Inside Pamela
ISO 27001 and NEN 7510 certified
ISO 27001 and NEN 7510 certified
Certified to ISO/IEC 27001:2022 and NEN 7510-1:2024
Independently audited by DNV.
Pamela holds certification against ISO/IEC 27001:2022 and NEN 7510-1:2024. Both were audited and issued by DNV, an accredited certification body.
For clinics evaluating clinical AI, the question of whether a vendor takes information security seriously is usually answered with a document rather than a description. This is that document, and what stands behind it.
In short:
ISO/IEC 27001:2022 — certification held, covering the information security management system
NEN 7510-1:2024 — certification held, the Dutch standard for organisations processing patient data
Both audited and issued by DNV
AVG (GDPR) — compliant, on European infrastructure
EU AI Act — built for, as it phases in
Certificates are subject to annual surveillance audits, not one-off assessments
What do these two standards actually cover?
They answer different questions, which is why both matter.
ISO/IEC 27001:2022 is the international standard for an information security management system. It is not a checklist of technical controls but an assessment of whether an organisation has a working system for managing security risk: risk assessment and treatment, access control, supplier management, incident response, business continuity, and a defined cycle of internal audit and improvement. The 2022 revision restructured the control set into four themes — organisational, people, physical, and technological — and introduced controls addressing cloud services, threat intelligence, and data masking.
NEN 7510-1:2024 is the Dutch standard for information security in healthcare. It builds on the ISO 27001 framework and adds the requirements specific to organisations that process patient data in the Netherlands. For Dutch care providers this is the relevant reference point: it is the standard your own organisation is measured against, and the one your data protection officer will recognise.
Holding ISO 27001 without NEN 7510 would leave a gap in the Dutch context. Holding both closes it.
What did certification involve?
An external audit by DNV against the requirements of both standards, covering documented policy, implemented controls, and evidence that those controls operate in practice rather than on paper.
Certification is not a single event. Both standards require ongoing surveillance audits, with a full recertification cycle after three years. The certificates are valid only as long as the management system continues to meet the requirements — which means the internal work continues after the certificate is issued.
Certificate details: [certificate numbers], valid until [date]. Verifiable through DNV's certificate register.
Why does this matter for a clinic evaluating AI?
Because the first questions about clinical AI are rarely about the product.
When a clinic considers bringing an AI tool into a care process, the questions that determine whether the project proceeds tend to be these: where is the data processed and stored, who has access to it, what happens in the event of an incident, and who has independently verified any of it. Those questions are usually asked by a data protection officer or an IT lead, and they are asked before anyone evaluates whether the documentation is any good.
Certification does not answer every one of those questions on its own. It does mean the answers have been examined by an accredited third party rather than supplied by the vendor. That shortens the assessment considerably, and it gives the person doing the assessment something they can file.
How does this relate to the AVG and the EU AI Act?
They are separate obligations, and worth keeping distinct.
The AVG (GDPR) is legislation. Pamela is compliant, operating on European infrastructure, with patient data processed and stored within the EU. Compliance is a legal position, not a certification, and no certificate substitutes for it.
The EU AI Act is phasing in over a period of years. Pamela is built for it as it takes effect. That is a forward-looking statement about design intent and preparation, not a certification claim — and any vendor presenting the AI Act as a badge today should be asked what exactly they mean by it.
ISO 27001 and NEN 7510 are certifications: audited, issued, and subject to renewal.
The distinction matters because these three are frequently presented as one undifferentiated list of credentials. They are not equivalent, and a clinic assessing vendors is entitled to know which is which.
Does certification mean the work is finished?
No. It means there is a system in place, and that an external auditor has confirmed it functions.
The regulatory picture for clinical AI in Europe is still developing, and the requirements placed on both vendors and care providers will continue to change. Certification against these two standards is a baseline rather than an endpoint — but it is the right baseline, and it is the one Dutch healthcare organisations are held to themselves.
The foundation, independently checked
Information security in healthcare software is not a feature to be added later. It is either designed in from the start and verified, or it is asserted.
ISO/IEC 27001:2022 and NEN 7510-1:2024, both certified
Audited and issued by DNV
AVG compliant, on European infrastructure
Re-audited annually, not certified once and shelved
Type less. Click less. Care better.
FAQ
Which certifications does Pamela hold? ISO/IEC 27001:2022 and NEN 7510-1:2024, both audited and issued by DNV.
What is the difference between ISO 27001 and NEN 7510? ISO 27001 is the international standard for an information security management system. NEN 7510 builds on it and adds the requirements specific to Dutch organisations processing patient data.
Is Pamela AVG (GDPR) compliant? Yes. Pamela operates on European infrastructure, with patient data processed and stored within the EU.
Is Pamela certified for the EU AI Act? No, and no organisation is — the AI Act is legislation phasing in over time, not a certification scheme. Pamela is built for it as it takes effect.
How long are the certificates valid? Both are subject to annual surveillance audits, with full recertification after three years. Current validity is stated on the certificates themselves.
