What is DCB0129?
DCB0129 (sometimes written as DCB 0129) is the NHS England clinical risk management standard governing how clinical risk is managed during the manufacture and deployment of health IT systems.
The standard applies to systems that:
- Support clinical decision-making
- Influence patient care pathways
- Capture, process, or present clinical information
- Are deployed within NHS organisations or NHS-commissioned services
DCB0129 focuses on ensuring that clinical risks introduced by digital systems are identified, assessed, mitigated, and managed throughout the system lifecycle.
In practice, this means health IT suppliers must be able to demonstrate that:
- Clinical hazards have been systematically identified
- Risks have been assessed and reduced to an acceptable level
- A suitably qualified Clinical Safety Officer (CSO) oversees this process
- Appropriate safety documentation is produced and maintained
Book a discussion about your product, deployment, or assurance requirements or use our free tool to see if DCB0129 applies to your product.
Who needs to comply with DCB0129?
There is an NHS flowchart provided by NHS England online that gives a broad overview of DCB0129 applicability and the sort of products that may require compliance.
However, in brief, you are likely to require DCB0129 compliance if you are:
- A health IT supplier providing software to NHS organisations
- A digital health startup integrating with NHS clinical workflows
- A medical device software manufacturer (including Software as a Medical Device) if your product sits within an IT system
- A system integrator or platform provider hosting clinical functionality
DCB0129 is commonly required as part of:
- Formal procurement mechanisms with deploying healthcare organisations
- NHS onboarding and assurance processes (e.g. IM1, PDS, EPS)
- DTAC and wider clinical safety assessments
What does DCB0129 compliance actually involve?
- 1
Appointment of a Clinical Safety Officer (CSO)
A suitably qualified Clinical Safety Officer must be responsible for overseeing clinical risk management activities and approving safety documentation.
- 2
Clinical risk management planning
This includes defining:
- Scope and intended use of the system
- Assumptions, constraints, and dependencies
- How clinical risks will be identified and managed
- 3
Hazard identification and risk assessment
You must identify clinical hazards arising from:
- System functionality
- Data flows and integrations
- User interfaces and workflows
- Foreseeable misuse
These hazards are assessed for severity and likelihood, with controls defined and tracked in the DCB0129 hazard log.
- 4
Production of safety documentation
Key artefacts of DCB0129 commonly include:
- Clinical Risk Management Plan (CRMP)
- Hazard Log
- Clinical Safety Case Report (CSCR)
- A Safety Incident Management Log (SIML)
- 5
Ongoing maintenance
DCB0129 compliance must be maintained, not just achieved once. All proposed functionality changes, updates, incidents, and new deployments should trigger reviews of the documentation and internal processes.
Common challenges with DCB0129
Many suppliers struggle with DCB0129 because:
- The standard is long and its constituent components are sometimes difficult to understand
- The standard is long and its constituent components are sometimes difficult to understand
- CSO input is left too late in delivery
- There is confusion about whether the standard applies or not
A proportionate, experienced approach is essential — particularly for smaller suppliers and fast-moving product teams.
How AbedGraham supports DCB0129 compliance
We provide practical, proportionate DCB0129 consultancy aligned to your product, risk profile, and NHS deployment context. Our support includes:
End-to-end DCB0129 delivery
We take responsibility for:
- Clinical risk management planning
- Hazard identification and documentation
- All DCB0129 documentation development
- CSO oversight and sign-off
This is ideal for organisations needing full DCB0129 compliance support.
DCB0129 consultancy and advisory support
If you already have internal capability, we can provide:
- Independent review and gap analysis
- Targeted consultancy on specific risks or documents
- Support responding to NHS or assessor queries
Outsourced Clinical Safety Officer (CSO)
We can provide experienced Clinical Safety Officers on:
- End-to-end delivery of DCB0129 for suppliers
- A project basis for fixed engagements
- Fractional or retained arrangements
Our CSOs work hand-in-hand with development, clinical, and governance teams.
More about DCB0129
Typical DCB0129 timelines
While every system is different, indicative timelines for a single-product company are usually within the first 3 months of engagement, although this depends on the existing documentation present and how pressing the procurement requirement is. We can always do our best to work around your sales timelines, however early engagement significantly reduces delivery risk and potential cost.
DCB0129 and DCB0160 – what’s the difference?
