The first edition applies
ISO 81001-1:2021 is published and recorded at stage 90.92, to be revised. It is the edition a procedure, contract or design file should name today. The publication record.
For the CISO and the security compliance lead
The health software safety standard is being rewritten. The draft is at ballot.
ISO/DIS 81001-1 is the second edition of the principles and concepts standard for health software and health IT systems. It is a 62 page draft at stage 40.20. This site states the public record, keeps the first edition's structure readable clause by clause, and gives you a dated way to move when the text lands.
Published todayISO 81001-1:2021
DraftEdition 2, 62 pages
Stage40.20, DIS ballot
Planning date14 Sep 2027
Read from the real rules, not invented. Every answer points to the official clause or record behind it, so you can check any line yourself.
No account for the free check. Not legal advice; does not certify.
The date to plan forAn estimate
14
September 2027
330 days from the build date. Derived from the stage record and the 12 week ballot. ISO has not recorded a publication date.
- 40.20Ballot open5 October 2026
- 40.60Close of votingNot recorded
- 50.00ApprovalNot recorded
- 60.60PublishedEstimate only
Know what the new edition asks of you before your supplier does.
A revision is a handover, and handovers are where evidence goes missing. This register turns each clause and element into the artefact a reviewer will ask for, so the answer is in the file before the question arrives.
30clause, element and annex rows120evidence lines120common gaps
PUBLISHED
DRAFT
The second edition is at ballot
Stage 40.20 was recorded on 5 October 2026. The draft is edition 2 and 62 pages. Its text and any change summary are not public, so no one can honestly tell you what it changes. What the record shows.
DATE
The date is an estimate
No close of voting, approval or publication date is recorded. The planning date used here is 14 September 2027, derived from the stage record and labelled an estimate. ISO has not committed to it. The dated timeline.
The official record gives the designation, the title, the committee, the ICS, the edition, the page count, the abstract and the full stage history. It gives no change summary and no publication date.
That is enough to plan against and not enough to claim what moved. The register therefore reads the published first edition's structure, labels every line by basis, and keeps the draft's unknowns in view.
| Stage | What it means | Date |
|---|---|---|
| 40.00 | DIS registered | 2026-08-05 |
| 40.20 | DIS ballot initiated: 12 weeks | 2026-10-05 |
| 40.60 | Close of voting | not recorded |
| 50.00 | Final text received or FDIS registered for formal approval | not recorded |
| 60.00 | International Standard under publication | not recorded |
| 60.60 | International Standard published | not recorded |
Each page states what the public record carries, why the element matters in a health estate, the evidence a reviewer asks for and the gaps that recur. Start with Clause 4 for the themes. Start with 5.3.4 if security evidence across a supplier boundary is your weakest point.
| Clause | Row | The answer in one line |
|---|---|---|
| 1 | Scope | The document fixes the shared principles, concepts and terms for safety, effectiveness and security of health software and health IT systems across the whole life cycle, from concept to decommissioning, and names the points where responsibility passes between parties. |
| 2 | Normative references | The public record does not list the normative references of the draft. A reference list decides which other editions bind, so it must be read from the published text, never assumed. |
| 3 | Terms and definitions | The first edition grouped its terms into four families: organisations, people and roles; key properties and processes; health information and technology; and risk management. The draft's own definitions are not public. |
| 3.1 | Organisations, people and roles | The first edition's first term group covers organisations, people and roles. The draft's definitions are not public. |
| 3.2 | Key properties and processes | The second term group covers the key properties and the processes that maintain them. The draft's definitions are not public. |
| 3.3 | Health information and technology | The third term group covers health information and technology. The draft's definitions are not public. |
| 3.4 | Risk management | The fourth term group covers risk management. The draft's definitions are not public. |
| 4 | Core themes | Clause 4 carries the themes of the document: the sociotechnical ecosystem, the system of systems, the life cycle, roles and responsibilities, communication, and the interdependence of the three properties. |
| 4.1 | General | The opening sub-clause states the themes that the rest of Clause 4 develops. Its text is not public. |
| 4.2 | Sociotechnical ecosystem | Health software works or fails as a sociotechnical arrangement: the people, the tasks, the technology, the organisation and the environment together. The draft's text is not public. |
The check asks which party you are, which edition you rely on, what the system is, whether responsibility crosses an organisation, what evidence you hold and when you need a plan. It returns the clause path, the weakest element and three actions.
