IEC 62304 Software Documentation Hub
IEC 62304 Medical Software Documentation
The complete software lifecycle file for medical device software and SaMD — development plan to release record, plus the cybersecurity documentation Notified Bodies now expect. Clause-referenced, safety-class scalable (A/B/C), fully editable. Or buy only the document you need.
Two kits, one software lifecycle
The SW Documentation Kit covers the full IEC 62304 lifecycle plus cybersecurity. The Gold tier adds the complete AI/ML module — the same 10-document set sold separately as the AI/ML Kit — for AI-enabled software and SaMD.
Standard
SW Documentation Kit
12 templates — 9 Word + 3 Excel
- Software Lifecycle (IEC 62304)
- Software Development Plan (Clause 5.1)
- Architecture & Detailed Design (5.3–5.4)
- Software Requirements Specification (5.2)
- Traceability Matrix — Excel
- SOUP List & Evaluation Record — Excel
- V&V Plan and V&V Report (5.5–5.8)
- Release & Configuration Management Record (5.8, 8)
- Problem Resolution & Anomaly Log — Excel (9)
- Cybersecurity (MDCG 2019-16)
- Cybersecurity Risk Assessment & Threat Model
- Cybersecurity Management Plan
- Vulnerability Disclosure Policy
€499 one-time · lifetime access
⚡ Save 40% vs buying individually (€828 → €499)
Get the SW KitGold
SW Documentation Kit Gold
23 templates — three coordinated modules
- 01 — Software Lifecycle Documents
- The complete IEC 62304 set: plan, design, SRS, traceability, SOUP, V&V, release, anomaly log
- 02 — AI/ML Documents
- The full AI/ML module: lifecycle plan, data governance & bias, model validation, AI risk (AAMI CR34971), PCCP, human oversight & transparency, postmarket monitoring, AI-augmented CEP/CER, SOP
- 03 — Cybersecurity Documents
- Risk assessment & threat model, management plan, vulnerability disclosure policy
€799 one-time · lifetime access
⚡ Everything in SW Kit + the full AI/ML module (€499 value)
Get the Gold KitWhich kit do you need?
Standard covers every software device. Gold is for AI/ML-enabled software and SaMD, where regulators expect the AI lifecycle file on top of IEC 62304.
| Module | Coverage | SW Kit | SW Kit Gold |
|---|---|---|---|
| Software Lifecycle (9 docs) | IEC 62304 Clauses 5, 8, 9 — safety Class A/B/C | ✓ | ✓ |
| Cybersecurity (3 docs) | MDR GSPR 17.2/17.4, MDCG 2019-16, IEC 81001-5-1 | ✓ | ✓ |
| AI/ML Module (10 docs + Master Index) | IMDRF GMLP, FDA/HC PCCP, EU AI Act Art. 13–14, AAMI CR34971 | — | ✓ |
| Price | One-time, lifetime access & free updates | €499 | €799 |
Or buy only the document you need
Each template is professionally drafted, clause-referenced, and fully editable. Filter by module:
Software Development Plan (SW-01)
Lifecycle model, deliverables mapped by safety class, SOUP and configuration management planning, and the interfaces with ISO 14971 and IEC 62366-1. The framework document all others reference.
Software Architecture & Detailed Design (SW-02)
System decomposition into items and units, interface specifications, SOUP requirements, segregation for risk control, and Class C detailed design — with the 5.3.6 verification checklist.
Software Requirements Specification (SW-03)
All 5.2.2 requirement categories — functional, performance, security, usability-related and more — with unique IDs, verification criteria, and risk control measures implemented in software.
Software Traceability Matrix (SW-04)
End-to-end traceability: system requirements ↔ software requirements ↔ design ↔ risk controls ↔ tests, with gap-detection columns for orphan requirements and untested items.
SOUP List & Evaluation Record (SW-05)
Controlled SOUP register with functional and environment requirements, published anomaly list evaluation, obsolescence monitoring, and an SBOM-friendly link to security vulnerability tracking.
Software V&V Plan (SW-06)
Unit, integration, and system testing strategy scaled by safety class — acceptance criteria, environments, regression rules, and validation planning consistent with FDA expectations.
Software V&V Report (SW-07)
Consolidated test results with pass/fail status, residual anomaly evaluation, verification of lifecycle completeness, and the release recommendation Notified Bodies expect as objective evidence.
Release & Configuration Management Record (SW-08)
Version identification, configuration items register including SOUP and tools, change control linkage, archiving of software and build environment, and known residual anomalies at release.
Problem Resolution & Anomaly Log (SW-09)
Problem report register from development through post-market: investigation, safety impact evaluation, advisory notice decision point, change control link, and trend analysis feeding PMS.
Cybersecurity Risk Assessment & Threat Model (CYB-01)
STRIDE-based threat identification per trust boundary, CVSS-compatible scoring, security controls mapping with residual risk, and the ISO 14971 interface for safety-impacting security risks.
Cybersecurity Management Plan (CYB-02)
How security is managed across the lifecycle: secure development activities, post-market monitoring, incident response and patch management — aligned with MDCG 2019-16 and FDA guidance.
Vulnerability Disclosure Policy (CYB-03)
Coordinated vulnerability disclosure: reporting channels, CVSS triage and remediation timelines, safe harbor for researchers, and communication to users and competent authorities.
AI Development & Lifecycle Plan (AI-01)
Master lifecycle plan integrating the IEC 62304 software lifecycle, the IMDRF GMLP principles and the Health Canada 9-stage ML lifecycle. The framework all other AI documents reference.
Data Governance & Bias Management Plan (AI-02)
Data sourcing, representativeness, dataset independence and bias identification & mitigation across the lifecycle — the density benchmark for the whole AI module.
