Published: 21st September 2026
Reviewed by: David Small BSc (Hons), MSc, MTOPRA (Founder and CEO)
What is DCB0129?
DCB0129 is formally titled:
“Clinical Risk Management: its Application in the Manufacture of Health IT Systems.”
The standard establishes clinical risk management requirements for manufacturers of health IT systems.
In practical terms, it requires manufacturers to take a systematic approach to identifying and managing clinical risks associated with their technology.
This means considering questions such as:
- What clinical hazards could arise from the technology?
- What circumstances could lead to patient harm?
- How severe could that harm be?
- How likely is it to occur?
- What controls can reduce the risk?
- What residual risks remain?
- How will clinical safety be monitored as the product changes?
Clinical safety therefore needs to form part of the product lifecycle rather than being treated as a document produced immediately before NHS procurement.
New to NHS DTAC Compliance?
Understanding the five areas of DTAC is an important part of preparing digital health technologies for NHS adoption. For a practical overview of the Digital Technology Assessment Criteria, including clinical safety, data protection, technical security, interoperability, and usability and accessibility, read our Complete Guide to NHS DTAC Compliance for Digital Health Manufacturers.
How Does DCB0129 Relate to DTAC?
Clinical safety is one of the five core areas considered under NHS DTAC.
When an organisation assesses a digital health technology, it needs assurance that appropriate clinical risk management arrangements exist.
For manufacturers, DCB0129 provides the central clinical risk management framework where it applies.
The relationship can be thought of simply:
DTAC asks whether appropriate clinical safety assurance exists.
DCB0129 provides requirements for how manufacturers manage clinical risk in health IT systems.
That is why a manufacturer approaching DTAC may be asked about clinical safety governance and supporting documentation such as a Hazard Log and Clinical Safety Case Report.
NHS England’s current NHS Login supplier requirements, for example, explicitly request a Clinical Safety Case Report and Hazard Log as part of clinical safety conformance evidence.
Does DCB0129 Apply to Your Digital Health Product?
Applicability needs to be determined based on the product and how it is used.
NHS England defines a health IT system as a product used to provide electronic information for health or social care purposes, which can consist of hardware, software or a combination of the two. Its broader guidance defines a digital product as a digital artefact, product or service used for health or social care purposes.
Examples potentially requiring consideration include:
- clinical decision-support software
- digital triage systems
- patient monitoring platforms
- healthcare mobile applications
- electronic prescribing-related software
- clinical workflow systems
- diagnostic software
- AI-enabled healthcare applications
- telehealth platforms
- systems exchanging clinical information
- Software as a Medical Device integrated into health IT environments
One particularly important point is that DCB0129 should not be dismissed simply because a product is already regulated as a medical device.
NHS England recommends adoption of DCB0129 and DCB0160 where digital products are developed or deployed to support health or social care services, subject to its applicability guidance. It also explicitly states that the standards do not replace medical-device regulatory requirements.
The regulatory and NHS clinical-safety assessments therefore need to be considered together.
DCB0129 vs DCB0160: What Is the Difference?
This is one of the most common areas of confusion.
The easiest distinction is:
Standard | Primary responsibility | Purpose |
DCB0129 | Manufacturer | Clinical risk management during manufacture/development of the health IT system |
DCB0160 | Deploying health organisation | Clinical risk management during deployment and use of the health IT system |
DCB0160 requires the healthcare organisation to establish a framework for managing clinical risks associated with deploying and implementing new or modified health IT systems.
But that does not mean the two processes operate independently.
The manufacturer needs to provide appropriate safety information that enables the NHS organisation to understand and manage the risks associated with local deployment.
NHS England guidance demonstrates this relationship through the transfer of identified risks: suppliers and providers may need to review transferred risks, incorporate them into their respective Hazard Logs and implement appropriate mitigations.
In other words:
The manufacturer manages the clinical safety of the product.
The NHS organisation manages the clinical safety of deploying and using that product within its particular environment.
The two need to connect.
Understanding the Wider DTAC Requirements?
