DCB0129 vs DCB0160
The two NHS England standards that govern clinical risk management for health IT — what they require, how they differ, and who is accountable.
| DCB0129 | DCB0160 | |
|---|---|---|
| Applies to | The organisation | Each health IT product |
| Core question | How do we manage clinical risk as a company? | Is this specific product clinically safe? |
| Key artefacts | Safety management plan, CSO appointment, training records | Hazard log, risk assessments, safety case report |
| Sign-off | Organisational clinical safety governance | Product safety case signed by the CSO |
| Maintained | Continuously, organisation-wide | Per product, through its lifecycle and changes |
What the standards are
DCB0129 and DCB0160 are clinical risk management standards published by NHS England. They set out how organisations developing, implementing or using health IT should identify, assess and control clinical risk across the product lifecycle.
They are not optional formality for NHS-facing suppliers: DCB0129/DCB0160 evidence is routinely requested in NHS procurement, DTAC submissions and clinical safety audits. The standards are freely applicable to any organisation, whether or not it sells to the NHS.
DCB0129 — organisation level
DCB0129 applies to the organisation. It requires a documented clinical risk management system covering how you manage clinical risk across all of your health IT products.
Typical artefacts: a clinical safety management plan, a named and empowered Clinical Safety Officer, organisation-level hazard log procedures, staff training records, and an organisation-level clinical risk management file.
- A named Clinical Safety Officer with defined authority
- A clinical risk management plan and process documentation
- Organisational hazard log processes and training records
- Oversight of clinical risk across every product you deliver
DCB0160 — product level
DCB0160 applies to each individual health IT product. It requires systematic clinical hazard identification, risk assessment, implementation of risk controls, and a clinical safety case signed off by the CSO before the product is deployed and maintained through change.
Typical artefacts: a product hazard log, risk assessments with severity and likelihood scoring, evidence of controls (testing, UAT, training), and a signed clinical safety case report.
- A structured hazard log for the product
- Risk assessment using a defined scoring methodology
- Evidence-backed risk controls (design, workflow, training)
- A clinical safety case signed by the CSO
How they fit together
Think of DCB0129 as the system and DCB0160 as the application of that system to one product. An organisation with strong DCB0129 processes runs DCB0160 projects faster and more consistently, because the CSO role, methodology and documentation templates already exist.
Most suppliers building clinical software need both. Organisations deploying third-party clinical systems (e.g. an NHS trust implementing an EPR) also carry DCB0129/DCB0160 obligations.
Who is responsible
Accountability sits with a human: the Clinical Safety Officer. The CSO must be a suitably qualified and experienced clinician who owns the clinical risk management process and signs the safety case.
This is why Csoportal is built the way it is: AI can suggest hazards, causes and controls, and can draft documentation — but the CSO reviews everything and makes every final decision. The AI never approves risk, declares ALARP or signs a safety case.
How Csoportal helps
Find a CSO
Search the independent directory for clinicians with DCB0129/DCB0160 experience in your specialty.
Run DCB0160 projects
Structured hazard logs, configurable risk matrix, evidence library and action tracking.
Build the safety case
Draft each section with AI assistance — clearly labelled, reviewed and approved by the CSO.
Stay audit-ready
Evidence linked to hazards, scoring decisions captured, versions maintained.
This page is an independent educational summary and is not official guidance. The standards are published by NHS England; Csoportal is not an NHS service and does not claim NHS endorsement.