The Clinical Safety Officer has gone from a footnote in an NHS standard to one of the most senior roles in digital health: a registered clinician, personally accountable for whether software is safe to put in front of patients. The CSO Standard tracks the regulation, the craft and the market.
Three things define the role, and explain why organisations cannot simply hand it to a manager.
DCB0129 and DCB0160 are issued under Section 250 of the Health and Social Care Act 2012. Both require a named Clinical Safety Officer: one for manufacturers of health IT, one for the organisations that deploy it.
NHS England defines the CSO as a clinician with a current professional registration, trained in clinical risk management and accountable for clinical safety. It cannot be delegated to IT or operations staff.
The CSO owns the clinical risk management system, signs the Clinical Safety Case Report and chairs the hazard log, with explicit authority to pause or stop a deployment when safety demands it.
If your organisation deploys software in a care setting (an EPR, a triage tool, an ambient AI scribe), DCB0160 applies to you. Not to your supplier. To you. The manufacturer's safety file covers the product; your organisation must assess the risk of using it in your context, with your patients and your pathways.
That duty sits with a named, registered clinician. NHS procurement asks for the evidence through DTAC. CQC expects a trained CSO in GP and independent settings. And since the Data (Use and Access) Act 2025, enforcement reaches private providers and suppliers directly, not just NHS bodies.
The good news: the role does not have to mean a new headcount. Many specialist providers embed CSO accountability in an existing senior clinician, typically the fastest, cheapest and most clinically credible route to compliance.
Where the requirement comes from, who is allowed to hold the pen, what the CSO actually owns, and why 2025's legislation ended the "NHS-only" era for private providers.
Read the guide →Standalone salaries and consultancy day rates, benchmarked from live listings and published rate cards, with a model for the embedded dual-role clinician.
Read the analysis →AI documentation tools are registered medical devices with real failure modes: omission, hallucination, substitution. Deploying one safely is the CSO's job.
Read the analysis →"If your digital technology cannot meet standard DCB0129, you will not be able to place it on the market."NHS England, guidance on clinical risk management standards