DCB0129 covers the manufacture of health IT systems; DCB0160 covers their deployment and use in England. The NHS publishes the standards as complementary requirements. Manufacturer standard, deployment standard
A manufacturer’s safety case report informs the receiving organisation’s own risk analysis. The organisation also has to define its local environment and assess local customisations. This is why evidence handover and deployment assessment are separate responsibilities. DCB0160, sections 2.5, 4.2 and 7.1
How the responsibilities differ
The table compares four responsibility areas in DCB0129 version 4.2 and DCB0160 version 3.2. “Manufacturer” describes a role, which can include an organisation developing or adapting a system; it is not simply a synonym for an external vendor.
| Responsibility | DCB0129: manufacturer | DCB0160: deploying health organisation |
|---|---|---|
| System context | Defines the product’s clinical scope and intended use | Defines intended use, operational environment and users locally |
| Clinical safety leadership | Nominates a clinical safety officer and sets authorisation arrangements | Nominates a clinical safety officer; management authorises deployment and accepts residual clinical risk |
| Evidence | Maintains the product safety case, hazard log and reports | Maintains evidence for deployment, use, maintenance and decommissioning |
| Later changes | Applies risk management to product updates | Assesses local customisations and manages the deployed system’s lifecycle |
Sources: DCB0129, sections 2–4 and 7; DCB0160, sections 2–4 and 7.
Both specifications describe the clinical safety officer as a suitably qualified, experienced clinician with relevant professional registration and risk-management knowledge. That requirement concerns the people performing the standards’ safety functions. Clinical safety officer requirements, deployment-side requirements
Supplier evidence informs the local assessment
DCB0160’s procurement section calls for the manufacturer’s applicable safety case reports to inform the health organisation’s own risk analysis. The same specification requires the organisation to define the operational environment and users, then assess local customisations before deployment. These are distinct activities: obtaining a supplier report does not complete them. DCB0160, sections 2.5, 4.2 and 7.1
The documents have different jobs
DCB0129 distinguishes a clinical risk management plan, which describes the process, from a hazard log, which records identified hazards and their resolution. A clinical safety case report presents the argument and evidence for a system’s safety in a defined application, setting and lifecycle stage. It requires reports to be made available to the receiving organisation. Definitions and documentation requirements
These terms refer to different evidence records. A document’s title alone says little about which system configuration or setting it addresses.
Applicability depends on the product and its use
NHS applicability guidance considers public funding, the health or adult-social-care purpose in England, and whether a digital product influences direct care. It also distinguishes medical-device software implemented within a health IT system from other device arrangements. Development with private funds does not itself exclude a product subsequently deployed in publicly commissioned care. Applicability guidance
The guidance separates situations it describes as mandated from those where adoption is recommended. It does not support a universal rule based only on whether software appears in an NHS setting. This article reports that framework without determining an individual product’s obligations.
Responsibilities continue after deployment
Both specifications cover reported safety concerns after deployment and their implications for the safety case. Manufacturer updates and a health organisation’s local changes remain within their respective lifecycle responsibilities. The documentation describes an ongoing process, extending beyond an initial handover. Manufacturer monitoring and modification, deployment lifecycle
A review is not a replacement standard
On 9 October 2026, the NHS current-release records still listed the 7 June 2018 releases. The national review’s consultation page records closure on 11 September 2026. Those observations establish the documents and consultation status checked here; they do not establish that revised standards have taken effect. DCB0129 release, DCB0160 release, consultation record
Our UK healthcare AI policy reporting separately follows announced regulatory changes and their implementation.