IEC 62304 Edition 2 now using Rigor Levels
The new Standard and its mapping with Risk, Cybersecurity, and AI
Expected for a long time the overhaul of the IEC 62304 software process for medical devices was published in August 2026. In practice, we avoided Class B devices for a while. Why? The ambiguity the class created was not worth its benefits or savings in work. Furthermore mapping the software process with risk and cybersecurity was never easy. This all is about to change and the investment of this transition is a clear winner.
Introduction
The IEC 62304 Edition 2 final standard was published on August 12, 2026. It replaces the old three-tier Software Safety Classification (Classes A, B, and C) with a simplified two-tier system renamed Software Process Rigor Levels (Level I and Level II). This shift eliminates the complex, highly debated distinction between “non-serious” and “serious” injuries. Instead, it evaluates software development processes based strictly on whether any harm is possible at all.
Summary of Changes: Old vs. New IEC 62304 Standard
|
Metric / Feature |
Old Standard (Ed. 1 / 1.1) |
New Standard (Edition 2 / 2026) |
|
Terminology |
Software Safety Classification |
Software Process Rigor Level |
|
Number of Tiers |
Three tiers (Class A, B, C) |
Two tiers (Level I, Level II) |
|
Low-Risk Tier |
Class A: No injury or damage to health is possible. |
Level I: Replaces Class A. Still covers software where no harm is possible. |
|
High-Risk Tier |
Split into Class B (non-serious injury) and Class C (serious injury or death). |
Level II: Subsumes both Class B and Class C into a single high-risk level. |
|
Scope of Harm |
Restricted mostly to “harm to patients, operators, or other persons”. |
Aligned with ISO 14971; expanded to include property and environmental damage. |
The Impact on Developers & Process Rigor
The primary goal of collapsing the mid-tier classification is to shorten decision-making trees, eliminate regulatory “gray zones,” and streamline compliance with parallel cybersecurity standards like IEC 81001-5-1. [1, 2]
- For Legacy Class A Manufacturers: Little changes regarding baseline engineering processes. However, the new edition mandates architectural planning requirements for all software levels, meaning Level I software now requires foundational architectural oversight that Class A previously bypassed. [2, 3]
- For Legacy Class B Manufacturers: Process requirements increase significantly. Because Class B is now merged into Level II, these software products must step up to the development, testing, and detailed documentation rigor previously reserved exclusively for Class C. [1, 2]
- For Legacy Class C Manufacturers: Process requirements remain essentially the same, as they were already practicing the highest tier of life cycle rigor and deep architectural testing. [1, 2]
Broadened Scope: AI & Health Software [1]
Beyond the A/B/C classification changes, the 2026 revision expands the baseline definitions of software: [1, 2]
- Health Software Scope: The standard’s boundary shifts from strictly “medical device software” to a broader umbrella of “health software,” directly aligning with standalone software frameworks like IEC 82304-1.
- Artificial Intelligence: Edition 2 explicitly integrates an AI Development Lifecycle (AIDL). Manufacturers building AI, machine learning, or deep learning software must now document specific data collection management protocols, training dataset verifications, and post-market model tuning plans. [1, 2]
To successfully adapt to this updated compliance landscape, it is helpful to establish where your software currently sits. Would you like to explore how to transition your current Class B documentation to meet the new Level II requirements, or do you need details on the specific AI lifecycle (AIDL) clauses?
62304 and Secure Lifecycle requirements
Structural Alignment: IEC 62304 v2 and IEC 81001-5-1 [1]
The 2026 overhaul of IEC 62304 was directly designed to run in parallel with the healthcare cybersecurity framework IEC 81001-5-1. Rather than treating security as an isolated post-development activity, the two standards align structurally to enforce a single “Security-by-Design” and “Safety-by-Design” workflow. [1, 2, 3, 4].
Diagram: Direct mapping of IEC 62304 Ed.2 and IEC 81001-5-1.
Key Touchpoints of the Integration:
- Two-Level Risk Match: IEC 81001-5-1 relies on a binary two-tier system. By collapsing Class B and C into Level II, IEC 62304 Edition 2 creates a direct 1:1 risk mapping across both frameworks. [1, 2, 3]
- Requirement to Security Pairing: As you define software functional requirements (Clause 5.1), you are expected to simultaneously execute threat modelling under IEC 81001-5-1 to identify cyber-vulnerabilities that could compromise patient safety. [1, 2]
- Architectural Bills of Materials: When creating software architecture files, you must now simultaneously build an automated Software Bill of Materials (SBOM). This ensures every open-source library or Software of Unknown Provenance (SOUP) is tracked for both safety bugs and cybersecurity vulnerabilities. [1, 2]
- Unified Maintenance Release: Software bug fixes (Clause 6) now share a unified release loop with cybersecurity patch management. A security patch cannot be deployed without verifying it hasn’t introduced an unintended safety regression. [1]
Implementation and Conclusion
62304 Ed. 1 Class B Transition
Transitioning legacy Class B software to Level II process rigor requires a substantial documentation upgrade. Because Level II merges both former Class B and Class C workflows, you must now author detailed software architecture diagrams, provide comprehensive unit-level test verification, and maintain end-to-end multi-tier traceability down to specific lines of code or code modules. [1, 2, 3, 4]
The AI Development Lifecycle (AIDL)
If your device integrates artificial intelligence, you must also adopt the newly formalised AI Development Lifecycle (AIDL). This requires your team to treat data selection as a distinct design control, establishing auditable logs for training vs. validation data splits, verifying dataset diversity to minimize bias, and building predefined versioning protocols to safely handle post-market model drift. [1, 3]
