Which statement correctly describes the relationship between IEC 62304 and ISO 14971?

Which statement correctly describes the relationship between IEC 62304 and ISO 14971?

• A. They are unrelated standards.
• B. ISO 14971 covers risk management for the device.
• C. IEC 62304 covers the software life cycle processes for medical device software; ISO 14971 covers risk management for the device overall.
• D. IEC 62304 covers safety training; ISO 14971 covers software development.

Answer: (C)

Understanding how these two standards fit together helps you see why one focuses on software activities and the other on overall device risk. IEC 62304 specifies the software life cycle for medical device software: how to plan, develop, test, maintain, and retire software, including how to classify software safety levels and manage software-related hazards during its life cycle. ISO 14971, on the other hand, provides the framework for risk management for the medical device as a whole—identifying hazards, assessing and controlling risks, and evaluating residual risk across the entire product, including its software. Together they are complementary. Risk management at the device level (ISO 14971) identifies and prioritizes hazards, some of which are software-related. The outputs and requirements from that risk assessment then guide the software life cycle activities outlined in IEC 62304, ensuring the software is developed and maintained with appropriate safety controls. In short, IEC 62304 covers the software life cycle; ISO 14971 covers device-wide risk management, and the software activities fit within that broader risk framework.

Understanding how these two standards fit together helps you see why one focuses on software activities and the other on overall device risk. IEC 62304 specifies the software life cycle for medical device software: how to plan, develop, test, maintain, and retire software, including how to classify software safety levels and manage software-related hazards during its life cycle. ISO 14971, on the other hand, provides the framework for risk management for the medical device as a whole—identifying hazards, assessing and controlling risks, and evaluating residual risk across the entire product, including its software.

Together they are complementary. Risk management at the device level (ISO 14971) identifies and prioritizes hazards, some of which are software-related. The outputs and requirements from that risk assessment then guide the software life cycle activities outlined in IEC 62304, ensuring the software is developed and maintained with appropriate safety controls. In short, IEC 62304 covers the software life cycle; ISO 14971 covers device-wide risk management, and the software activities fit within that broader risk framework.