Model Validation & Performance Report (AI-03)
Standalone performance evaluation plus subgroup / sub-population analysis, with the methodology and acceptance criteria expected by reviewers across five markets.
AI Risk Management Plan & Report (AI-04)
ISO 14971 risk management extended with AAMI CR34971 guidance on AI/ML-specific hazards — data drift, automation bias, generalisation failure and more.
Predetermined Change Control Plan (AI-05)
The PCCP — the AI module's flagship. Pre-authorised modifications, modification protocol and impact assessment, aligned with FDA and Health Canada PCCP nomenclature.
Human Oversight & Transparency Plan (AI-06)
GMLP principles P7/P9 plus the Transparency guiding principles and EU AI Act Articles 13–14 on transparency and human oversight, in one coordinated plan.
Postmarket AI Performance Monitoring (AI-07)
Real-world performance monitoring: drift detection, logging strategy and re-training triggers, structured to feed back into the PCCP and the risk file.
Clinical Evaluation Plan — AI-Augmented (AI-08a)
A clinical evaluation plan built on a real CEP template, with AI-specific additions flagged as [AI MODULE] so the AI evidence strategy integrates with your clinical process.
Clinical Evaluation Report — AI-Augmented (AI-08b)
The reporting counterpart to AI-08a, built on a real CER template with [AI MODULE] markers, documenting the AI clinical evidence and its benefit-risk contribution.
SOP — AI/ML Model Development & Lifecycle (AI-09)
The procedural SOP your ISO 13485 QMS requires: roles, steps and stage gates for AI/ML model development, built on ISO 13485 §7.5 and the GMLP process structure.
No documents match this filter.
Every clause, covered
Each template is mapped to its IEC 62304 clause (or cybersecurity reference) and the point in the lifecycle where auditors expect it to exist.
| Document | Primary Reference | When to produce |
|---|---|---|
| SW-01 Development Plan | IEC 62304 Clause 5.1 | Project start, before design input |
| SW-02 Architecture & Design | Clauses 5.3–5.4 | After requirements, before implementation |
| SW-03 SRS | Clause 5.2 | Design input phase |
| SW-04 Traceability Matrix | Clauses 5.1.1, 7.3.3 | Started early, maintained throughout |
| SW-05 SOUP List | Clauses 5.3.3–5.3.4, 8.1.2 | Architecture phase, updated per release |
| SW-06 V&V Plan | Clauses 5.5–5.7 | Before verification activities begin |
| SW-07 V&V Report | Clause 5.8 | Before release decision |
| SW-08 Release & CM Record | Clauses 5.8, 8 | At every release |
| SW-09 Anomaly Log | Clause 9 | Open from development, run continuously |
| CYB-01 Risk Assessment & Threat Model | GSPR 17.2/17.4, MDCG 2019-16 | Design phase, refined ongoing |
| CYB-02 Cybersecurity Management Plan | IEC 81001-5-1 | Project start, maintained post-market |
| CYB-03 Vulnerability Disclosure Policy | ISO/IEC 29147, 30111 | Before market launch |
Frequently Asked Questions
Are these documents ready to submit to a Notified Body?
The templates provide the complete structure, clause references, and required content sections. You must populate them with your device-specific data — architecture, requirements, test results, threat model — and validate the expert-judgment points. They are professional, deep starting points, not a substitute for software regulatory expertise.
Which software safety classes do the templates cover?
All three — Class A, B, and C per IEC 62304 Clause 4.3. The Development Plan and V&V documents include guidance on which activities and deliverables apply at each class, so you scale the file to your classification instead of over-documenting a Class A device.
What is the difference between the SW Kit and the Gold Kit?
The SW Kit (12 templates) covers the IEC 62304 lifecycle plus cybersecurity — sufficient for conventional medical device software. The Gold Kit (23 templates) adds the complete AI/ML module: GMLP-aligned lifecycle plan, data governance and bias management, model validation, AI risk per AAMI CR34971, the PCCP, human oversight and transparency, postmarket AI monitoring, AI-augmented CEP/CER, and the development SOP. If your software contains a machine learning model, Gold is the right tier.
I already bought the AI/ML Kit — should I buy Gold?
No — the Gold AI/ML module is the same document set. If you already own the AI/ML Kit, buy the standard SW Documentation Kit to complete your file. If you own neither, Gold is cheaper than buying the two kits separately.
What format are the files in?
Editable Microsoft Word .docx for the plans, specifications, and reports; Excel .xlsx for the Traceability Matrix, SOUP List, and Anomaly Log. Every kit includes a README with usage instructions. Delivered as a single ZIP, instant download after purchase.
Does the cybersecurity module cover the FDA as well as the EU?
The module is built primarily on the EU framework — MDR GSPRs 17.2/17.4, MDCG 2019-16, IEC 81001-5-1 — with cross-references to FDA premarket cybersecurity guidance. The threat modeling and vulnerability handling structure is jurisdiction-neutral, so the same file supports a 510(k) cybersecurity section with device-specific adaptation.
How do I get updates if standards or guidance change?
You receive lifetime access. As IEC 62304, MDCG guidance, or FDA cybersecurity expectations evolve, registered customers receive update notifications by email with revised documents at no additional cost.
Is the kit licensed for use across multiple devices?
Yes — licensed for internal use within your organisation across multiple device families and projects. Redistribution outside your organisation or reselling is not permitted.
Do you offer consulting on top of these documents?
Yes. For device-specific completion — safety classification, architecture reviews, threat modeling facilitation, Notified Body submission preparation — we offer dedicated consulting. Contact us through the consulting page.
Build your software file today
The SW Documentation Kit gives you the full IEC 62304 lifecycle plus cybersecurity for €499 — 40% off individual pricing. Building AI-enabled software? Gold adds the complete AI/ML module for €799.