ISO/TS 81001-2-1:2025 PDF

Overview

ISO/TS 81001-2-1:2025 provides requirements and guidance for using assurance cases to manage the safety, effectiveness and security of health software and health IT systems. It establishes an assurance case framework for healthcare delivery organizations (HDOs) and health software / medical device manufacturers (MDMs) to identify, develop, interpret, update and maintain assurance cases that support risk management across the full lifecycle. The technical specification supports consistent communication and information transfer between manufacturers, HDOs, service providers and regulators.

Key topics and requirements

• Assurance case framework: Defines objectives, structure and lifecycle use of assurance cases to communicate risk and confidence for safety, effectiveness and security.
• Development process: A stepwise, iterative approach (identify goal → define basis → identify strategy → elaborate strategy → identify solution) for constructing assurance cases.
• Notation and argument elements: Guidance on common elements (goals, strategies, solutions/evidence, context, assumptions, justifications) and relationships (SupportedBy, InContextOf) to improve consistency and comparability.
• Evidence and argument considerations: Requirements for identifying, documenting and maintaining evidence supporting claims about safety and security.
• Change management: Guidance for updating assurance cases as systems evolve, including during deployment, operation, maintenance and decommissioning.
• Security assurance cases: Specific considerations for security risks and integration with overall safety and effectiveness arguments.
• Patterns and examples: Informative annexes provide generic risk-based HIT patterns, IEC 80001-1 compliance patterns, AI and security assurance case patterns to accelerate practical adoption.
• Standards alignment: Leverages ISO/IEC/IEEE 15026-2 and aligns with ISO 81001-1 and IEC 80001-1 to bridge manufacturer–HDO information gaps.

Applications and who uses it

ISO/TS 81001-2-1 is applicable to all parties in the health software and health IT lifecycle, including:

• Health software developers and medical device manufacturers (MDMs) - to produce assurance cases that communicate product risks and evidence.
• Healthcare delivery organizations (HDOs) - to extend manufacturer information into site-specific assurance cases for integration, configuration and operation.
• System integrators, cloud and IT service providers, system administrators - to demonstrate safe and secure deployment choices.
• Regulators, funders and monitoring agencies - to assess organizational capability and evidence of risk management.
• Training providers and assessors - to teach and evaluate assurance case creation and use.

Practical use cases include supplier-to-provider risk handover, procurement evaluation, deployment acceptance, safety/security audits and lifecycle change control.

Related standards

• ISO 81001-1 - foundational principles for health software and health IT systems.
• IEC 80001-1 - roles, responsibilities and assurance case concept for risk management of health IT infrastructures.
• ISO/IEC/IEEE 15026‑2 - guidance leveraged for assurance case structure and considerations.