Documentation Interactive

How the standards fit together

Read it from the bottom up. The quality system is the foundation, development happens inside it, the standards supply the detail, and the evidence they produce is what goes to a regulator.

Market accessWhere the evidence goes

United States FDA 510(k) Premarket notification European Union CE Mark MDR and IVDR Canada Health Canada Device licence

EvidenceWhat a regulator reads

Evidence V&V & Traceability Verification, validation and the trace between them

Standards

Process standards

Risk ISO 14971 Risk management Software IEC 62304 Software life cycle Usability IEC 62366-1 Usability engineering Security IEC 81001-5-1 Security in the life cycle

Depends on what you build

Electrical device IEC 60601 Electrical safety Lab and IVD equipment IEC 61010 Laboratory equipment safety Standalone software IEC 82304-1 Health software product safety

Development processInside the quality system

Development process Design Controls ISO 13485 clause 7.3

Quality systemThe foundation

Quality system ISO 13485 Quality management system

Suppliers and services SOC 2 Service organisation controls

Every connection, in words

The same 42 connections the map draws, as a list.

FDA 510(k) builds on

ISO 13485The FDA’s quality system rule, 21 CFR Part 820, incorporates ISO 13485 by reference.
Design ControlsDesign controls apply to Class II and III devices under 21 CFR 820.10(c).
V&V & TraceabilityThe submission is built from verification and validation evidence.
ISO 14971The submission includes the risk management file.
IEC 62304FDA-recognized. A declaration of conformity can stand in for part of the software documentation.
IEC 62366-1FDA-recognized. Supports the human factors evidence where use-related risk matters.
IEC 81001-5-1FDA-recognized. Supports the cybersecurity information required for connected devices.
IEC 60601Electrical safety and EMC test reports, where the device is electrical.
IEC 61010FDA-recognized. Electrical safety test reports for laboratory and IVD instruments.
IEC 82304-1FDA-recognized. Product-level safety evidence for standalone software.

CE Mark builds on

ISO 13485Harmonised standard for the quality system the regulations require.
ISO 14971Harmonised standard for the risk management required by Annex I.
V&V & TraceabilityTechnical documentation includes verification and validation results (Annex II).
IEC 62304Treated as the state of the art for the software life cycle that Annex I requires.
IEC 81001-5-1Evidence for the information security requirements in Annex I.
IEC 62366-1Evidence for the Annex I requirements on use error and usability.
IEC 60601Evidence for the electrical safety requirements in Annex I, for electrical devices.
IEC 61010Evidence for the electrical safety of IVD instruments under the IVDR.
IEC 82304-1Evidence at the product level for software that is a device on its own.

Health Canada builds on

ISO 13485Licences for Class II to IV devices need an MDSAP certificate: an ISO 13485 audit plus Canadian requirements.
V&V & TraceabilityLicence applications for higher-class devices include safety and effectiveness evidence.

V&V & Traceability builds on

Design ControlsVerification and validation are design control activities (clauses 7.3.6 and 7.3.7).
IEC 62304Software verification activities and their records (clauses 5.5 to 5.7).
ISO 14971Each risk control measure is verified as implemented and as effective.
IEC 62366-1The summative usability evaluation is part of validation.
IEC 60601Type test reports from the laboratory are verification evidence.

IEC 62304 builds on

ISO 14971Requires risk management to ISO 14971 (clause 4.2). The software safety class comes from the risk analysis.
ISO 13485Assumes a quality management system is in place (clause 4.1).
Design ControlsSupplies the software-specific detail for each design control activity.

IEC 62366-1 builds on

ISO 14971Use-related risks are analysed and controlled through the ISO 14971 risk file.

IEC 81001-5-1 builds on

IEC 62304Adds security activities to the same life cycle stages.
ISO 14971Security risks that could lead to harm feed the risk file.

IEC 60601 builds on

ISO 14971Requires a risk management process to ISO 14971. The laboratory reviews the risk file.
IEC 62304Clause 14 points to IEC 62304 for the software in programmable systems.
IEC 62366-1Collateral standard IEC 60601-1-6 points to IEC 62366-1 for usability.

IEC 61010 builds on

ISO 14971For IVD instruments, its risk assessment is normally carried out within the ISO 14971 file.

IEC 82304-1 builds on

IEC 62304Requires IEC 62304 for the software life cycle.
ISO 14971Requires risk management to ISO 14971 at the product level.

Design Controls builds on

ISO 13485Design controls are clause 7.3 of ISO 13485.
ISO 14971The outputs of risk management are design inputs (clause 7.3.3).

ISO 13485 builds on

ISO 14971Requires risk management throughout product realisation (clause 7.1).
SOC 2A supplier’s SOC 2 report is evidence for supplier evaluation (clause 7.4).

A summary for orientation. It is not regulatory or legal advice, and it is no substitute for the standard or regulation itself. Requirements change: confirm the current edition before relying on anything here. Last reviewed November 2026.