Understanding DCB0129: Clinical Risk Management for AI in Healthcare

If you're developing or deploying health IT systems in the NHS, you'll need to comply with DCB0129. But what exactly is it, and how does it apply to modern AI systems? This guide cuts through the jargon to explain what you need to know.

What is DCB0129?

DCB0129 is an information standard published by NHS England that mandates clinical risk management for health IT systems. Originally published in 2012 and updated in 2018, it requires manufacturers to implement a systematic approach to identifying and managing clinical risks associated with their products.

The standard applies to any IT system that could affect patient safety - which, in practice, means almost any system used in clinical settings. This includes electronic health records, clinical decision support systems, and increasingly, AI-powered tools like triage systems.

The Core Requirements

DCB0129 requires manufacturers to:

• Appoint a Clinical Safety Officer (CSO) - a suitably qualified clinician responsible for ensuring clinical safety throughout the product lifecycle
• Establish a Clinical Risk Management System - documented processes for identifying, evaluating, and controlling clinical risks
• Create a Hazard Log - a living document that tracks all identified hazards, their severity, and the controls in place
• Produce a Clinical Safety Case Report - evidence demonstrating that risks have been reduced to acceptable levels
• Maintain safety throughout deployment - ongoing monitoring and incident management processes

Why It Matters for AI

AI systems present unique challenges for clinical risk management. Unlike traditional software where behaviour is deterministic, AI systems can produce unexpected outputs and may change over time as models are updated. This makes rigorous safety assessment even more critical.

For AI triage systems like Medelic, key considerations include:

• Red flag detection - ensuring the system reliably identifies urgent clinical presentations that require immediate escalation
• Appropriate uncertainty handling - what happens when the AI is unsure? The system must fail safely
• Consistency and fairness - ensuring the system performs equally well across different patient demographics
• Human oversight - maintaining appropriate clinical supervision of AI-generated recommendations

"DCB0129 isn't just a compliance exercise - it's a framework that forces you to think systematically about what could go wrong and how to prevent it. For AI systems, this discipline is invaluable."

The Hazard Log in Practice

The hazard log is the heart of DCB0129 compliance. For each identified hazard, you must document:

• Description of the hazard and potential clinical harm
• Initial risk rating (severity × likelihood)
• Existing controls and their effectiveness
• Residual risk after controls
• Acceptability of residual risk
• Ongoing monitoring requirements

For Medelic, our hazard log includes over 150 identified hazards, ranging from "system fails to identify chest pain as potentially cardiac" to "patient provides misleading information that affects triage outcome." Each hazard has documented controls and is reviewed quarterly.

Integration with DCB0160

While DCB0129 governs manufacturers, its companion standard DCB0160 applies to healthcare organisations deploying health IT. Together, they create a complete safety framework. When a practice deploys Medelic, they need to ensure their own clinical governance processes accommodate the new system - something we actively support through our implementation programme.

Beyond Compliance

Meeting DCB0129 requirements should be seen as the baseline, not the ceiling, for clinical safety. At Medelic, we go further by:

• Running continuous safety monitoring with automated anomaly detection
• Maintaining a Clinical Advisory Board for independent oversight
• Publishing regular safety reports to our practice partners
• Conducting prospective clinical validation studies

Clinical safety isn't a box to tick - it's a culture to embed throughout an organisation. DCB0129 provides the framework; what matters is how seriously you take it.