ISO certification for digital health companies: 13485, 27001, 9001 and 42001

ISO certification shows buyers, regulators and investors that you run your business to an independently audited standard. For digital health, the four that matter most are ISO 13485, ISO 27001, ISO 9001 and ISO 42001.

Which standard does what

• ISO 13485: quality management for medical device manufacturers, the usual basis for UKCA and CE technical files
• ISO 27001: information security management, strong evidence for DTAC and NHS procurement
• ISO 9001: general quality management for any organisation
• ISO 42001: management system for building or using AI responsibly

How certification works

• Gap analysis against the standard
• Build or adapt policies, processes and records with your team
• Run the system and complete an internal audit and management review
• Stage 1 audit by an accredited certification body, checking readiness
• Stage 2 audit, checking the system works in practice
• Certificate issued, then surveillance audits and recertification on a three year cycle

Choose an accredited certification body

In the UK, look for a certification body accredited by UKAS. Certificates from unaccredited bodies carry far less weight with NHS buyers and regulators.

Do one system, not four

Many requirements overlap: document control, risk management, internal audit, management review and corrective action. An integrated management system lets you meet several standards with one set of processes, saving time and audit cost.

How DigiSafe helps

We run the gap analysis, build the system alongside your team, prepare you for the certification audits and connect it to your clinical safety, DTAC and medical device work. Tell us what you need or book a free 20 minute call with an expert.