting CE marks should anticipate a 9-to-18-month review timeline from design freeze to market launch.
In the US market, the FDA aligns with IMDRF risk frameworks and recognizes IEC 62304 as a consensus standard. Additionally, Section 524B of the FD&C Act mandates a Cybersecurity Plan and a Software Bill of Materials (SBOM) in CycloneDX or SPDX formats for all connected medical devices.
When building cross-platform healthcare applications that meet strict regulatory frameworks, see our analysis on custom mobile application development to learn how to isolate patient interfaces from core calculation engines.
Architectural Topology: Safety Segregation & SOUP Control
Isolating high-risk components from lower-risk modules significantly lowers verification overhead. For example, isolating a Class C dosing algorithm behind a strict REST API boundary from a Class A analytics interface reduces Class C documentation volume by 40% to 60%.
Technical Execution Checklist:
-
Dependency & SBOM Management: Lock dependency versions and generate automated SBOMs on every build pipeline run to monitor CVE vulnerability databases.
-
Automated CI/CD Validation: Enforce static code analysis (SAST), dependency scanning, and mandatory 90%+ unit test coverage gates on Class C components.
-
Cybersecurity (IEC 81001-5-1): Perform threat modeling, penetration testing, and maintain 99.9% uptime with structured logging for post-market surveillance.
Moving from Technical Debt to a Compliant Roadmap
Most software teams do not start from scratch; they manage existing products with legacy technical debt. Conducting a gap analysis maps current engineering workflows against IEC 62304 and ISO 13485 requirements, ranking gaps by audit risk to integrate remediation directly into sprint backlogs.
Bugloos provides an objective Code & Architecture Audit for HealthTech companies. We review your codebase, SOUP registers, toolchain validation, and regulatory documentation to deliver a prioritized remediation roadmap.
(Ready to pass notified body reviews and prepare your technical file? Request a Code & Architecture Audit with our technical team today.)
Frequently Asked Questions
What is the difference between IEC 62304 and ISO 13485?
IEC 62304 is a software lifecycle standard governing how medical device software is planned, built, verified, and maintained. ISO 13485 is an organizational quality management standard governing document control, supplier management, and design reviews. ISO 13485 provides the quality system, while IEC 62304 defines the software engineering processes within it.
Does IEC 62304 apply to standalone mobile apps and SaMD?
Yes. Software with an independent medical purpose such as diagnostic algorithms or treatment calculators falls under IEC 62304. Under EU MDR Rule 11, most SaMD applications are classified as Class IIa or higher.
Can we use Agile methodologies under IEC 62304?
Yes. Agile and IEC 62304 are fully compatible when following guidance such as AAMI TIR45. The standard mandates defined process outputs and traceability, which agile teams fulfill by mapping documentation deliverables to sprint boundaries.
