How to implement BSI TR-03161 and similar requirements in a QMS for DiGA?

If possible, it's a good idea to integrate these requirements directly into your existing system for tracking stakeholder and software requirements. You'll eventually need full traceability, especially for certification, and some of the BSI requirements may result in additional risk control measures, so it's important to link them properly.

For implementation, you can either reference where each requirement is addressed (such as in your QMS, privacy policy, or code repository), or create a checklist in your technical documentation noting where each requirement is fulfilled. If you already have related procedures in your QMS, reference those. For new requirements, add them to your requirements list and ensure traceability.

For upcoming standards like ISO/IEC 82304-2 or IEC 81001-5-1, it's a similar approach—track them alongside your other requirements, and update your processes if they become mandatory.