The CRA's 24-hour reporting duty has applied since 11 September 2026. Check whether it reaches you
Start the system

For health IT supplierssoftware for hospitals and clinics, all of the EU

Hospitals check their suppliers now. Have the answers ready.

Hospitals under NIS2 must manage the security of their suppliers, so their questions, and patient data under the GDPR, come to you.

Start your compliance system Check if NIS2 applies to you
Example data

The rules that reach you

What reaches a health IT supplier, and from when

Your clients' law reaches you by contract, patient data brings the GDPR, and what you build decides the rest.

NIS2, through your clients

Directive (EU) 2022/2555 · your clients' law

Your clients' duty

Healthcare providers are Annex I entities, and Article 21 has them manage the security of each direct supplier.

Supply chainSecurity in the relationship with each direct supplierArt 21(2)(d)
Your practicesYour vulnerabilities, product quality and secure development are weighedArt 21(3)
Hospitals in scopeHealthcare providers that are medium-sized or largerArt 2(1)
Annex I, 5Your clients' duty since NIS2 can be your own law too, as a maker of medical device software or as a cloud provider, from medium-sized up. Check yours

GDPR

Regulation (EU) 2016/679

Applies

Health data is a special category under Article 9, and as your clients' processor you work under an Article 28 contract.

Art 9Art 28Since

ISO 27001

ISO/IEC 27001:2022 · a standard

Not a law

Clients and tenders ask for the certificate, and its controls map onto the measures NIS2 Article 21 asks for.

Annex A, 93 controlsYour clients set the date

Cyber Resilience Act

Regulation (EU) 2024/2847

Unless it is a medical device

Health software you place on the market is in the CRA like any product, unless it is a medical device under the MDR.

Art 2(2)In full from

AI Act

Regulation (EU) 2024/1689

If you build medical AI

AI that is a medical device, or a safety component of one, and needs a notified body under the MDR is high-risk.

Art 6(1)Annex IHigh-risk rules from

In numbers

What health buyers ask for

871 of3,403

ISO 27001 tender notices came from health buyers, 26% of all in the year to 10 October 2026.

Source: TED, buyers whose main activity is health, read 11 October 2026

345 of871

health notices were for software, 40% of them.

Source: TED, main classification CPV 48, read 11 October 2026

24 of27

member states have communicated an act transposing NIS2 to the Commission.

Source: EUR-Lex, national transposition measures, read 23 October 2026

What StandardOS does for a health IT supplier

Answers from your records, for every hospital that asks

Every tile is a screen in the product today.

Questionnaires answered from your records

Paste a client's questions and each answer is drafted from your controls and evidence, with its source.

Your ISMS, drafted

ISO 27001 with its Statement of Applicability and policies drafted for you to approve.

Your processing register

The Article 30 record of each client's data, with the processor terms and the transfers beside it.

Trust center, then the audit

Show clients where you stand, and find an accredited auditor when you want the certificate.

One subscription

Every rule on this page, on one record.

ISO27001CRANIS2DORAISO42001AIACTISO9001MRGDPRDATAACTISO27701EAAISO14001PLDREDGPSRNIS2IRRoHSREACHWEEEPPWRWBBATPTDEUDREEDCER

The 5 on this page, and 22 more for the same price

€249/mo

Every framework included.

excl. VAT, per organization

  • Unlimited users, auditors included
  • 7 days free, no card, no sales call
Start your compliance system

Questions

What health IT suppliers ask first

Short answers, each with the article it rests on.

Is a health software supplier under NIS2?

Usually through its clients: the hospital is, and Article 21 has it manage your security as its supplier. It can be yours too, as a maker of medical device software or as a cloud provider, from medium-sized up.

Art 21(2)(d)Annex II, 5(a)
Does the CRA apply to clinical software?

Not if it is a medical device under the MDR, which Article 2(2) excludes. Other health software you place on the market is in the CRA like any product.

CRA Art 2(2)
Is our AI feature high-risk?

It is if it is a medical device, or a safety component of one, that needs a notified body under the MDR, from 2 August 2028. Some Annex III uses, emergency patient triage among them, are high-risk too.

AI Act Art 6(1)AI Act Annex III, 5(d)
What will a hospital ask us under NIS2?

Its measures must cover the security of each direct supplier, weighing your vulnerabilities, product quality and secure development, so expect questions on all three.

Art 21(2)(d)Art 21(3)
Do we need a processor contract with each hospital?

Yes, where you process patient data on its behalf. Article 28(3) sets what the contract must contain, and health data is a special category under Article 9.

GDPR Art 28(3)GDPR Art 9

Answer the next hospital from your records.

7 days free, no card and no sales call.

Start your compliance system Check if NIS2 applies to you

This page in:DeutschFrançaisNederlandsEspañolDansk