DCB0129 compliance for NHS software manufacturers

DCB0129 is the NHS England information standard (Clinical Risk Management: its Application in the Manufacture of Health IT Systems) that requires manufacturers of Health IT systems used in the NHS to run a Clinical Risk Management System and produce a signed Clinical Safety Case Report. It replaces the older SCCI0129 and is mandated for any organisation supplying software into NHS clinical care.

Yes if your product is a Health IT system used in NHS clinical care, including EPRs, patient-facing apps, clinical decision support, AI/ML tools, ambient voice scribes, digital therapeutics, patient portals and clinical messaging. If a clinician or patient uses your product to make or record a clinical decision inside the NHS, DCB0129 applies.

DCB0129 is a standard, not a service, you can implement it in-house with a registered Clinical Safety Officer, or outsource to a specialist consultancy such as DigiSafe. Providers should have GMC/NMC/HCPC-registered clinicians on staff and demonstrable experience of NHS-signed Clinical Safety Case Reports.

A Clinical Risk Management Plan, a Hazard Log, a Clinical Safety Case Report and evidence of a named, currently-registered Clinical Safety Officer. The CSCR must be updated for every material release, and the Hazard Log must be live, not a one-off document.

DCB0129 is for manufacturers of Health IT systems, the product. DCB0160 is for deploying organisations, trusts, ICBs, health boards and GP federations, and covers safe deployment into a specific clinical environment. A single NHS product usually needs both: DCB0129 from the supplier and DCB0160 from every deployer.

No. DTAC v2 is NHS England's wider assessment covering clinical safety, data protection, technical security, interoperability and usability. DCB0129 sits inside the clinical safety section of DTAC, you need DCB0129 to pass the clinical safety part, but DTAC requires much more besides.

For a first pass, typically 4-8 weeks with DigiSafe, depending on product complexity and how much documentation already exists. Ongoing maintenance is part of the CSO retainer and typically requires 4-8 hours of CSO time per material release.

A DigiSafe first-pass DCB0129 package (Clinical Risk Management Plan, Hazard Log, Clinical Safety Case Report and named CSO sign-off) starts at £4,500 fixed. Ongoing CSO cover to keep the file live starts at £999/month.

Yes. NHS England confirmed in 2024/25 that AI clinical decision support, ambient voice technology (AVT) scribes and AI-assisted documentation tools used in NHS clinical care are Health IT systems and require full DCB0129 evidence, plus additional AI assurance under the NHS AI Framework.