Clinical safety and compliance with DCB0129 form an important part of the NHS Digital Technology Assessment Criteria, but they are only one area of DTAC. For an overview of clinical safety, data protection, technical security, interoperability, and usability and accessibility, read our Five Areas of NHS DTAC Requirements.
What Does DCB0129 Compliance Involve?
Although the exact activities depend on the technology and its clinical risks, several components are particularly important.
1. Clinical Safety Governance
Someone needs appropriate responsibility and authority for clinical safety.
This is where the Clinical Safety Officer (CSO) becomes important.
The CSO provides clinical safety oversight and helps ensure clinical risk management is applied appropriately.
However, appointing a CSO does not mean clinical safety becomes one person’s job.
Effective clinical safety often requires input from:
- software developers
- clinicians
- product teams
- regulatory professionals
- quality assurance
- information security
- usability specialists
- senior management
Developers understand the system.
Clinicians understand the potential consequences within care pathways.
Both perspectives are needed.
2. Clinical Risk Management Plan
Clinical safety needs to be planned.
A Clinical Risk Management Plan establishes how clinical risk management will be undertaken for the health IT system.
Depending on the project, it may address matters such as:
- scope
- responsibilities
- clinical safety activities
- risk-management methodology
- risk acceptability
- review arrangements
- documentation
- lifecycle activities
The objective is to establish a controlled process before simply starting to populate a Hazard Log.
3. Hazard Identification
One of the central clinical safety activities is identifying potential hazards.
A hazard is a potential source of harm to a patient.
For digital health software, hazards might relate to situations such as:
- incorrect clinical information being displayed
- important information being unavailable
- patient information being associated with the wrong patient
- an alert failing to trigger
- an incorrect calculation
- delayed transmission of information
- data being incorrectly interpreted
- a user misunderstanding an interface
- integration failures
- outdated clinical information being presented
Importantly, teams should avoid focusing only on software defects.
Clinical hazards can emerge from the interaction between technology, users, workflows, data and the wider healthcare environment.
4. The Hazard Log
The Hazard Log becomes one of the most important working records within the clinical risk management process.
It provides a structured mechanism for recording and tracking identified hazards and associated clinical risks.
A well-maintained Hazard Log can capture matters such as:
- hazard
- foreseeable sequence of events
- potential harm
- initial risk
- risk controls
- residual risk
- responsible parties
- status
The Hazard Log should be a living record.
As software changes, new integrations are introduced, incidents occur or additional information becomes available, clinical risks may need to be reconsidered.
5. Clinical Risk Controls
Identifying a hazard is only the beginning.
Where risk is unacceptable, appropriate controls need to be established.
Controls could include:
- software design changes
- validation rules
- warnings
- alarms
- user-interface improvements
- access restrictions
- workflow controls
- training
- instructions
- monitoring
- operational procedures
The strongest control is not necessarily another warning message.
Where practicable, risks should be addressed through effective system design rather than relying solely on users to prevent hazardous situations.
6. Clinical Safety Case
The Clinical Safety Case brings together the argument and evidence supporting the clinical safety of the technology.
NHS clinical safety guidance defines the Clinical Safety Case as the accumulation and organisation of product and business-process documentation and supporting evidence throughout the lifecycle of a health IT system.
This is important because a Clinical Safety Case is more than a collection of forms.
It needs to tell a coherent story.
What are the risks?
How were they identified?
How were they controlled?
What evidence supports those controls?
What residual risks remain?
Why is the resulting position considered acceptable?
7. Clinical Safety Case Report
The Clinical Safety Case Report communicates the conclusions of the Clinical Safety Case at a defined point in the product lifecycle.
NHS guidance describes it as presenting the arguments and supporting evidence for the safety of the system for a defined application and environment.
For NHS customers, this can become an important piece of assurance evidence.
It provides a structured way of understanding the manufacturer’s clinical safety position without requiring the customer to reconstruct the entire risk-management process itself.
What Clinical Safety Evidence Should Manufacturers Prepare?
For manufacturers preparing for DTAC and NHS procurement, the clinical safety evidence package may therefore include:
- Clinical Risk Management Plan
- clinical risk management procedure
- Hazard Log
- Clinical Safety Case
- Clinical Safety Case Report
- evidence of Clinical Safety Officer involvement
- clinical hazard workshops or review records
- evidence supporting risk controls
- safety incident records
- change-control evidence
- DCB0129 compliance evidence
- relevant product safety documentation
The exact package should reflect the technology and applicable requirements.
