On 22 September 2026, the BSI (German Federal Office for Information Security) handed over the first certificate under BSI TR-03185 to our partner DUX Healthcare from Karlsruhe. Manufacturers who have their development process certified under TR-03185 can ship updates to a TR-03161-certified health application without having every version re-assessed.

This article explains what BSI TR-03185 requires, how the update procedure works, and why DiGA manufacturers already have a good starting point with their ISO 27001 ISMS.

In many digital health teams, compliance is an event rather than a process: once a year, shortly before an audit or certification, someone checks where things stand. Every line of code written between two such deadlines goes unassessed until the next one – and the gaps discovered then are expensive to fix.

azuma nori supports both modes of operation: the classic gap analysis as a snapshot, and headless operation, which lets you automate the check inside your CI/CD pipeline. This article shows how to move from point-in-time to continuous compliance.