ISO/DIS 81001-1: the stage, the dates and the edition that applies today
The official record read on 21 October 2026. The draft is at stage 40.20, DIS ballot initiated on 5 October 2026. The first edition, ISO 81001-1:2021, is published and is the edition a procedure should name today.
Health software and health IT systems safety, effectiveness and security, Part 1: Principles and concepts
The first edition was 61 pages.
ICS 35.240.80, IT applications in health care technology.
Stage 40.20, DIS ballot initiated: 12 weeks, 5 October 2026.
Published March 2021, recorded at stage 90.92, to be revised.
An estimate, not an ISO commitment.
| Stage | What it means | Date | Source |
|---|---|---|---|
| 10.99 | New project approved | 2025-02-26 | Recorded on the ISO page |
| 30.00 | Committee draft (CD) registered | 2025-02-26 | Recorded on the ISO page |
| 30.20 | CD consultation initiated | 2026-01-30 | Recorded on the ISO page |
| 30.60 | Close of comment period | 2026-03-28 | Recorded on the ISO page |
| 30.99 | CD approved for registration as DIS | 2026-07-31 | Recorded on the ISO page |
| 40.00 | DIS registered | 2026-08-05 | Recorded on the ISO page |
| 40.20 | DIS ballot initiated: 12 weeks | 2026-10-05 | Recorded on the ISO page; current stage |
| 40.60 | Close of voting | not recorded | Not recorded; a 12 week ballot from 5 October 2026 would close on 28 December 2026 |
| 50.00 | Final text received or FDIS registered for formal approval | not recorded | Not recorded |
| 60.00 | International Standard under publication | not recorded | Not recorded |
| 60.60 | International Standard published | not recorded | Not recorded; the planning date is an estimate |
A blank is not a prediction. The page records only what ISO records.
What a CISO should name today
The first edition is the one that applies
ISO 81001-1:2021 is published. It supplies the vocabulary and the concepts for health software and health IT systems, and for the three properties a CISO has to hold together: safety, effectiveness and security. It follows a system from its first idea to its retirement. Its Clause 4 carries the core themes and its Clause 5 the eight foundational elements. That is the structure this register reads.
The draft is not a document to cite
A draft at ballot can change before publication. Citing the second edition today would overstate what is settled and could name a clause that moves. Name the first edition in the procedure, note that a second edition is in development, and keep the register ready to move.
ISO has not published a change summary for the second edition. Any page, report or consultant that describes what the draft changes is either working from a text it cannot share or guessing. This site does not guess.
An estimate for planning, 330 days from the build date of 19 October 2026 and 344 days from the recorded 40.20 date of 5 October 2026. ISO has not recorded a 40.60 date, a 50.00 date, a 60.00 date or a 60.60 date. The date is labelled an estimate wherever it appears and is not an ISO commitment.
Nothing here is invented. The register reads the public ISO record and the published structure of the first edition. The four market pages name the held standards that sit around it for a CISO in the United States, the European Union, the United Kingdom and Australia, with the count of rules kept for each. Every one links to the standard page so you can check it.
HIPAA Security Rule 67 rules
HIPAA Privacy Rule 27 rules
FDA Quality Management System Regulation 13 rules
NIST Cybersecurity Framework 2.0 106 rules
UK GDPR 60 rules
UK Data Protection Act 2018 83 rules
UK NCSC Cyber Assessment Framework 63 rules
Australian Privacy Principles 13 rules
Australia My Health Records Act 2012 40 rules
Australia Therapeutic Goods (Medical Devices) Regulations 2002 75 rules
These standards are named and counted, not quoted. Where a market's regime is not held in the library, the page says so instead of stating it.