How do I know if my records management software is actually compliant with the standards it claims to meet?

A vendor claim of “compliance” is a starting point for your evaluation, not the end of it. Compliance is rarely a single yes-or-no property of a product. It depends on how a system is configured, deployed, and operated in your environment. The goal is to move from a marketing claim to evidence you can verify.

Ask which standard, and which version

Begin by asking exactly what the claim refers to. A credible answer names a specific standard, the edition or version, and the date it was assessed against. Standards such as ISO 15489 and ISO 16175 describe functional and management requirements for records in digital environments, while government and sector rules may impose additional obligations. Vague phrasing like “fully compliant” without a named standard should prompt more questions, not reassurance.

Distinguish certification from self-assertion

Some compliance claims rest on independent testing or certification against a published specification; others are the vendor’s own assertion. Both can be legitimate, but they carry different weight. Ask:

• Was the assessment performed by the organization itself or by an independent party?
• Against which requirements, and is a test report or conformance statement available?
• Does the certification apply to the product version you will actually run?

Map requirements to features you can test

Translate each standard’s requirements into concrete capabilities, then confirm them in a working environment. Typical areas include reliable capture, classification, retention and disposition scheduling, audit trails that cannot be silently altered, access controls, and defensible deletion. Where possible, validate these against your own records and policies rather than a canned demo.

Remember that compliance is operational

Even well-designed software only stays compliant if it is configured and used correctly. Your retention schedules, security settings, and procedures are part of the compliant system. Standards and program guidance consistently emphasize that recordkeeping is governed by policy and practice, not by software alone.

Document your own due diligence

Keep a record of what you asked, what evidence you received, and how you tested it. This documentation supports your program’s own defensibility and helps during audits.

For related guidance, see the compliance and standards topic hub.