BSI Enables Faster Software Updates Without Recertification

The German Federal Office for Information Security (BSI) will pilot a new TR-03185 “Secure Software Lifecycle” certification from February 2026 that keeps certified software compliant after updates without re-certification by certifying secure development processes, enabling faster releases, less administrative burden, and sustained trust.

The German Federal Office for Information Security (BSI) is introducing a new procedure that allows certified software to remain compliant after updates without requiring recertification. By certifying software development processes under TR-03185 “Secure Software Lifecycle,” manufacturers can deploy security-relevant updates faster while maintaining product certification.

Instead of recertifying every software version, the new approach focuses on ensuring that development and change processes are consistently secure and quality-assured. Certification under TR-03185 is valid for three years and maintained through annual surveillance audits, eliminating the need for re-certifications, maintenance procedures, and change notifications for updates.

The procedure will launch as a pilot from February 2026 for health apps (TR-03161), with plans to extend it to other technical guidelines. Although optional, TR-03185 certification offers manufacturers faster release cycles, reduced administrative effort, and a strong trust signal demonstrating secure development practices such as Security by Design and DevSecOps.

For more information, BSI will announce information sessions on its website. Questions can be directed to tr03185@bsi.bund.de