What class is your medical device software? Find out in two minutes

There is a specific moment most founders building health software hit. An investor, a customer, or a co-founder asks: "So what class is it?" And you realise you do not actually know. Class I? IIa? Is it even a medical device? What does IEC 62304 Class B mean and why does the standard have its own classes on top of the EU ones?

If that is you, take a breath. Not knowing your class yet is completely normal. What is not fine is building for months without settling it, because almost every compliance decision you make from here hangs off this one answer.

Let us fix that. Here is what your class actually is, why it is the first domino, and how to find yours in about two minutes.

Your class is the first domino

Before you write a single quality document, you need to know your class, because your class determines the entire shape of the work ahead.

It decides whether you can self-declare your product or whether you need a Notified Body to audit you. It decides whether a clinical evaluation is required. It changes your realistic timeline from somewhere around 6 to 12 months to closer to 18 months or more. It even changes which version of the software lifecycle standard you have to follow.

Get this right at the start and everything downstream lines up. Get it wrong, specifically if you assume you are a lighter class than you really are, and you can build the wrong quality system, skip a step you needed, and find out late that some of your work does not count. That is the expensive version. We are going to avoid it.

The two numbers that actually matter

For standalone software, two classifications do most of the heavy lifting.

Your EU MDR class comes from Rule 11 of the EU Medical Device Regulation (2017/745, Annex VIII). In plain English, Rule 11 says:

• Software that provides information used to make a diagnostic or treatment decision is Class IIa, and goes higher if a wrong output could cause serious harm or death.
• Software that monitors physiological processes is Class IIa, and higher if it monitors vital parameters where sudden change is immediately dangerous.
• Everything else is Class I.

Your IEC 62304 class is separate and answers a different question: if the software itself fails, how bad could it get? Class A means no injury is possible. Class B means non-serious injury is possible. Class C means serious injury or death is possible. Notice this is about severity if it fails, not how likely failure is. You answer for the worst realistic case, not the typical day.

Those two numbers, an EU MDR class and an IEC 62304 class, are what a Notified Body, an investor, and a regulatory consultant all want to hear from you. They are the headline of your entire compliance position.

Why founders get stuck here

The thing that trips people up is rarely the rules. It is the gap between what you built and what you claim.

Regulators do not classify your software by how it works under the hood. They classify it by what you say it achieves for the user. "We analyse retinal images" is an engineering description. "We detect diabetic retinopathy" is an intended use claim, and that claim is what puts you squarely inside Rule 11. Two teams with almost identical code can land in different classes purely because of how they describe the outcome.

This is genuinely hard to see from the inside, because you live in the implementation. You think in features and models. Regulators think in claims and consequences. The classifier is built to translate between the two for you.

What the classifier actually does

Our free classifier is an EU MDR compliance tool built for startups and small teams: a short, structured questionnaire that walks you through the same four things a regulatory specialist would ask first:

1. What do you claim your software achieves? This is the highest-leverage question, because it sets your starting position.
2. Is it even a medical device? If your product is an admin or workflow tool with no clinical output, you may not be a medical device at all, and the tool will tell you that and point you at ISO 9001 instead. Knowing you are out of scope is just as valuable as knowing your class. If that single question is the only thing on your mind right now, we have a shorter tool just for the medical device question and a plain-English guide to where the line actually sits.
3. What is your EU MDR class? It applies Rule 11 (Annex VIII) step by step, driven mainly by the worst realistic harm if your output is wrong and whether a clinician reviews it first.
4. What is your IEC 62304 software safety class? Based on severity of harm if the software fails.

At the end you get a plain-language compliance pathway: which standards apply to you (ISO 13485, IEC 62304, ISO 14971), whether you need a Notified Body, and what getting certified actually looks like for your class. Every step shows its reasoning, so if your class got pushed up, you see exactly why. No black box.

It runs entirely in your browser. No personal data is collected, and your answers stay client-side until you choose to save them.

The conservative bias, and why it protects you

Here is a design choice worth understanding, because it is doing something quietly clever for you.

When your answers are borderline, the tool does not split the difference. It rounds up. It tells you to proceed as the higher class until you have confirmed otherwise with a specialist.

That sounds cautious, but it is the financially smart move. Work you complete for a higher class is never wasted if you are later confirmed lower; you simply needed less of it. The reverse is the trap: building for a lower class and discovering you were actually higher means redoing foundational work and losing months. Under-classifying is the one failure mode that actually costs you runway, so the tool is deliberately tuned to avoid it.

What it is not, so you can trust what it is

We are going to be straight with you, because that is the only way this is useful.

The classifier is not a legal classification, and it does not pretend to be. EU MDR classification is ultimately a legal determination with real consequences, and a borderline result, anything involving Class IIb, Class III, or IEC 62304 Class C, should be confirmed with a qualified regulatory specialist before you make a formal submission.

What the tool does, and does reliably, is put you on the right pathway to start building toward, and teach you your own position along the way. That matters more than it sounds. By the time you sit down with a specialist, you understand your classification, your obligations, and your gaps. You ask sharper questions, you are harder to oversell, and you arrive already prepared instead of paying consultant rates to start from a blank page.

Settle the question today

You do not need to carry the "what class are we?" question around as a vague source of dread. It has an answer, and finding it is genuinely a two-minute job.

Run the classifier and get your likely EU MDR and IEC 62304 class, your compliance pathway, and the reasoning behind every step. Once you know your class, the compliance readiness score gives you a quick read on how far you already are from audit-ready. Then, when you are ready to turn that pathway into an actual quality system, QualiHQ is the ISO 13485 and IEC 62304 QMS software that builds it with you from the same answers, and you can see exactly how that works first.

Comparing tools before you commit anything? We keep honest, up-to-date rundowns of the best free QMS software for medical device teams, the best QMS for small teams, the best free ISO 13485 software, and the best QMS for EU MDR compliance, with QualiHQ judged on the same terms as everyone else.

If you are still earlier than that and want the groundwork first, our guides on when software becomes a medical device and what compliance actually means are a good place to start.

Find your class first. Everything else gets easier once you know where you stand. Run the free classifier.