Trust
Certification and regulation
Notal Care's status per standard and law, with timeline. The clinical modules are going through MDR certification as class IIa, expected Q3 2027.
Overview
Status per framework
| Framework | What it covers | Notal Care status |
|---|---|---|
| NEN 7510-1:2024 / 7512 / 7513 | Information security in healthcare; designated in the Dutch Electronic Data Processing by Healthcare Providers Decree (Besluit elektronische gegevensverwerking door zorgaanbieders); logs retained for 5 years | Set up in line with the standards; certification audit scheduled |
| ISO/IEC 27001:2022 | Information security management system | Set up in line with the standard; audit scheduled |
| GDPR and Wabvpz | Data processing agreement (Art. 28 GDPR), DPIA for large-scale health data, logging (Art. 15e Wabvpz) | Data processing agreement available; DPIA input in the document pack |
| MDR (Regulation 2017/745) | Software that provides information for diagnostic or therapeutic decisions: class IIa or higher (Annex VIII, Rule 11) | Clinical modules in certification as class IIa; expected Q3 2027. Core layer is not a medical device |
| EU AI Act | Class IIa+ medical devices are high-risk AI (Art. 6(1), Annex I); applies from 2 August 2028; AI literacy (Art. 4) since 2 February 2025 | Preparation in parallel with the MDR process |
| Dutch Cybersecurity Act (Cyberbeveiligingswet) | Organisations > 50 FTE or > €10 million turnover; largely covered by NEN 7510 | Customer side; Notal Care provides the evidence |
Planning
Certification timeline
2 February 2025
AI literacy (EU AI Act Art. 4)
Applies from this date.
Scheduled
Certification audit NEN 7510 and ISO/IEC 27001
Q3 2027
MDR class IIa: CE marking of clinical modules
Expected completion of certification.
2 August 2028
EU AI Act: high-risk AI requirements for medical devices
Planning; dates may change.
All the evidence in one pack
Data processing agreement, sub-processors, data flow, DPIA input, security policy, audit schedule and MDR status statement.