What is DCB0129?
DCB0129 (sometimes written as DCB 0129) is the national, mandatory NHS England clinical risk management standard that governs how clinical risk is managed during the manufacture of health IT systems.
The standard applies to systems that:
- Can help support clinical decision-making
- Influence patient care pathways
- Capture, process, or surface clinical information to users
- Are deployed within NHS organisations (e.g. hospitals, general practices) or NHS-commissioned services
DCB0129 ensures that clinical risks introduced by digital systems are considered, assessed, mitigated, and controlled for throughout the system lifecycle.
In reality, this means health IT manufacturers must be able to demonstrate that:
- Clinical hazards have been identified and evaluated
- The risks have been assessed and reduced to an acceptable level
- A suitably qualified Clinical Safety Officer (CSO) has overseen this process
- Appropriate safety documentation has been produced and maintained on an ongoing basis
Book a discussion about your product, deployment, or assurance requirements or use our free tool to see if DCB0129 applies to your product.
Who needs to comply with DCB0129?
There is an applicability flowchart provided by NHS England that gives a broad overview of DCB0129 applicability and the sort of products that may require compliance.
However, you are likely to require DCB0129 for your product if you are:
- A health IT supplier providing software that impacts on patient pathways to NHS organisations
- A digital health startup integrating with NHS clinical workflows or NHS central repositories
- A medical device software manufacturer (including Software as a Medical Device) if your product sits within an IT system
- A system integrator or platform provider hosting any clinical functionality
DCB0129 is commonly required as part of:
- Formal procurements with deploying healthcare organisations (e.g. hospitals)
- NHS onboarding and assurance processes for central repositories (e.g. IM1, PDS, EPS)
- DTAC requests and wider deploying organisation clinical safety assessments
What does DCB0129 compliance actually involve?
- 1
Appointment of a Clinical Safety Officer (CSO)
A suitably qualified Clinical Safety Officer must be responsible for overseeing and managing clinical risk management activities and approving the required safety documentation outputs.
- 2
Clinical risk management planning
This requires defining:
- Scope and intended use (and contra-indications) of the system
- Assumptions, constraints, and dependencies
- The process as to how clinical risks will be identified and managed
- 3
Hazard identification and risk assessment
Identification of possible clinical hazards arising from:
- System functionality
- Data flows and integrations (e.g. 3rd parties)
- Clinical and patient user interfaces and workflows
- Foreseeable misuse
These hazards are assessed for severity and likelihood and a risk score, with controls defined and tracked in the DCB0129 hazard log and other documents.
- 4
Production of safety documentation
The usual required outputs of DCB0129 include:
- Clinical Risk Management Plan (CRMP)
- Hazard Log
- Clinical Safety Case Report (CSCR)
- Safety Incident Management Log (SIML)
- 5
Ongoing maintenance
DCB0129 compliance must be maintained for future releases, not just achieved once. All proposed functionality changes, updates, incidents, and new deployments should trigger reviews of the documentation and internal processes to ensure they are up to date.
Common challenges with DCB0129
Many suppliers struggle with DCB0129 because:
- The standard is long and it is sometimes difficult to understand
- CSO input is left too late in product development
- There is confusion about whether the standard applies or not to your products
A proportionate, experienced approach is essential — particularly for smaller suppliers and fast-moving product teams which is difficult to gauge.
How AbedGraham supports DCB0129 compliance
We provide practical, effective DCB0129 consultancy aligned to your product, risk profile, and NHS deployment context. Our support includes:
End-to-end DCB0129 delivery
We take responsibility for:
- Clinical risk management planning
- Hazard identification and documentation
- All DCB0129 documentation development (as above)
- CSO sign-off
This is ideal for organisations needing full DCB0129 compliance support.
DCB0129 consultancy and advisory support
If you already have internal capability, we can provide:
- An independent review and gap analysis of the current documentation
- Targeted consultancy on specific risks or documents
- Support responding to NHS/customer queries
Outsourced Clinical Safety Officer (CSO)
We can provide experienced Clinical Safety Officers on:
- End-to-end delivery of DCB0129
- A project basis for fixed engagements
- Fractional or retained arrangements
Our CSOs work hand-in-hand with development, clinical, and governance teams to expedite work.
More about DCB0129
Typical DCB0129 timelines
While every system is different, indicative timelines for a single-product company (creation of the core documentation from scratch) are usually within the first 3 months, although this depends on the existing documentation present and how pressing the procurement requirement is. We always do our best to work around your sales timelines, however early engagement significantly reduces delivery risk and potential cost.
