Which standards apply to an IVD medical device?

The IVD changes the question

Our preceding article, Which standards does your medical device actually need?, explains why standards selection should start with the device rather than a generic checklist.

In vitro diagnostic medical devices make that principle especially important. An electrical laboratory analyser, a reagent, a specimen receptacle, a self-test and standalone IVD software may all fall under the same regulatory framework. They plainly do not require the same technical standards or the same conformity evidence.

The applicable set must follow the intended purpose, assay technology, users, operating environment, architecture, specimen types and performance claims of the actual IVD system.

Start with the IVDR requirements

Regulation (EU) 2017/746—the IVDR—establishes the legal requirements for IVD medical devices in the European Union. Its General Safety and Performance Requirements define what the manufacturer must achieve.

Standards provide established processes and test methods that can help generate evidence of conformity. They do not replace the Regulation, and their use does not remove the need to justify the device’s safety, performance and benefit–risk conclusions.

The manufacturer must also identify the appropriate edition for each intended market. The newest international edition is not necessarily the edition currently harmonised in Europe or recognised elsewhere.

Think in four layers

A useful standards assessment separates four related but different layers.

These layers interact. They should not be collapsed into a single undifferentiated standards list.

IEC 61010 or IEC 60601?

One of the most common points of confusion concerns electrical safety.

For most electrical IVD analysers, the usual foundation is IEC 61010-1, covering electrical equipment for measurement, control and laboratory use, together with IEC 61010-2-101, which contains particular safety requirements for IVD medical equipment.

Other parts of the IEC 61010 series may apply where the instrument heats materials, performs mechanical mixing or stirring, or incorporates automatic laboratory processes.

IEC 60601-1 should not be selected merely because the analyser is a medical device, is powered or is used in a hospital. An analyser examining specimens outside the body will normally follow the IEC 61010 route. The decision depends on the standards’ scopes, the equipment’s intended purpose and its relationship with the patient—not simply its location.

This choice can affect the entire safety and test strategy, so it should be resolved early and documented.

Safety includes the result

Electrical safety is only part of the IVD safety case. An analyser can remain electrically safe while producing a clinically misleading result.

Risk management under ISO 14971 should therefore consider harm arising from:

• false-positive or false-negative results;
• incorrect quantitative results;
• delayed or unavailable results;
• results assigned to the wrong patient;
• invalid calibration or quality-control status;
• use errors; and
• cybersecurity events affecting data or performance.

The device’s essential performance and test acceptance criteria must therefore be derived from its intended medical purpose and risk analysis—not simply from electrical survival.

EMC, software and cybersecurity

Electrical IVD equipment will normally require assessment against IEC 61326-1 and the IVD-specific IEC 61326-2-6. The EMC strategy should define acceptable behaviour during and after disturbances. “No damage” is not enough if an electromagnetic event can corrupt a measurement, lose patient information or allow an invalid result to be reported.

Where the IVD contains embedded firmware, analyser software, a result-calculation application or standalone software, IEC 62304 will normally form the software-lifecycle foundation. It addresses development, maintenance, configuration management and problem resolution, but it does not replace system-level verification and validation.

For connected or updateable products, IEC 81001-5-1 provides an important cybersecurity lifecycle framework. Threat modelling, secure architecture, access control, secure communications, update mechanisms, software-bill-of-materials management, vulnerability monitoring and security testing may all be relevant.

Cybersecurity and safety risk management should be connected but not treated as identical. Some security risks affect confidentiality or operations; others can alter results, interrupt testing or expose multiple patients to harm.

Usability is part of result integrity

IEC 62366-1 applies usability engineering to safety-related user interactions. For an IVD, critical tasks may include:

• identifying the patient and specimen;
• loading the correct consumables;
• selecting the correct assay;
• responding to calibration or quality-control warnings;
• reviewing and approving results; and
• recovering the instrument following a fault.

A technically accurate measurement can still lead to harm if it is linked to the wrong patient, interpreted incorrectly or released despite an invalid quality-control condition.

Labelling and performance standards

The ISO 18113 series provides the principal IVD-specific framework for information supplied by the manufacturer. Different parts address professional-use reagents and instruments, as well as products intended for self-testing.

Performance requires another group of standards and guidance. Depending on the product, these may include ISO 17511 for metrological traceability, ISO 23640 for stability evaluation, ISO 15198 for manufacturer-recommended quality-control procedures and ISO 20916 for clinical performance studies using specimens from human subjects.

Assay-specific standards and CLSI documents may also be needed for precision, bias, measuring interval, detection capability, interference, carry-over, method comparison, reference intervals and clinical-performance characteristics.

The studies should follow the intended purpose, specimen type, target population, users, environment and performance claims. A familiar protocol should not be selected merely because it was used on the last product.

Do not confuse product and laboratory standards

ISO 13485 governs the manufacturer’s quality-management system. ISO 15189 addresses the quality and competence of medical laboratories. Both may be highly relevant to the environment in which an IVD is developed or used, but neither substitutes for the applicable product-safety, EMC, software, usability or performance standards.

A device can be produced under a certified quality system and used in an accredited laboratory while still lacking adequate product conformity evidence.

Build a justified applicability matrix

For a professional electrical analyser, an initial standards set might include IEC 61010-1, IEC 61010-2-101, IEC 61326-1, IEC 61326-2-6, ISO 14971, IEC 62304, IEC 62366-1, IEC 81001-5-1 and relevant parts of ISO 18113.

That is a starting point—not a universal answer.

The Standards Applicability Matrix should record each standard and edition, the reason for inclusion or exclusion, the applicable product components, target-market status, required evidence, responsible owner and review status.

When the intended purpose, assay, architecture, accessories, environment or markets change, the matrix should be reviewed as part of the change—not after testing has already been commissioned.

The central principle

Standards selection should follow the IVD system.

Begin with the intended purpose, users, specimens, operating environment, architecture and performance claims. Understand how incorrect, delayed or unavailable results could lead to harm. Then select the safety, lifecycle and performance standards needed to control those risks and demonstrate conformity.

The objective is not the longest possible standards list. It is a defensible body of evidence tailored to the actual IVD medical device.