The goal is not to create the largest possible folder of documents.
It is to demonstrate a coherent, controlled clinical safety process.
DCB0129 and ISO 14971: Are They the Same?
No.
This distinction is especially important for manufacturers of Software as a Medical Device.
ISO 14971 provides an internationally recognised framework for applying risk management to medical devices.
DCB0129 is an NHS clinical risk management standard for health IT systems.
There are areas of conceptual overlap because both involve identifying hazards, evaluating risks, implementing controls and maintaining risk management throughout the lifecycle.
But one should not simply be substituted for the other.
NHS guidance confirms that DCB0129/DCB0160 do not supersede or replace medical-device regulatory requirements.
For a digital product falling within both frameworks, an efficient approach is to align the processes where appropriate while clearly demonstrating the requirements of each.
This avoids maintaining two disconnected safety systems while also avoiding the assumption that compliance with one automatically demonstrates compliance with the other.
Common DCB0129 Mistakes
Several problems can weaken clinical safety readiness.
Starting clinical safety too late
Clinical safety should influence development.
Finding a significant clinical hazard immediately before procurement may require changes to the software itself—not merely changes to documentation.
Treating the Hazard Log as a template exercise
A generic list of software risks does not demonstrate meaningful clinical risk management.
Hazards need to reflect the actual product, intended use, users and clinical environment.
Focusing only on software failure
A system can operate exactly as designed and still contribute to clinical risk if its design, information presentation or workflow creates unsafe circumstances.
Assuming medical device risk management is enough
ISO 14971 documentation may provide valuable evidence, but manufacturers still need to establish how applicable DCB0129 requirements are addressed.
Creating a Clinical Safety Case Report without the underlying process
The report is an output of clinical risk management.
It should not be written first and justified retrospectively.
Failing to maintain the evidence
Clinical safety continues after the initial release.
Changes to functionality, integrations, clinical workflows or identified hazards may affect the safety case.
Clinical Safety Does Not End at NHS Deployment
The manufacturer’s responsibilities and the deploying organisation’s responsibilities interact throughout deployment.
DCB0160 requires health organisations to apply clinical risk management to deployment, use, maintenance and decommissioning. Its current specification also requires post-deployment processes for reviewing safety concerns and incidents and considering their effect on the ongoing Clinical Safety Case.
Manufacturers should therefore be prepared to support NHS organisations with appropriate safety information.
This can include communicating:
- known hazards
- required controls
- residual risks
- deployment assumptions
- configuration requirements
- safety-related changes
- incidents
- limitations
Clinical safety is therefore not just a compliance requirement.
It is part of the relationship between the technology manufacturer and the healthcare organisation using the product.
DCB0129 Is Currently Under Review – What Does This Mean?
This is particularly relevant for manufacturers preparing for NHS procurement in 2026.
NHS England has commenced a formal review of DCB0129 and DCB0160 to ensure the standards remain practical, current and aligned with developments in healthcare technology and clinical practice.
A public consultation launched on 29 June 2026 and is scheduled to remain open until 11 September 2026.
This does not mean manufacturers should stop implementing clinical safety requirements while waiting for revised standards.
The current published DCB0129 and DCB0160 requirements remain the relevant standards.
Instead, manufacturers should ensure their clinical safety systems are properly implemented and monitor the NHS England review so they can respond to future changes when revised requirements are published.
For Patient Guard, we should also review this article immediately before its planned September publication because the consultation is active during the campaign.
A Practical DCB0129 Readiness Checklist
Before approaching NHS DTAC or procurement, ask:
- Have we assessed whether DCB0129 applies?
- Have we established clinical safety responsibilities?
- Do we have appropriate Clinical Safety Officer oversight?
- Is there a documented Clinical Risk Management Plan?
- Have product-specific clinical hazards been systematically identified?
- Is our Hazard Log current?
- Have clinical risks been evaluated and controlled?
