Side-by-side breakdown
| Dimension | IEC 62304 | IEC 81001-5-1 |
|---|---|---|
| Scope | Software lifecycle processes for medical device software. | Health software security activities across the lifecycle. |
| Current edition | IEC 62304:2006/AMD1:2015. | IEC 81001-5-1:2021. |
| Safety classification | Class A / B / C by potential harm. | Risk-based; layers on top of 62304 safety class. |
| Activities | Planning, requirements, architecture, detailed design, implementation, verification, release, maintenance. | Secure-by-design, threat modeling, vulnerability management, security testing, secure update, postmarket monitoring. |
| FDA recognition | Recognized consensus standard. | Recognized; cited in 2026 premarket guidance as the SPDF underpinning. |
| Relationship | Foundational SDLC standard. | Cybersecurity overlay that maps each activity to a 62304 lifecycle stage. |
When to use which
Update your software development plan to reference both standards. Every 62304 activity should have an 81001-5-1 cybersecurity counterpart - design review includes threat-model review, verification includes security testing, release includes SBOM generation.
If you already have a mature 62304 program, adding 81001-5-1 is mostly a documentation overlay rather than a process rewrite. Start with the gap assessment.