It runs in your browser and sends nothing anywhere. It never returns a compliance verdict. When an answer is missing or unsure it returns scope incomplete and names the missing answer, because a blank is never the lighter pathway.
What it will not do
No score, no certificate
It will not audit the system, score maturity out of 100, or tell you that you conform. It will tell you which row to open next and what evidence that row expects.
The paid kit carries the full register, the evidence list and the dated plan.
One off
The obligation kit
USD 799
The full register as a working file: every clause, element and annex row, the evidence list, the common gaps and a dated plan, in PDF, CSV and XLSX.
Monthly
The change watch
USD 49 a month
An email when the record changes: a new stage, a new date, the DIS text landing, the publication, or a change in the guidance this register is read against.
Both are one click to Stripe Checkout. No account is needed before payment. Not legal advice; does not certify.
Is ISO/DIS 81001-1 published yet?
No. The ISO record shows ISO/DIS 81001-1 at stage 40.20, DIS ballot initiated, on 5 October 2026, with a 12 week ballot. The draft is 62 pages and is edition 2. The edition that applies today is ISO 81001-1:2021.
When will the second edition publish?
The ISO record does not give a publication date. This site uses 14 September 2027 as a planning estimate, derived from the stage record and the ballot length. It is labelled an estimate wherever it appears and is not an ISO commitment. The watch tells you when a real date is recorded.
What does the draft change?
The public record does not say. The ISO page gives the designation, the stage, the edition, the page count and the abstract, and nothing that describes the changes. No reputable source can tell you what moved until the text or a change summary is public. This site says that plainly instead of guessing.
What applies to my organisation today?
ISO 81001-1:2021 is the published edition. It sets the principles, concepts and terms for safety, effectiveness and security of health software and health IT systems across the life cycle, and it describes eight foundational elements in its Clause 5. A CISO can build the register against that edition now and move it when the second edition publishes.
What does the USD 799 kit contain?
The full register of 27 clause and element rows and 3 annex rows, 120 evidence lines, 120 common gaps and a dated plan, in PDF, CSV and XLSX, with owner, status and due date fields on every line. The specimen shows the shape before you buy. The change watch is USD 49 a month.
Is this legal advice or a certification?
No. It is a reference and a working register. ISO 81001-1 is a principles and concepts standard, not a certification scheme, and it does not replace a clinical safety case, a regulatory submission or legal advice. The free check returns a reading of your answers, not a compliance result.
The scope reading
Which of the seven themes and eight elements apply to your party, your system and your transition points, in the document's own order.
The weakest element
The first gap in the order to fix it, named from your own answers, with the evidence the row expects.
The date arithmetic
How many days from today to your planning date, against the ballot of 5 October 2026 and the estimate of 14 September 2027.
Nothing here is invented. The register reads the public ISO record and the published structure of the first edition. The four market pages name the held standards that sit around it for a CISO in the United States, the European Union, the United Kingdom and Australia, with the count of rules kept for each. Every one links to the standard page so you can check it.
United States
HIPAA Security Rule 67 rules
HIPAA Privacy Rule 27 rules
FDA Quality Management System Regulation 13 rules
NIST Cybersecurity Framework 2.0 106 rules
United Kingdom
UK GDPR 60 rules
UK Data Protection Act 2018 83 rules
UK NCSC Cyber Assessment Framework 63 rules
Australia
Australian Privacy Principles 13 rules
Australia My Health Records Act 2012 40 rules
Australia Therapeutic Goods (Medical Devices) Regulations 2002 75 rules
These standards are named and counted, not quoted. Where a market's regime is not held in the library, the page says so instead of stating it.