Compliance & Security for European Healthtech

We are a done-for-you compliance and security partner for European healthtech. We build your ISMS, write the policies, run the internal audit, coordinate the accredited certification body, and sit next to you on audit day - then keep the certificate alive year-round.

No. Independent certification under ISO/IEC 17021-1 requires the certification body to be independent from the party that built the system. Asteron builds and operates the management system; an accredited certification body issues the certificate. Accreditation bodies (for example RvA in the Netherlands, DAkkS in Germany, SWEDAC in Sweden and UKAS in the United Kingdom) do not certify companies themselves - they accredit the certification bodies. Certification bodies such as BSI, DNV, Bureau Veritas and TÜV are the organisations that perform Stage 1 and Stage 2 audits and issue certificates.

Yes if you're European healthtech, roughly 10-200 people, with a real requirement - a tender, a notified body, a DiGA submission, an enterprise deal. No if you need a certificate in four weeks or the cheapest software-only route: those aren't us.

A single compliance core - one risk model, one control set, one evidence system - built once and projected into whichever frameworks you actually need: ISO 27001, ISO 27701, ISO 42001, IEC 81001-5-1, NEN 7510, NIS2, HIPAA. so every next certificate costs 40-60% less and takes weeks, not quarters.

It depends on what your product is and which buyers or regulators are blocking you: an MDR medical device follows one path, health software outside MDR another, clinical AI a third. That classification is exactly what the free assessment gives you - a map of which deadlines apply to your product, which don't, and what can safely wait - in writing, whether or not you work with us.

Audit-ready in 12 weeks is a defined, contractual milestone - internal audit passed, evidence in place, team trained. The certificate itself typically lands 4-6 months from kickoff, driven by the certification body's own scheduling of Stage 1 and Stage 2.

25-40 hours across the project. We do the work; you make the decisions. Your team's role is limited to what only they can do: approving documents, applying technical changes to their own systems from our step-by-step instructions, and attending short training we run. In-house, the same project consumes 200-400 hours.

Scoping, policies, risk assessment, control implementation guidance, evidence collection, internal audit, auditor coordination and audit-day advocacy - all delivered by a named senior expert. One contract, one accountable team, one price agreed up front.

No - independent certification under ISO/IEC 17021-1 requires the certification body to be independent from the party that built your system. You contract and pay the certification body directly - typically €4,500-6,000 for 10-50 people, €6,000-9,000 for 51-150. We negotiate partner rates, book the slot and prepare every session.

The guarantee covers the specific outcome defined in your signed scope - for example, ISO 27001 certification against a defined scope statement. If non-conformities arise from our deliverables, we remediate them at zero additional cost and support you through re-assessment until that contracted outcome is achieved. It is not an unlimited guarantee: it applies to the outcome named in the contract, not to work outside that scope.

A certificate needs feeding - surveillance every year, recertification every three. Our ongoing plans (Compliance Operations) keep evidence current, handle surveillance audits, and handle customer security questionnaires with a defined turnaround. Or take it fully in-house with a structured handover - no lock-in.

Yes - it's a distinct service we call Core onboarding. We inherit your existing policies, controls and evidence, map them into the Asteron Compliance Core, close gaps, and take over year-round operation: surveillance audits, questionnaires, evidence collection. Especially useful when the consultant has left or the ISMS owner has changed jobs.

Regulatory Radar is our ongoing tracking of European healthtech regulation - AI Act, CRA, EHDS, NIS2, NEN 7510:2024, MDR updates. When something changes that affects your product, you get a written note explaining what it means for your certificates and what, if anything, needs to change. Included in ongoing plans.

Yes - that's the point of the Compliance Core. Because adding the next certificate is weeks, not quarters, at 40-60% less than the standalone price. Common next steps: ISO 27701 for privacy, ISO 42001 for AI, IEC 81001-5-1 for medical device software.

Yes - it's core to our Dutch practice. Every NEN 7510 certificate issued against the 2017+A1 version expires on 20 February 2027. The transition to NEN 7510:2024 is a real project - a new control structure aligned with ISO 27001:2022, new requirements on cloud and supply-chain security - and certification bodies' transition slots are finite. We run the transition at a fixed price from your existing ISMS.

Yes. IEC 81001-5-1 is now the expected state of the art for medical device software security - files that passed review two years ago are coming back with cybersecurity findings. We build the security file end-to-end, integrated with your ISO 13485 QMS and aligned with your notified body's expectations.

We run a dedicated medical device track covering IEC 81001-5-1 security files, MDR/IVDR security expectations, and integration with your ISO 13485 QMS. One contract, one accountable team - designed to align with your notified body, not fight it.

Our practice is European healthtech - Warsaw and Amsterdam offices, remote work with companies across the EU and UK. Certification audits are performed by accredited certification bodies with local auditors; we coordinate the process regardless of where you're incorporated. For US frameworks we support SOC 2 and HIPAA on the same core.