AI Scribe Governance (NHS): DTAC, DCB0129/0160, MHRA — What Clinicians Need to Know: IMG guide for UK practice (2026)

Key points

In NHS settings, ambient scribing adoption typically expects DTAC-style due diligence plus digital clinical safety assurance.
DCB0129 applies to manufacturers; DCB0160 applies to adopting organisations — both matter to your governance story.
If a product is (or functions as) a medical device, MHRA/UKCA considerations may apply (supplier should evidence their position).

Most frontline problems are not ‘AI quality’ problems — they’re governance problems: unclear accountability, uncontrolled retention, weak access controls, and missing clinical safety documentation. The goal is not to slow adoption; it’s to avoid preventable risk that later triggers a shutdown.

Two standards you’ll hear repeatedly

Digital clinical safety in England commonly references DCB0129 (manufacturer responsibilities) and DCB0160 (adopter responsibilities). Even if you’re not writing the safety case, you should know what evidence to ask for.

Step 1 — Ask for DTAC evidence early

DTAC is used at procurement/due diligence to check baseline standards (e.g., security, clinical safety, interoperability, data protection). Don’t leave this until after a pilot is embedded.

Step 2 — Confirm clinical safety documentation

Request the supplier’s DCB0129 artefacts and your organisation’s plan for DCB0160 adoption (clinical safety officer involvement, hazard log approach, go-live controls).

Step 3 — Run a DPIA-quality data-flow review

Document: what data is captured, where processed, where stored, retention periods, who can access, and how deletion works. Ensure the ‘audio layer’ is not a blind spot.

Step 4 — Clarify medical device status

Ask the vendor how they classify the product and what regulatory evidence supports that. If it’s a medical device, make sure UK regulatory requirements for NHS use are addressed.

Step 5 — Define minimum safe operating controls

Examples: mandatory human review, audit logs, role-based access, ‘pause recording’ protocol, incident reporting pathway, and periodic sampling for quality checks.

SourceNHS England: DTAC (Digital Technology Assessment Criteria)

Open Link

SourceNHS England (Digital): Clinical risk management standards (DCB0129/DCB0160)

Open Link

SourceNHS England (Digital): DCB0129 standard page

Open Link

Official Sources

NHS England — DTAC

NHS England (Digital) — Clinical risk management standards (DCB0129/DCB0160)

NHS England (Digital) — DCB0129 standard page

Your learning path

Save your place and choose what comes next

Work through this guide (5 steps)

Use the actions from this article to track what you have worked through.

Step 1 — Ask for DTAC evidence early
DTAC is used at procurement/due diligence to check baseline standards (e.g., security, clinical safety, interoperability, data protection). Don’t leave this until after a pilot is embedded.
Return to this section
Step 2 — Confirm clinical safety documentation
Request the supplier’s DCB0129 artefacts and your organisation’s plan for DCB0160 adoption (clinical safety officer involvement, hazard log approach, go-live controls).
Return to this section
Step 3 — Run a DPIA-quality data-flow review
Document: what data is captured, where processed, where stored, retention periods, who can access, and how deletion works. Ensure the ‘audio layer’ is not a blind spot.
Return to this section
Step 4 — Clarify medical device status
Ask the vendor how they classify the product and what regulatory evidence supports that. If it’s a medical device, make sure UK regulatory requirements for NHS use are addressed.
Return to this section
Step 5 — Define minimum safe operating controls
Examples: mandatory human review, audit logs, role-based access, ‘pause recording’ protocol, incident reporting pathway, and periodic sampling for quality checks.
Return to this section

United Kingdom · Starting work · Article 8 of 28