DCB0129 and DCB0160 explained: clinical safety and the Clinical Safety Officer for health software

DCB0129 and DCB0160 for health software: required documents, hazard log, safety case, who can be a Clinical Safety Officer and CSO training costs.

Short answer. DCB0129 is the NHS clinical risk management standard for companies that build health IT; DCB0160 is the matching standard for NHS and care organisations that deploy it. As a manufacturer you need a clinical risk management system, a named Clinical Safety Officer (CSO) who is a registered clinician, a clinical risk management plan, a hazard log and a clinical safety case report, kept up to date for the life of the product. NHS buyers ask for these in section C1 of DTAC. The current versions are DCB0129 v4.2 and DCB0160 v3.2, and NHS England is reviewing both.

This guide is for founders and product teams building software used in direct patient care. It covers what the standards require, what each document is, who can act as CSO and what training costs, how to fit the work into agile delivery, and what the 2025-26 changes mean.

Last checked: 2 November 2026.

This is a general guide for suppliers, not legal or regulatory advice. Magora is a software developer, not your regulatory advisor. NHS requirements change from time to time, so check the current version on the official pages linked below before you submit anything.

Does DCB0129 apply to your product?

DCB0129 applies to manufacturers of health IT systems: software that is used in the direct care of patients. In DTAC terms, if your product provides electronic information that influences, supports or manages the real-time or near real-time direct care of patients, you must show DCB0129 compliance or justify why you are out of scope.

Typical examples in scope are clinical records and dashboards, prescribing and medication tools, triage and referral, remote monitoring, care-planning tools and clinical decision support. Purely administrative tools, such as rota or finance systems, usually are not. NHS England publishes an applicability tool to help decide. If you conclude the standard does not apply, write the reasoning down: the buyer can challenge it.

DCB0129 applies whether or not your product is also a medical device. For medical devices, ISO 14971 applies as well, and the standard is broadly consistent with it.

DCB0129 vs DCB0160

Source: DCB0129 v4.2 and DCB0160 v3.2 specifications, NHS England.

The documents DCB0129 requires

Source: DCB0129 v4.2 sections 2–3. NHS England publishes free templates for the system, plan, hazard log and safety case report.

There is no single NHS-wide scoring scheme for the hazard log. You declare the risk matrix you used in the plan and the safety case report, and each buyer judges it against its own tolerance. Hazard identification methods named in the standards include functional failure analysis, HAZID and structured what-if technique (SWIFT).

The Clinical Safety Officer: who can do it

Both standards use the same wording. The CSO must:

• be a suitably qualified and experienced clinician;
• hold a current registration with an appropriate professional body, such as the GMC, NMC or HCPC, relevant to their training and experience;
• be knowledgeable in risk management and its application to clinical domains;
• make sure the clinical risk management process is followed.

The standards do not name a required course, and DTAC version 2.0 dropped the earlier requirement for NHS England training. Training is still strongly recommended, and NHS England runs the best-known programme:

Source: NHS England clinical risk management training page, last edited 5 October 2026.

In-house CSO or outsourced?

The CSO can be provided through an outsourced arrangement, which is common for startups without a clinician on staff. Either way, the CSO needs real authority: they approve the plan, every hazard log version and the safety case report, and should be able to stop a release.

• In-house clinician: best when clinical input shapes the product every week.
• Outsourced CSO: sensible early on or for lower-risk products. Agree the time commitment, how they join sprint reviews and turnaround for sign-offs.
• Cost: there is no public price list for outsourced CSO services; get quotes, and compare what is included (plan, hazard workshops, safety case, release sign-offs).

At Magora the CSO sits with the client or a specialist they appoint. We are not a clinical safety provider; our role is to build the product so the hazard log and safety case have the engineering evidence they need.

Fitting DCB0129 into agile development

NHS England publishes guidance on applying the standard in agile delivery. In practice it comes down to treating clinical safety as part of the definition of done:

1. Write the intended purpose and the risk management plan in Discovery.
2. Run a hazard workshop on the first backlog with the CSO, product owner and lead engineer.
3. Link hazards to stories and tests, so every control has a test that proves it.
4. Review the hazard log at the end of each sprint; new features get assessed when they are built, not reconstructed at the end.
5. Produce the safety case report per release, with residual risks and hazards transferred to the deploying organisation spelled out.
6. After launch, log incidents and re-assess. The file stays live for the life of the product.

