The Crosswalk

    IEC / ISO

    IEC 81001-5-1

    Source

    Health software & health IT systems safety, effectiveness and security, secure development

    Last updated ·
    Share

    What it is

    Process standard derived from IEC 62443-4-1, tailored for health software. Defines a secure development lifecycle (requirements, design, implementation, verification, release, post-release).

    Why it matters

    Cited or adopted by the EU (via MDCG 2019-16), Japan (JIS), UK (BS EN), Singapore and TGA. Complying with it satisfies most jurisdictions' SDLC expectations.

    Adopted or referenced by

    EU MDR Swissmedic MHRA PMDA (JIS T) TGA HSA

    Regulatory recognition

    How each regulator treats this standard. Confirm the current edition against each regulator's list before you file.

    US FDA

    Recognized

    Recognition No. 13-122 (IEC 81001-5-1 Ed. 1.0 2021-12, complete recognition)

    Listed in the FDA Recognized Consensus Standards database. A declaration of conformity can support the SPDF evidence expected by the Feb 2026 premarket cybersecurity guidance.

    EU (MDR/IVDR)

    State of the art

    EN IEC 81001-5-1:2022

    Adopted by CENELEC. Used as state of the art for MDR Annex I §17.2/17.4 and referenced by MDCG 2019-16. Check the Official Journal for harmonised status before claiming presumption of conformity.

    UK MHRA

    State of the art

    BS EN IEC 81001-5-1:2022

    Accepted as evidence of a secure development lifecycle for UKCA and CE-recognised devices.

    Japan MHLW/PMDA

    Required

    JIS T 81001-5-1:2023

    MHLW cybersecurity notification expects conformity for programmed medical devices from Apr 2024.

    Swissmedic

    State of the art

    SN EN IEC 81001-5-1:2022

    Follows the EU EN adoption under the MedDO.

    Australia TGA

    Referenced

    IEC 81001-5-1:2021

    Cited in TGA cybersecurity guidance as a recognised secure lifecycle standard.

    Singapore HSA

    Referenced

    IEC 81001-5-1:2021

    Referenced in HSA cybersecurity guidance and the Aug 2026 GL-10 best-practice guide.

    Key clauses

    Activities mapped to IEC 62304

    Aligns directly with the medical software lifecycle standard.

    SBOM

    Requires identification and management of third-party components.

    Vulnerability handling

    Defines coordinated disclosure and patching expectations.