IEC 62304 Software Lifecycle Documentation Checklist
IEC 62304 defines the life cycle processes for medical device software. This checklist lists the documents and records a software file normally holds, grouped by life cycle stage, so you can see gaps before an audit or submission.
0 of 35 items complete
12 critical items still open - these are the highest-risk gaps.
Planning and classification
Requirements and architecture
Implementation and verification
Release
Maintenance, problem resolution and configuration
Each checked item scores one point. Treat unchecked critical items as findings to close before submission or audit. Which activities are mandatory depends on the software safety class, so mark items not applicable to your class with a documented rationale.
Optional software file completeness review
We can discuss how traceability between requirements, risks and tests is kept in your tools.
Optional. The tool and every export work without this. No spam.
How to use it
Work through each group with the software lead and quality engineer. For each item locate the controlled document or record and tick it only when you can point to the evidence. Mark critical items first, since they are the ones most likely to cause a finding. Export the result to PDF or Excel and file it with the design history as a periodic completeness review.
- Tick only items with evidence you can show
- Close critical items before others
- Record not applicable items with a rationale
Software safety classes
The standard assigns Class A when no injury or damage to health is possible, Class B when non-serious injury is possible, and Class C when death or serious injury is possible, after taking risk controls outside the software into account. The class drives the depth of documentation: detailed design and unit verification are expected at higher classes, while Class A requires lighter activities. Classification should be reviewed whenever risk analysis changes.
How it fits with risk and regulation
IEC 62304 expects software risk management to run within the ISO 14971 process, and regulators generally ask for a software description, hazard analysis, requirements, architecture, verification and a traceability matrix in a submission. Cybersecurity expectations are growing, so many teams add security risk management and a software bill of materials to the same file.
Common mistakes
Teams often write documents after the code instead of in sequence, skip traceability from risk controls to tests, list SOUP without versions or known anomalies, and let configuration slip so the tested build cannot be reproduced. Agile approaches are compatible with the standard when the required outputs and reviews are produced and controlled.
Frequently Asked Questions
Does IEC 62304 apply to all software?
It applies to software that is a medical device or part of one, including software as a medical device. It does not replace the need for the manufacturer to decide what is in scope for their product.
Can I use an agile process?
Yes. The standard does not mandate a model. You must still plan, document requirements, verify, manage risk and configuration, and keep the outputs under control for each release.
What is SOUP?
Software of unknown provenance is software item not developed for use in the medical device, such as an operating system or third party library. You identify it, specify requirements for it and monitor its known anomalies.
Is this checklist sufficient for FDA submission?
It is a documentation completeness aid. FDA software guidance sets submission content by documentation level, so read the current guidance for your device.
If software release and problem records need to link to your ERP and complaint data, Netray can discuss how to connect them.
Related Tools
Medical Device Standards Reference Table (ISO, IEC, ASTM)
A searchable lookup of the standards that medical device manufacturers cite in the QMS, design file and technical documentation, with area and typical use.
Compliance & ContractsEU MDR Annex VIII Classification Rules Reference
A searchable summary of the 22 classification rules in Annex VIII of Regulation (EU) 2017/745 with the class each rule typically leads to.
Compliance & ContractsEU MDR Technical Documentation Readiness Assessment
A short self-assessment of how complete and current your technical documentation is against the structure of MDR Annexes II and III.
Compliance & ContractsFDA 21 CFR 820 to ISO 13485 Clause Crosswalk
Map each 21 CFR 820 quality system topic to the corresponding ISO 13485 clause to speed up QMSR gap assessments and procedure rewrites.
More Quality & Inspection tools
See all- CAPA Corrective and Preventive Action Form Template
- Device History Record (DHR) Template
- ISO 13485 Internal Audit Checklist
- Process Validation IQ OQ PQ Template
- Medical Device Complaint Handling Form Template
- ISO 14971 Risk Management Worksheet
- Sterilization Load Record Template
- Medical Device Design Verification Protocol Template
- Medical Device Supplier Evaluation Scoring Worksheet
Keep exploring
Free tools
- Medical Device Standards Reference Table (ISO, IEC, ASTM)A searchable lookup of the standards that medical device manufacturers cite in the QMS, design file and technical documentation, with area and typical use.
- ISO 13485 Quality Plan Template with Medical Device File ExampleA fill-in ISO 13485 quality plan with a medical device file content example and a clause compliance checklist table.
- Medical Device Design Verification Protocol TemplateFill-in design verification protocol with objective, samples, test method, acceptance criteria, deviations and approval lines.
Guides
- ISO 13485 ERP Requirements for Medical Device Contract ManufacturersWhat ISO 13485 and FDA QMSR actually require of an ERP at a medical device contract manufacturer: records, traceability, change control and software validation.
- Using AI to Review Device History Records Before Lot ReleaseHow a medical device contract manufacturer can use private AI to pre-check device history records for missing entries, cert mismatches and out-of-spec data.
- Field Service ERP Work Order Lifecycle ManagementManage the complete work order lifecycle from creation through completion with integrated ERP costing, scheduling, and technician dispatch workflows.
AI on your ERP
- AI on Your ERP for Medical Device Manufacturing Under QMSR and ISO 13485Private AI on your ERP for medical device makers: DHR assembly, UDI, complaints, CAPA and supplier controls under FDA QMSR and ISO 13485, kept on your own infrastructure.
- AI on Infor SyteLine for Medical Device Manufacturers: Genealogy, DHR and Audit EvidencePrivate AI on Infor SyteLine for medical device makers: lot and serial genealogy, DHR assembly, UDI and QMSR evidence, with human approval on every write.
Software
- SiliconExpertSiliconExpert is an electronic component intelligence service covering lifecycle, compliance and cross-references. See modules, integrations and alternatives.
- Critical Manufacturing MESCritical Manufacturing MES explained: a modular MES for semiconductor, electronics and medical device plants, with integrations, limitations and alternatives.