Clause 14 applies to a programmable electrical medical system unless basic safety and essential performance rely on no function delivered by a programmable electronic subsystem, or the risk management of 4.2 demonstrates that failure of any subsystem does not lead to unacceptable risk; the IT-network requirements of 14.13 apply to any PEMS intended for incorporation into an IT-network regardless; and where 14.2 to 14.13 apply, IEC 62304's software safety classification (4.3), development process (clause 5), risk management (7), configuration management (8) and problem resolution (9) also govern how each subsystem's software is developed or modified, excluding post-production maintenance. A risk control measure implemented in a subsystem brings the clause into play, and off-the-shelf software of unknown provenance, non-medical subsystems and legacy devices may need additional risk control. Compliance is judged by inspecting every document required and, where necessary, assessment of the requirements, which may be an internal audit.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.