On 22 September 2026, the BSI (German Federal Office for Information Security) handed over the first certificate under BSI TR-03185 to our partner DUX Healthcare from Karlsruhe. Manufacturers who have their development process certified under TR-03185 can ship updates to a TR-03161-certified health application without having every version re-assessed.

This article explains what BSI TR-03185 requires, how the update procedure works, and why DiGA manufacturers already have a good starting point with their ISO 27001 ISMS.