Heidi: The World’s First ISO 42001-Certified AI Scribe

What does it mean that Heidi is ISO 42001-certified?

ISO 42001 certification demonstrates that Heidi has an AIMS in place and that it adheres to the foundational, standard requirements that validate ethical AI use. This is underpinned by a dedicated AI policy that establishes a structured approach for its operation.

Below, we look at three ways this official validation benefits Heidi:

AI-Specific Risk Management and Impact Assessment

Adhering to the ISO 42001 standards indicates that Heidi uses threat modeling to identify and assess potential threats to secure its software development lifecycle (SDLC).

Heidi's risk management policy for its AIMS is comprehensive and addresses both opportunities and relevant risks in accordance with the framework set out in ISO 42001. Crucially, this policy integrates ongoing performance evaluations, such as those outlined in Clause 9, directly into Heidi's system clauses.

AI Ethics and Human-in-the-Loop Requirements

Heidi's commitment to responsible AI is affirmed by the ISO 42001 certification, which provides a framework for managing increasingly complex AI environments. Key elements include ethical oversight and policy, as well as accountability and fairness.

Heidi’s AI policy with provisions for ethical oversight guides development and deployment, requiring clinician review and approval. To remain fair and accountable, the standard encourages accountability and fosters fairness throughout Heidi’s AI lifecycle.

AI System Lifecycle Governance and Controls

Across the full lifecycle of its AI systems, Heidi applies governance controls. These controls shape how features are released in practice and thus ensure quality checks and safety requirements are met before clinicians ever use them. These measures are aligned with regulations governing AI use in healthcare and provide clear guidance for responsible deployment.

Due to the depth and sensitivity of ADHD assessments, the team at Divergence places importance on rigorous governance around clinical information. Before Heidi, clinicians spent three to six hours just to turn long consultation transcripts and notes into structured reports which created cognitive strain and operational inconsistencies.

Neurodevelopmental Nurse Specialist Andrew Jay recalls, "An ADHD assessment is the most comprehensive mental health assessment. It has to be, because we’re not only looking at the presentation now, we’re looking at the life history…Our average assessment is two and a half hours, but we’ve done five or six-hour sessions for some patients just to get the level of detail we need..."

With Heidi, documentation is now completed in half to an hour, and the notes sound just like them. “It’s creating a standardized output, which for me as a manager is incredibly valuable,” Andrew explains, describing how Heidi’s templates support quality and oversight at scale.

For practices that operate under modern AI governance expectations like the ISO 42001 certification, Divergence’s experience shows how smart systems like Heidi can reduce risk and support clinicians in improving patient engagement.

How does Heidi maintain ISO 42001 certification?

As a healthcare AI partner, Heidi has earned trust and continues to strengthen it as AI systems grow more complex. The approach reflects an understanding that responsible AI governance requires ongoing attention rather than a single assurance. Heidi maintains governance practices that evolve alongside clinical realities and technical standards.

ISO 42001 reflects Heidi’s focus on managing AI systems responsibly through defined controls and accountability, and the following main points.

1. Annual External Audits and Internal Reviews

Heidi is committed to leading the responsible use of AI in healthcare, with ISO 27001 certification serving as a foundational step toward ISO 42001 alignment. As an AI-forward organization, Heidi recognizes that maintaining ISO 42001 certification requires sustained effort, with certification cycles spanning three years. Regular external audits and internal reviews ensure controls remain effective, and governance practices stay current.

2. Performance Tracking Aligned with AI Objectives

Heidi uses structured performance evaluations to assess how effectively its AIMS performs in real clinical workflows. These reviews examine whether Heidi’s systems continue to meet intended objectives in real clinical settings. The outcomes inform governance decisions and support ongoing oversight across the AI lifecycle.

3. Nonconformity Management and Corrective Actions

When limitations are identified, governance processes guide corrective action to protect patient care and clinician trust. To ensure continuous adaptability and enhancement, Heidi prepares ahead of time to address potential nonconformities. Heidi, with its AIMS Improvement Policy, is consistent in documenting its corrective actions and in internally verifying them.

This policy mandates active participation and collaboration from executive leadership down through the organization.