Template: SOUP List (Software of Unknown Provenance)

IEC 62304 requires the documentation of SOUP, which stands for Software of Unknown Provenance. In simpler terms, these are third-party libraries integrated into your code, often listed in files such as requirements.txt or Gemfile.

1. Risk Level Definitions

IEC 62304 requires an evaluation of risks related to SOUP. One way to approach this is by classifying each SOUP according to its risk level. For most software development not involving high-risk scenarios, SOUP risk levels will typically be “low” or “medium”.

2. SOUP List

This section is for the SOUP list. For each third-party library in use, add a corresponding entry in the table below. Maintain one comprehensive “global” SOUP list for the medical device, even if the code is distributed across different repositories. The “software system” column can be used to note the relevant (git) repository.

In line with IEC 62304, when specifying requirements, functional, performance, hardware, and software requirements must be noted. However, you may not need to restate common requirements that apply to all SOUP, such as “runs on Linux.” It’s best to keep requirements simple and clear, as if explaining to a development colleague why a specific library was included.

Remember, the focus is on the content (i.e., the columns below) rather than the format (Google Sheets, markdown, etc.). Choose a format that integrates seamlessly with your workflow, such as a markdown file in your git repository. Just ensure it can be exported for auditors.