Standards and regulations
What each standard asks of you, in plain English, from ISO 27001 to the EU AI Act.
- ISO 27001The international standard for an information security management system: who asks for it, how it is structured, and how certification works.
- ISO 27001 context of the organisation
- ISO 27001 leadership and the information security policy
- ISO 27001 risk assessment and treatment
- The ISO 27001 Statement of Applicability
- ISO 27001 support, competence, awareness and documented information
- ISO 27001 Annex A organisational controls
- ISO 27001 Annex A people controls
- ISO 27001 Annex A physical controls
- ISO 27001 Annex A technological controls
- ISO 27001 internal audit
- ISO 27001 management review
- ISO 27001 improvement, nonconformity and corrective action
- ISO 27002 and how it relates to ISO 27001
- UK GDPR and EU GDPRThe data protection law for personal data about people in the UK and the EU: who it binds, how it is organised, who enforces it, and where to start.
- Lawful basis for processing
- Transparency and privacy notices
- Individual rights and subject access requests
- Data protection impact assessments
- Processors and data processing agreements
- International data transfers
- Personal data breaches
- Records of processing activities
- Data (Use and Access) Act 2025 changes to UK GDPR
- Cyber EssentialsThe UK government-backed scheme that certifies five basic technical security controls: who asks for it, the current edition, cost and how Plus differs.
- SOC 2An AICPA attestation report in which a CPA firm gives an opinion on your controls. Who asks for one, how the criteria are organised, and how audits run.
- ISO 9001The international quality management standard: who asks for it, what the 2026 edition changed, how its clauses fit and how certification works.
- ISO 13485The quality management standard for medical devices: who needs it, how its five requirement clauses are laid out, and how certification sits beside EU MDR.
- EU MDRThe law every medical device sold in the EU or Northern Ireland must meet: who it binds, how its chapters fit, and how a device reaches its CE mark.
- UK MDR 2002 and UKCA markingHow a medical device reaches the Great Britain market under the Medical Devices Regulations 2002, how long CE marks last, and the Northern Ireland rules.
- ISO 42001The international standard for an AI management system: who asks for it, how its clauses and Annex A fit together, and how certification works.
- EU AI ActThe EU law on artificial intelligence: who it reaches, how it sorts systems by risk, what applies when, and who enforces it.
- IEC 62304The life cycle standard for medical device software: safety classes A, B and C, the processes each class needs, and how conformity is assessed.
- IEC 62366-1The usability engineering standard for medical devices: use specification, use errors, formative and summative evaluation, and how assessors check it.
- ISO 14971The risk management standard for medical devices: how the process runs, how EU MDR and UK MDR 2002 rely on it, and why it has no certificate of its own.