Both, European and US regulations, distinguish three different categories of medical device software, the software safety classes accordingly to IEC 62304 respectively the FDA levels of concern. Frequently manufactures confuse both.
IEC 62304:2006 + Amendment 2015 define the software safety classes as follows:
„The SOFTWARE SYSTEM is software safety class A if:
The SOFTWARE SYSTEM is software safety class B if:
The SOFTWARE SYSTEM is software safety class C if:
IEC 62304:2006 + A1:2015
The following diagram summarizes this classification:
The FDA defines the Levels of Concern as follows:
FDA guidance document: Content of the premarket submission for software contained in medical devices
Please note that both definitions primarily are dependent on the severity of potential harms and not on risks. I.e. the probability of this harms is not what determines the software safety class respectively the level of concern.
The IEC 62304 introduces the software safety classes to determine the extent of documentation to be complied.
Table 1: The documentation depends on the safety class IEC 62304. E.g. for class A software no software architecture (chapter 5.3) is required. The numbers correspond to the chapters of the standard.
The FDA uses the levels of concern to determine the amount of documentation to be submitted. I.e. the level of concern does not influence the documentation to be compiled.
|Level of concern||x||x||x|
|Device hazard analysis||x||x||x|
|Software requirements specification||(x)||x||x|
|Architecture design chart||x||x|
|Software design specification||x||x|
|Description of software environment||x||x|
|Verification and Validation documentation||(x)||x||x|
|Revision level history||x||x||x|
If you market your products in the US, the software safety class is irrelevant. You have to document according to class C anyhow. Do not confuse compilation and submission of documents!
IEC 62304 permits a reduction of the software safety class by means that are external to the software only. Examples are:
The FDA expects measures to mitigate risks. However, the levels of concern are determined prior to these measures. I.e. a reduction of the level of concern does not impact the documentation to be submitted.