- Can we demonstrate evidence supporting those controls?
- Have residual risks been appropriately evaluated?
- Do we have a coherent Clinical Safety Case?
- Is there an appropriate Clinical Safety Case Report?
- Are clinical safety activities integrated with product change control?
- Do we have processes for reviewing safety information after release?
- Can we communicate relevant hazards and controls to NHS deploying organisations?
- Is our clinical safety evidence ready to support DTAC and NHS procurement?
If several answers are “no” or “we’re not sure”, the clinical safety workstream should be addressed before a live NHS procurement deadline creates additional pressure.
How Patient Guard Can Support DCB0129 and Clinical Safety
Clinical safety requires more than completing a template.
Patient Guard’s Clinical Safety Compliance Services support digital health manufacturers with the practical implementation of NHS clinical risk management requirements.
Support can include establishing the appropriate clinical safety framework, reviewing DCB0129 applicability, developing clinical risk management documentation, supporting hazard identification and helping build the evidence required for a robust Clinical Safety Case.
For organisations working towards broader NHS adoption, clinical safety can also be integrated with our DTAC Readiness Assessment, DTAC Accelerator and NHS Procurement Ready services.
This means clinical safety is addressed as part of the wider NHS market-access strategy rather than as an isolated compliance exercise.
Build Clinical Safety Into Your NHS Strategy
If your digital health technology is intended for the NHS, clinical safety should be considered early.
Waiting until an NHS organisation asks for your Hazard Log or Clinical Safety Case Report can expose gaps at exactly the point when commercial deadlines are tightest.
A structured approach to DCB0129 can help you identify clinical risks earlier, build stronger evidence and provide NHS customers with greater confidence in your technology.
Patient Guard can help you understand your current position and develop the clinical safety evidence needed to support DTAC and NHS procurement.
The important word is evidence.
DTAC readiness is much stronger when each answer can be traced to current, controlled and product-specific evidence.
Frequently asked questions about DCB0129 and Clinical Safety
NHS England states that compliance with DCB0129 and DCB0160 is mandatory under the Health and Social Care Act 2012. DCB0129 establishes clinical risk management requirements for manufacturers of health IT systems. Applicability should be determined for the particular digital product and circumstances.
DCB0129 applies clinical risk management requirements to manufacturers of health IT systems. DCB0160 establishes requirements for health organisations responsible for deployment and use.
Medical device status does not automatically remove DCB0129 considerations. NHS England's applicability guidance explains circumstances where medical devices implemented within health IT systems remain within scope and explicitly states that DCB0129/DCB0160 do not replace medical-device regulatory requirements.
It is the report presenting the arguments and supporting evidence demonstrating the clinical safety position of a health IT system for a defined application, environment and point in its lifecycle.
The Hazard Log forms a central part of clinical risk management evidence. NHS England supplier assurance processes can explicitly require both the Clinical Safety Case Report and Hazard Log.
Yes. NHS England is currently reviewing DCB0129 and DCB0160. A public consultation opened on 29 June 2026 and is scheduled to close on 11 September 2026.
References
This guide is based on official NHS England guidance, standards and digital service guidance relating to the Digital Technology Assessment Criteria (DTAC), clinical safety, data protection, technical security, interoperability, usability and accessibility for digital health technologies used within NHS and social care settings.
