4 November 2026, 07:54 PM
DCB0129 and DCB0160 are two standards for NHS clinical risk management in health IT. They ask organisations to appoint a Clinical Safety Officer, look at how their software could harm patients, put controls in place, and keep a written record of the risks and what was done about them. DCB 0129 applies to manufacturers. DCB 0160 applies to the organisations that deploy and use the software.
Not every NHS organisation can produce that documentation for every tool it uses. More than 10,000 digital tools used in patient care have no documented clinical safety assurance. A 2025 study covering 14,747 deployments across 178 NHS organisations found that 17.3% of deployments with reported assurance data were fully assured against both standards. In a separate subset of 8,536 deployments, 70.1% had no documented clinical safety assurance.
The standards were introduced in 2009 and last updated in 2018. The current versions are DCB0129 v4.2 and DCB0160 v3.2. NHS England opened a public consultation on 29 June 2026 and closed it on 11 September 2026. The review is looking at whether the standards still fit a world of AI, complex interconnected systems, and modern development practices. The response report is still pending, so the rules you follow today may be revised. If you are a manufacturer, a revised standard could change what you submit for procurement. If you are writing a deployment safety case in a trust, it could change what that case needs to cover. Either way, the version you work to now may not be the version you work to next year.
By the end of this blog, you will know the difference between DCB0129 and DCB0160 in practice. You will also see who each standard applies to, what it asks of you, and how the two fit together.
Source: https://qualysec.com/difference-between-dcb0129-and-dcb0160/
Not every NHS organisation can produce that documentation for every tool it uses. More than 10,000 digital tools used in patient care have no documented clinical safety assurance. A 2025 study covering 14,747 deployments across 178 NHS organisations found that 17.3% of deployments with reported assurance data were fully assured against both standards. In a separate subset of 8,536 deployments, 70.1% had no documented clinical safety assurance.
The standards were introduced in 2009 and last updated in 2018. The current versions are DCB0129 v4.2 and DCB0160 v3.2. NHS England opened a public consultation on 29 June 2026 and closed it on 11 September 2026. The review is looking at whether the standards still fit a world of AI, complex interconnected systems, and modern development practices. The response report is still pending, so the rules you follow today may be revised. If you are a manufacturer, a revised standard could change what you submit for procurement. If you are writing a deployment safety case in a trust, it could change what that case needs to cover. Either way, the version you work to now may not be the version you work to next year.
By the end of this blog, you will know the difference between DCB0129 and DCB0160 in practice. You will also see who each standard applies to, what it asks of you, and how the two fit together.
Source: https://qualysec.com/difference-between-dcb0129-and-dcb0160/