DCB0129 and DCB0160 – what’s the difference?
DCB0129 applies to manufacturers of health IT systems and DCB0160 applies to healthcare organisations deploying and using those systems. If you are an entity that does aspects of both of those, you may need to cover both standards as part of the same product (which we can manage for you). While the standards are legally distinct, they are closely linked, and clarity between responsibilities is essential to avoid gaps or duplication.
Learn more here about how DCB0129 and DCB0160 interact in practice.
Why Work with The AbedGraham Group?
- Long standing experience in NHS clinical safety and assurance work
- A proportionate approach aligned to real delivery contexts
- Significant experience supporting startups, established suppliers and multi-national corporations
- Clear, defensible documentation that stands up to scrutiny
- We cover all aspects of DCB0129 compliance from the initial documentation to be completed through to ongoing release compliance.
Interested in Other NHS Requirements?
Clinical Safety Officer (CSO)
Independent Clinical Safety Officer services providing clinical oversight, governance, and sign-off required under DCB0129 for NHS-deployed digital health systems.
DCB0160 Guidance for Suppliers
Clear guidance on DCB0160 clinical risk management for deployment, helping suppliers understand responsibilities, support NHS customers, and avoid delays caused by role confusion.
Clinical Safety
Talk to a DCB0129 specialist
If you need support with DCB0129 compliance, DCB 0129 consultancy, or Clinical Safety Officer services, we’d be happy to discuss your situation. Speak to a DCB0129 consultant about your product and NHS deployment plans.
Frequently asked questions
There is no difference - both refer to the same NHS clinical risk management standard. The spacing variation is common in searches and documentation.
Yes. NHS suppliers of all sizes may be required to demonstrate DCB0129 compliance, though the approach should be proportionate.
DCB0129 is a mandated NHS information standard and is commonly required as part of NHS procurement and assurance processes.
Yes. DCB0129 requires a named CSO with appropriate competence and authority. We can provide that as part of any DCB0129 package.
DCB0129 compliance is not a one-off exercise. It must be maintained for as long as the system is deployed, with reviews triggered by functionality changes, updates, incidents and new deployments. To confirm whether your product needs to comply in the first place, NHS England provides a flowchart here, and we can give expert advice on navigating it where the answer is still unclear.
We pride ourselves in working with SMEs and startups through to some of the largest companies in the world for this standard. We can support any company size with any product at any stage of development.
Yes - in fact, outsourcing DCB0129 and the Clinical Safety Officer role is the most common way of working for health IT suppliers, and frequently the most efficient way to fulfil the standard.
If you are still potentially impacting on patient care, then the answer is yes. Frequently, deploying organisations will ask for evidence of DCB0129 before even starting a pilot or proof-of-concept study now.
Broadly speaking, yes. If you are connecting to central NHS systems (IM1, PDS, EPS), then not only will you need to complete DCB0129 for your product, but you may also need to complete a specific hazard log provided by the NHS for that integration and return it in a specific format. Very few people understand this requirement but it can delay connectivity significantly.
We always aim to include DCB0129 as early in the software development life cycle process as possible. This ensures maximal stakeholder engagement and sets up the process of ongoing compliance in the organisation.
Deploying organisations or regulators will generally look at whether the documentation provided has fulfilled all of the requirements of the standards. Having done this for over 100 products and taken clients through every local or national onboarding scheme, we know how best to structure and present documents for easier procurements.
This depends on the complexity and number of products but generally for a simple one-product company, the initial paperwork can be created within a 3-month period. However, if there is a pressing procurement requirement, we may be able to expedite that timeline.
Broadly speaking, yes. We always say that at the least all major and minor releases and associated testing reports should be reviewed by the CSO prior to go-live. Any incident that may impact on patient care should also be escalated for review too.
Yes, and this is frequently the most common way for health IT companies to fulfil the standard.
The honest answer is: very variably. We have seen hugely disparate ways of assessing DCB0129 documentation, and it really operates on a case-by-case basis. That said, having managed over 100 products to date in this area, we have seen almost every type of organisation response and are well equipped to respond accordingly.
Related services
DCB0129 Support & Assurance
The AbedGraham Group provides specialist DCB0129 (DCB 0129) compliance consultancy for organisations…
Clinical Safety Officer (CSO) Services Provider
Experienced Clinical Safety Officer support for DCB0129 and NHS digital assurance The AbedGraham…
DCB0160 Compliance & Consultancy
Understanding DCB0160 and how it relates to DCB0129 for NHS health IT suppliers DCB0160 is the…