Thalix Health
Book a demo

Clinical safety and assurance

DCB0129 and DCB0160 clinical safety standards explained

Short answer

DCB0129 and DCB0160 are the NHS's clinical risk management standards for health IT. DCB0129 applies to the manufacturer that builds and maintains a system; DCB0160 applies to the health organisation that deploys, uses, maintains or decommissions it. Both are information standards under section 250 of the Health and Social Care Act 2012, and NHS England says compliance is mandatory under that Act.

Sources checked October 2026 · General information, not legal, regulatory or clinical safety advice

Two standards, two sides of the same system

DCB0129 (Clinical Risk Management: its Application in the Manufacture of Health IT Systems) sets clinical risk management requirements for the organisations responsible for developing and maintaining health IT systems. DCB0160 (… in the Deployment and Use of Health IT Systems) requires a health organisation to set up a framework in which the clinical risks of deploying a new or changed system are properly managed.

They are linked on purpose. Requirement 2.5.1 of DCB0160 says that when a health organisation procures a health IT system it must ensure the manufacturer and the system comply with DCB0129, and the manufacturer makes its clinical safety case reports available to help the organisation do its own risk analysis.

What both standards ask for

  • Top management provides resources, assigns competent people and nominates a clinical safety officer.
  • A clinical risk management plan at the start of the project, including risk acceptability criteria, approved by the clinical safety officer.
  • A hazard log, with each version approved by the clinical safety officer.
  • A clinical safety case and clinical safety case reports, each report approved by the clinical safety officer. Under DCB0160 there's a report for each lifecycle phase: deployment, use, maintenance and decommissioning.
  • A clinical risk management file holding all of it, and a safety incident management log.
  • Assessment of any third-party products included in or used with the system, and regular review of the process itself.

Versions, status and the current review

The current releases are DCB0129 Amd 24/2018 (specification v4.2) and DCB0160 Amd 25/2018 (specification v3.2), both released on 7 June 2018. The 2018 update extended both standards to functionality classified as a medical device where it is implemented in a health IT system; they don't apply to software incorporated in a physical medical device, such as dose calculations inside an infusion pump. NHS England has started a review of DCB0129 and DCB0160, and its DTAC guidance says any changes will be reflected in future DTAC updates.

Do they apply to you?

NHS England's applicability guide walks through it step by step. The legal duty applies to publicly funded health or adult social care in England, which includes privately funded products later deployed in a publicly commissioned service, for products used in the direct care of patients. Wellbeing and lifestyle products are out of scope, and so are population-level services. Even where the legal duty doesn't apply, NHS England strongly recommends adopting both standards and suggests deployment organisations require them in contracts. It also recommends that manufacturers and deployers consider DTAC.

What it does not mean

  • They aren't certificates. They're standards an organisation applies and evidences, through its own plan, hazard log and safety case reports.
  • A supplier's DCB0129 work doesn't cover the hospital. The deploying organisation still owes its own DCB0160 work for its own setting.
  • They don't replace medical device regulation. NHS England says the standards never supersede the regulatory requirements for medical devices.

Where Thalix fits

Thalix is built so that this process has somewhere to live. New agents, workflows, boards and tools ship as versioned apps with a risk tier worked out from their contents (0 views, 1 operational, 2 clinical information, 3 clinical decisions), with the reason shown. Nobody approves their own app; tier 2 also needs the clinical-safety role, which is the clinical safety officer's recorded and audited sign-off. Tier-3 apps exist only as Ed25519-signed, locked packages from a trusted publisher, and a failed upgrade puts the previous version back.

Thalix's security notes say plainly that a hospital deployment needs a clinical safety case (for example DCB0129/DCB0160 in England), information governance approval and penetration testing. A pilot with us includes your clinical safety officer from day one; we don't claim a completed safety case for any hospital today.

Thalix is at pilot stage. Demos run on synthetic data, and a hospital deployment needs its own clinical safety case, information governance approval and security review. We don't claim any certification or assessment result the product doesn't have.

Questions people ask

What is the difference between DCB0129 and DCB0160?

DCB0129 applies to the manufacturer that develops and maintains a health IT system. DCB0160 applies to the health organisation that deploys, uses, maintains or decommissions it. A system in use in the NHS usually needs both.

Are DCB0129 and DCB0160 mandatory?

NHS England says compliance is mandatory under the Health and Social Care Act 2012 for health IT within their scope; its applicability guide explains the scope. Outside that scope they are still strongly recommended.

Is NHS England changing DCB0129 and DCB0160?

NHS England has started a review of both standards. The current releases are the 2018 updates, Amd 24/2018 and Amd 25/2018.

Sources

Each source below is an official page, read and checked in October 2026. Where a page and this guide differ, the official page wins.

General information only, written for hospital digital, IT, operations and clinical safety teams. It isn't legal, regulatory, information governance or clinical safety advice, and it doesn't replace your own organisation's processes or the official guidance linked above.

Clinical safety and assuranceWhat does a clinical safety officer do?Under DCB0129 and DCB0160 a clinical safety officer is a registered clinician who approves the risk plan, hazard log and safety case reports. Clinical safety and assuranceHazard log and clinical safety case report: what goes in them?The DCB0129 and DCB0160 definitions of hazard, clinical risk, hazard log and safety case report, what each document is for, and example hazards for AI software. Clinical safety and assuranceThe DTAC (Digital Technology Assessment Criteria) explainedDTAC is how NHS and social care buyers assess digital health products across five areas. What's in scope, the 2026 form, who assesses what, and what DTAC isn't. Clinical safety and assuranceIs AI software a medical device in the UK?Whether hospital AI software is a medical device depends on its intended purpose. How the MHRA's guidance draws the line, and what it means for buyers.

All guides

Thalix Health

See Thalix on a demo hospital.

A conversation with us is 45 minutes and free: the work you want to hand to agents, the systems involved, and where Thalix would and wouldn't fit. Demos run on synthetic patients.

Book a demo or email hello@thalixhealth.com