Clinical safety for the AI you deploy
If your practice, clinic or trust uses an AI scribe, NHS England's guidance asks you to keep your own clinical safety case for it under DCB0160, separate from the supplier's case under DCB0129. DCB0160 is also the deploying organisation's standard for an AI agent used in NHS care. We help you write your case, check what the supplier gives you, and keep it current once the tool is in use.
It is for NHS trusts and GP practices, and for private healthcare: dental groups, private clinics and hospital groups. If you deliver no NHS-funded care, you can still follow the same standard; whether it is a legal duty for you is a question for your legal advisers. Your accountable officer and your Clinical Safety Officer make the decisions; we do the groundwork with them.
Last updated
Is an AI scribe a medical device?
It depends on what the product is intended to do. The MHRA's guidance of July 2026 turns on two questions: does a clinician review what the AI produces, and does the product go beyond paperwork into diagnosis or treatment?
-
Not a medical device
A scribe that only transcribes the consultation, summarises it, drafts letters or suggests clinical codes, all for a clinician to check before any of it is used.
-
A medical device
A product intended to support diagnosis, treatment or prevention, or one that takes clinical action without a clinician's review, such as placing an order by itself.
The supplier's stated intended purpose decides which side a product falls on, so we read it closely, and again whenever the supplier adds a feature. The MHRA's guidance is written for scribes. For an AI agent the same question of intended purpose applies: booking appointments and taking messages is administration, while judging how urgent a patient's request is goes further, and its status needs checking.
What does a deploying organisation need?
NHS England's guidance for AI scribes names four things: the organisation's own safety case and hazard log under DCB0160, a data protection impact assessment, evidence from the supplier, and a plan for monitoring the tool once staff use it.
- A safety case and hazard log under DCB0160
- The hazards of using this tool in your setting, the control for each one, and who is responsible for it, signed off by your Clinical Safety Officer.
- A data protection impact assessment
- NHS England says a DPIA is highly likely to be a legal requirement for ambient scribing, and its guidance on ambient scribing products includes a template.
- Evidence from the supplier
- Its DCB0129 safety case, its assessment against version 2 of the Digital Technology Assessment Criteria (DTAC), its Data Security and Protection Toolkit (DSPT) status, and its medical device status for the product's intended purpose.
- Monitoring after go-live
- How you will spot problems once clinicians use the tool, how staff report them, and when you review the safety case because the product or your use of it has changed.
The registry is self-certification, not NHS approval. NHS England Digital keeps a registry of ambient voice technology suppliers that have self-certified against NHS England's criteria. A listing is the supplier's own declaration, and your own checks still apply.
For GP services, the Care Quality Commission's guidance on AI looks for the same groundwork: evidence that you checked the tool and assessed its risks before you relied on it.
What we do
Five pieces of work, in order, from choosing a supplier to running the tool. You can start at any of them.
-
Review the supplier's evidence
We read the supplier's DCB0129 safety case, DTAC assessment, DSPT status and medical device position, and list the gaps and questions to put to them before you commit.
-
Write your safety case and hazard log with you
Hazard workshops with your clinicians and staff, then a DCB0160 safety case and hazard log drafted for your own services, workflows and systems.
-
Support your DPIA
We work through NHS England's template with your data protection officer or information governance lead: what is recorded, where it is processed, how long it is kept and who can see it.
-
Go-live checks
Before clinicians use the tool with patients, we check that the controls in the hazard log are in place, staff know how to review a draft and report a problem, and there is a fallback if the tool is unavailable.
-
Monitoring and a safety review of every change
We review incidents and feedback with you, assess the safety impact of each supplier update or change in how you use the tool, and update the safety case and hazard log to match.
Who decides
Your accountable officer and your own Clinical Safety Officer sign off the safety case and decide whether the tool goes live. Clinicians review and approve every note, letter and code the AI drafts before it enters the record. With an AI agent, anything clinical goes to a member of your staff, who also confirms any action that changes the patient record. We prepare the evidence; the decisions stay with you.
Who does the work
Our Clinical Safety Officer leads each safety case, and our engineers work alongside, because many hazards sit in the technology: where recordings go, how the model is updated, and what the tool connects to.
Read our clinical safety approach- Clinical safety, led by our Clinical Safety Officer, with the hazard workshops run alongside your clinicians.
- Engineering review of the supplier's technical evidence: data flows, hosting, integrations and how changes are released.
- The same method on our own product. Prime Assist has a clinical safety case under DCB0129, signed off by our Clinical Safety Officer.
- Your advisers stay involved. We work alongside your data protection officer and legal advisers rather than giving legal advice.
Are DCB0129 and DCB0160 changing?
Both are under review. NHS England consulted on revising them from 29 June to 11 September 2026, with a response to follow. The current versions stay in force while the review runs.
The consultation asked about cyber security requirements and whether the standards should apply to medical devices, so safety cases written now may need updating when the new versions arrive. We write them so they can be updated, and review yours against the new versions when NHS England publishes them.
Separately, the National Commission into the Regulation of AI in Healthcare recommended in September 2026 that AI in healthcare be monitored continuously once it is in use. That is advice to government, not law, but it points the same way as the monitoring above.
- Source: NHS England: national review of DCB0129 and DCB0160, supporting information
- Source: MHRA: National Commission into the Regulation of AI in Healthcare
The rules and dates on this page are as found on , from the sources linked. Guidance in this area is changing, so we check each one again at the start of every safety case.
Questions people ask
Does the supplier's DCB0129 safety case cover us?
No. The supplier's case covers how the product was made. DCB0160 asks the deploying organisation to assess the risks of using it in your own services, with your staff, patients and systems, and to keep that record up to date.
Is a supplier on NHS England's AVT registry approved by the NHS?
No. Suppliers on the registry have self-certified against NHS England's criteria. Being listed is the supplier's own declaration, so you still check its evidence and keep your own safety case.
We have not named a Clinical Safety Officer. What should we do?
DCB0160 asks the deploying organisation to name one: a registered clinician trained in clinical risk management, who signs off your safety case. If you have not named yours yet, we go through the options with you before the safety case starts.
Does this cover AI agents as well as scribes?
Yes. The same DCB0160 work applies to an AI agent that answers calls, books appointments or reads incoming letters. The safety case names the actions a member of your staff must confirm before the agent can take them.
Do you give legal advice on data protection?
No. We help you complete the DPIA and describe how the tool handles data, and we work alongside your data protection officer and legal advisers, who advise you on the law.