What changed in 2025-26, and what is coming

• Legal powers. NHS England says section 250 of the Health and Social Care Act 2012 was amended: from 7 July 2025 bodies must comply with information standards rather than have regard to them, and from 5 February 2026 IT providers can be made subject to a duty of compliance. NHS England adds that, as the standards stand, bodies must continue to have regard to them, but future revisions are likely to use the new powers.
• A national review. NHS England announced a review of DCB0129 and DCB0160 in December 2024, ran focus groups in 2025 and opened a public consultation in summer 2026. Topics include a risk-based tiered approach, AI, agile delivery, post-implementation monitoring and cyber security.
• No new version yet. As of 2 November 2026, DCB0129 v4.2 and DCB0160 v3.2 remain current. NHS England says DTAC will be updated when the review concludes.

For a supplier, the practical message is that clinical safety is moving from a buyer's checklist item towards a direct duty. Building the discipline in now costs less than retrofitting it.

What does DCB0129 compliance cost?

The standard itself is free to use. The costs are the CSO's time, training, and the product team's time on hazard analysis, testing and documentation. That team time is far lower when the work runs alongside development. For what we charge to build regulated health software, see how much healthcare software costs in the UK: regulated, integration-heavy platforms typically cost £80,000–£120,000 over 5–8 months, and a first release starts from £10,000.

For the other NHS requirements, see our guides to DTAC and the DSPT, and the overview NHS software compliance: DTAC, DCB0129 and DSPT.

Building software used in patient care? Send us a brief: we will build a free working prototype of the core journey in 5–10 working days, and run Discovery with your CSO so the hazard log starts with the backlog. More about our healthcare software development.

Frequently asked questions

What is DCB0129?

DCB0129 is the NHS clinical risk management standard for manufacturers of health IT systems. It requires a clinical risk management system, a named Clinical Safety Officer, a clinical risk management plan, a hazard log and a clinical safety case report, kept for the life of the product. The current version is 4.2.

What is the difference between DCB0129 and DCB0160?

DCB0129 applies to the manufacturer that builds the health IT system. DCB0160 applies to the health or care organisation that deploys and uses it. The deploying organisation relies on the manufacturer's DCB0129 documents to do its own clinical risk work.

Who can be a Clinical Safety Officer?

A suitably qualified and experienced clinician who holds a current registration with an appropriate professional body, is knowledgeable in risk management and its application to clinical domains, and can make sure the process is followed. The standard does not require a particular course.

Can a Clinical Safety Officer be outsourced?

Yes. NHS England's DTAC form allows the CSO to be provided through an outsourced arrangement, as long as the person meets the requirements and has enough responsibility to ensure the standard is followed.

How much does Clinical Safety Officer training cost?

NHS England's clinical safety training for non-NHS organisations costs £35 plus VAT for Essentials e-learning, £50 plus VAT for Intermediate e-learning, and £625 for the one-day Practitioner course for commercial organisations (£475 for NHS).

Is DCB0129 mandatory?

DCB0129 and DCB0160 are information standards published under section 250 of the Health and Social Care Act 2012, and NHS buyers ask for DCB0129 evidence in section C1 of DTAC. NHS England is reviewing both standards; new powers in force since 2025 and 2026 are likely to be used in future revisions.

Does DCB0129 apply to medical devices?

Yes. DCB0129 applies to all health IT systems, including those also regulated as medical devices. For devices, ISO 14971 risk management applies as well, and the two can share much of the same evidence.

Sources

• NHS England: DCB0129 clinical risk management, manufacture of health IT systems
• DCB0129 v4.2 specification (PDF)
• NHS England: clinical risk management standards
• NHS England: clinical safety documentation and templates
• NHS England: clinical risk management training
• NHS England: national review of DCB0129 and DCB0160, supporting information
• NHS England: conduct a DTAC assessment