Implementing rule 2.3 of the current MDD states that device software falls in the same class automatically, which also indicates the level of concern assigned to it on principle.
EN 62304 is still a harmonized standard, which classifies (parts of) software into A, B and C levels dependent on risk, but is based on manufacturer judgment.
Then there's "Guidance document Medical Devices - Scope, field of application, definition - Qualification and Classification of stand alone software -
MEDDEV 2.1/6", which, even if you're not doing stand-alone work, provides enlightening illustrative examples.
The quite informal Borderline manual on medical devices has some guidance on Mobile software in Clause 9, but this is based on cases, not rules. Once again more enlightening than prescriptive.
With the MDR coming who knows what other changes loom on the horizon, so I'm not making any statements on that part.