| Organisation | Reference | Why it's relevant |
|---|---|---|
| NHS England | Digital Technology Assessment Criteria (DTAC): Guidance for Buyers and Suppliers | Provides the principal NHS guidance on the Digital Technology Assessment Criteria. DTAC provides a national baseline for assessing digital health technologies and supports NHS and social care organisations when considering the assurance of digital technology products. |
| NHS England | Medical Devices and Digital Tools | Provides NHS England guidance relating to medical devices and digital health tools, including considerations relevant to the implementation and use of digital technologies within NHS healthcare environments. |
| NHS England | Principles for Using Digital Technologies in Mental Health Inpatient Treatment and Care | Defines DTAC as a set of criteria used when introducing new digital health technology and identifies the national minimum standards covering clinical safety, data protection, technical security, interoperability, usability and accessibility. |
| NHS England Digital | Clinical Risk Management Standards | Provides the NHS framework for clinical risk management of health IT systems and explains the roles of DCB0129 and DCB0160. DCB0129 applies to manufacturers of health IT systems, while DCB0160 applies to health organisations deploying and using those systems. |
| NHS England Digital | DCB0129: Clinical Risk Management – its Application in the Manufacture of Health IT Systems | Defines clinical risk management requirements for organisations responsible for developing and maintaining health IT systems. It is particularly relevant to digital health manufacturers preparing clinical safety evidence for DTAC. |
| NHS England Digital | DCB0160: Clinical Risk Management – its Application in the Deployment and Use of Health IT Systems | Defines clinical risk management requirements for health and care organisations responsible for the deployment, use, maintenance or decommissioning of health IT systems. |
| NHS England | National Review of Clinical Risk Management Standards DCB0129 and DCB0160: Supporting Information | Provides current information on NHS England's review of DCB0129 and DCB0160 and explains their respective responsibilities. DCB0129 establishes clinical risk management requirements for manufacturers of health IT systems, while DCB0160 establishes requirements for care organisations deploying and using health IT systems. |
| NHS England Digital Service Manual | What All NHS Services Need to Do About Accessibility | Sets out NHS accessibility requirements for digital services, including WCAG 2.2 Level AA, compatibility with commonly used assistive technologies, inclusion of people with access needs in user research and publication of an accessibility statement. |
| NHS England Digital Service Manual | Accessibility | Provides NHS guidance on designing, developing and testing accessible digital services. The NHS Digital Service Manual reflects WCAG 2.2 and provides guidance covering accessibility across product development, user research, content, design, development and testing. |
DTAC readiness should not be treated as a one-time exercise. Digital health manufacturers should maintain their supporting evidence as their technology, clinical use, data processing activities, security environment, integrations and applicable NHS requirements evolve.
Patient Guards Recent Posts
DCB0129 and Clinical Safety: What Digital Health Manufacturers Need for NHS DTAC
For digital health manufacturers preparing to enter the NHS, clinical safety can be one of the most important—and sometimes misunderstood—parts of DTAC.
It is not enough to demonstrate that your software works.
Manufacturers need to consider what could happen if the technology fails, produces incorrect information, presents information incorrectly, contributes to a workflow error or is used in circumstances that could expose patients to harm.
This is where clinical risk management and DCB0129 become particularly important.
NHS England identifies DCB0129 as the clinical risk management standard for manufacturers of health IT systems. Its counterpart, DCB0160, applies to health organisations deploying and using health IT systems. NHS England states that compliance with these standards is required under the Health and Social Care Act 2012.
For manufacturers working towards NHS DTAC readiness, understanding the distinction—and having the right clinical safety evidence—is essential.
DTAC Requirements Explained: The 5 Areas Digital Health Manufacturers Need to Get Right
If your digital health technology is heading towards the NHS, understanding the Digital Technology Assessment Criteria (DTAC) should be part of your market-access planning.
But one of the biggest mistakes manufacturers can make is treating DTAC as simply another questionnaire to complete.
The questions are only part of the process.
Behind your answers needs to be evidence showing that your technology and organisation have appropriate arrangements for clinical safety, data protection, technical security, interoperability, and usability and accessibility.
These five areas form the core of NHS DTAC. NHS England describes DTAC as national baseline criteria for digital health technologies entering NHS and social care.
For digital health manufacturers, the practical question is therefore not simply:
“Can we complete the DTAC assessment?”
It is:
“Can we demonstrate that our product meets the requirements?”
This guide looks at each of the five DTAC areas, the types of evidence manufacturers should consider and some of the common gaps that can delay NHS readiness.
The Complete Guide to NHS DTAC Compliance for Digital Health Manufacturers
A complete guide to NHS DTAC compliance for digital health manufacturers, covering the five DTAC assessment areas, required evidence, clinical safety, data protection, technical security, interoperability and usability, and how to prepare your digital health technology for NHS procurement.
Patient Guards Related Services
Need Training?
Do you need training on Quality Management Systems or EU MDR/ EU IVDR? then check out our training courses.