DCB0129 applies to manufacturers and suppliers of health IT systems and DCB0160 applies to healthcare organisations deploying and using those systems. If you are an entity that does aspects of both of those, you may need to cover both standards as part of the same product. While distinct, the two standards are closely linked, and clarity between responsibilities is essential to avoid gaps or duplication.
Learn more here about how DCB0129 and DCB0160 interact in practice.
Why Work with The AbedGraham Group?
- Deep specialism in NHS clinical safety and assurance
- Proportionate approach aligned to real delivery contexts
- Experience supporting startups, established suppliers and multi-national corporations
- Clear, defensible documentation that stands up to scrutiny
- Consultants who integrate with your team, not slow it down
- We cover all aspects of DCB0129 provision from initial documentation through to ongoing compliance and communication with other parties
Interested in Other NHS Requirements?
Clinical Safety Officer (CSO)
Independent Clinical Safety Officer services providing clinical oversight, governance, and sign-off required under DCB0129 for NHS-deployed digital health systems.
DCB0160 Guidance for Suppliers
Clear guidance on DCB0160 clinical risk management for deployment, helping suppliers understand responsibilities, support NHS customers, and avoid delays caused by role confusion.
Clinical Safety
Talk to a DCB0129 specialist
If you need support with DCB0129 compliance, DCB 0129 consultancy, or Clinical Safety Officer services, we’d be happy to discuss your situation. Speak to a DCB0129 consultant about your product and NHS deployment plans.
Frequently asked questions
There is no difference - both refer to the same NHS clinical risk management standard. The spacing variation is common in searches and documentation.
Yes. NHS suppliers of all sizes may be required to demonstrate DCB0129 compliance, though the approach should be proportionate.
DCB0129 is a mandated NHS information standard and is commonly required as part of NHS procurement and assurance processes.
Yes. DCB0129 requires a named CSO with appropriate competence and authority. We can provide that as part of any DCB0129 package.
DCB0129 compliance is not a one-off exercise. It must be maintained for as long as the system is deployed, with reviews triggered by functionality changes, updates, incidents and new deployments. To confirm whether your product needs to comply in the first place, NHS England provides a flowchart here, and we can give expert advice on navigating it where the answer is still unclear.
We pride ourselves in working with SMEs and startups through to some of the largest companies in the world for this standard. We can support any company size with any product at any stage of development.
Yes - in fact, outsourcing DCB0129 and the Clinical Safety Officer role is the most common way of working for health IT suppliers, and frequently the most efficient way to fulfil the standard.
If you are still potentially impacting on patient care, then the answer is yes. Frequently, deploying organisations will ask for evidence of DCB0129 before even starting a pilot or proof-of-concept study now.
Broadly speaking, yes. If you are connecting to central NHS systems (IM1, PDS, EPS), then not only will you need to complete DCB0129 for your product, but you may also need to complete a specific hazard log provided by the NHS for that integration and return it in a specific format. Very few people understand this requirement but it can delay connectivity significantly.
We always aim to include DCB0129 as early in the software development life cycle process as possible. This ensures maximal stakeholder engagement and sets up the process of ongoing compliance in the organisation.
Deploying organisations or regulators will generally look at whether the documentation provided has fulfilled all of the requirements of the standards. Having done this for over 100 products and taken clients through every local or national onboarding scheme, we know how best to structure and present documents for easier procurements.
This depends on the complexity and number of products but generally for a simple one-product company, the initial paperwork can be created within a 3-month period. However, if there is a pressing procurement requirement, we may be able to expedite that timeline.
Broadly speaking, yes. We always say that at the least all major and minor releases and associated testing reports should be reviewed by the CSO prior to go-live. Any incident that may impact on patient care should also be escalated for review too.
Yes, and this is frequently the most common way for health IT companies to fulfil the standard.
The honest answer is: very variably. We have seen hugely disparate ways of assessing DCB0129 documentation, and it really operates on a case-by-case basis. That said, having managed over 100 products to date in this area, we have seen almost every type of organisation response and are well equipped to respond accordingly.
Related services
DCB0129 Support & Assurance
The AbedGraham Group provides specialist DCB0129 (DCB 0129) compliance consultancy for organisations…
Clinical Safety Officer (CSO) Services Provider
Experienced Clinical Safety Officer support for DCB0129 and NHS digital assurance The AbedGraham…
DCB0160 Compliance & Consultancy
Understanding DCB0160 and how it relates to DCB0129 for NHS health IT suppliers DCB0160 is an NHS…