Where is patient data stored? Within the European Union.
Certified to ISO/IEC 27001:2022 and NEN 7510-1:2024
Independently audited by DNV.
Pamela holds certification against ISO/IEC 27001:2022 and NEN 7510-1:2024. Both were audited and issued by DNV, an accredited certification body.
For clinics evaluating clinical AI, the question of whether a vendor takes information security seriously is usually answered with a document rather than a description. This is that document, and what stands behind it.
In short:
ISO/IEC 27001:2022 — certification held, covering the information security management system
NEN 7510-1:2024 — certification held, the Dutch standard for organisations processing patient data
Both audited and issued by DNV
AVG (GDPR) — compliant, on European infrastructure
EU AI Act — built for, as it phases in
Certificates are subject to annual surveillance audits, not one-off assessments
What do these two standards actually cover?
They answer different questions, which is why both matter.
ISO/IEC 27001:2022 is the international standard for an information security management system. It is not a checklist of technical controls but an assessment of whether an organisation has a working system for managing security risk: risk assessment and treatment, access control, supplier management, incident response, business continuity, and a defined cycle of internal audit and improvement. The 2022 revision restructured the control set into four themes — organisational, people, physical, and technological — and introduced controls addressing cloud services, threat intelligence, and data masking.
NEN 7510-1:2024 is the Dutch standard for information security in healthcare. It builds on the ISO 27001 framework and adds the requirements specific to organisations that process patient data in the Netherlands. For Dutch care providers this is the relevant reference point: it is the standard your own organisation is measured against, and the one your data protection officer will recognise.
Holding ISO 27001 without NEN 7510 would leave a gap in the Dutch context. Holding both closes it.
What did certification involve?
An external audit by DNV against the requirements of both standards, covering documented policy, implemented controls, and evidence that those controls operate in practice rather than on paper.
Certification is not a single event. Both standards require ongoing surveillance audits, with a full recertification cycle after three years. The certificates are valid only as long as the management system continues to meet the requirements — which means the internal work continues after the certificate is issued.
Certificate details: [certificate numbers], valid until [date]. Verifiable through DNV's certificate register.
Why does this matter for a clinic evaluating AI?
Because the first questions about clinical AI are rarely about the product.
When a clinic considers bringing an AI tool into a care process, the questions that determine whether the project proceeds tend to be these: where is the data processed and stored, who has access to it, what happens in the event of an incident, and who has independently verified any of it. Those questions are usually asked by a data protection officer or an IT lead, and they are asked before anyone evaluates whether the documentation is any good.
Certification does not answer every one of those questions on its own. It does mean the answers have been examined by an accredited third party rather than supplied by the vendor. That shortens the assessment considerably, and it gives the person doing the assessment something they can file.
How does this relate to the AVG and the EU AI Act?
They are separate obligations, and worth keeping distinct.
The AVG (GDPR) is legislation. Pamela is compliant, operating on European infrastructure, with patient data processed and stored within the EU. Compliance is a legal position, not a certification, and no certificate substitutes for it.
The EU AI Act is phasing in over a period of years. Pamela is built for it as it takes effect. That is a forward-looking statement about design intent and preparation, not a certification claim — and any vendor presenting the AI Act as a badge today should be asked what exactly they mean by it.
ISO 27001 and NEN 7510 are certifications: audited, issued, and subject to renewal.
The distinction matters because these three are frequently presented as one undifferentiated list of credentials. They are not equivalent, and a clinic assessing vendors is entitled to know which is which.
Does certification mean the work is finished?
No. It means there is a system in place, and that an external auditor has confirmed it functions.
The regulatory picture for clinical AI in Europe is still developing, and the requirements placed on both vendors and care providers will continue to change. Certification against these two standards is a baseline rather than an endpoint — but it is the right baseline, and it is the one Dutch healthcare organisations are held to themselves.
The foundation, independently checked
Information security in healthcare software is not a feature to be added later. It is either designed in from the start and verified, or it is asserted.
ISO/IEC 27001:2022 and NEN 7510-1:2024, both certified
Audited and issued by DNV
AVG compliant, on European infrastructure
Re-audited annually, not certified once and shelved
Type less. Click less. Care better.
FAQ
Which certifications does Pamela hold? ISO/IEC 27001:2022 and NEN 7510-1:2024, both audited and issued by DNV.
What is the difference between ISO 27001 and NEN 7510? ISO 27001 is the international standard for an information security management system. NEN 7510 builds on it and adds the requirements specific to Dutch organisations processing patient data.
Is Pamela AVG (GDPR) compliant? Yes. Pamela operates on European infrastructure, with patient data processed and stored within the EU.
Is Pamela certified for the EU AI Act? No, and no organisation is — the AI Act is legislation phasing in over time, not a certification scheme. Pamela is built for it as it takes effect.
How long are the certificates valid? Both are subject to annual surveillance audits, with full recertification after three years. Current validity is stated on the certificates themselves.
Where is patient data stored? Within the European Union.
"A certificate instead of a promise."
