Two different regimes, two different questions. Here is when your product needs MHRA medical device registration, an NHS clinical safety case, or both.
By Dr Chiho Song · NHS clinician and contracted Clinical Safety Officer · 15 June 2026 · 6 min read
One of the most common questions I get from founders is some version of: "We are getting CE or UKCA marked as a medical device, so we do not also need DCB 0129, right?" Or the reverse: "We are doing DCB 0129, so we do not need to worry about the MHRA." Both assumptions are wrong, and getting them wrong is expensive. These are two separate regimes that answer two separate questions, and plenty of products need both.
Hold these apart in your head and most of the confusion disappears.
A product can be a medical device but not used in the NHS. It can be used in the NHS but not be a medical device. It can be both. The two questions do not collapse into one another.
In the UK, medical devices are regulated by the MHRA under the Medical Devices Regulations 2002. Software counts as a medical device, often called Software as a Medical Device or SaMD, when it has a medical purpose for an individual: diagnosis, prevention, monitoring, prediction, prognosis, or treatment. A symptom checker that suggests a likely condition is probably a device. A tool that simply stores and displays a record, without interpreting it, usually is not.
If your software is a device, you have to classify it (the risk-based class drives how much scrutiny applies), demonstrate conformity, apply UKCA marking (CE marking is accepted during the current transition), and register with the MHRA. Higher-risk classes need involvement from an approved body. This regime is about the device being fit and conformant.
DCB 0129 is an NHS information standard, mandatory under the Health and Social Care Act 2012 for health IT used in NHS care. It does not ask whether your product is a conformant device. It asks whether, in the specific way it is used in a clinical setting, it could contribute to a patient being harmed, and it makes you prove you have analysed and controlled those hazards with a named Clinical Safety Officer signing it off. If you want the full picture, read DCB 0129 explained in plain English.
Crucially, being a marked medical device does not satisfy DCB 0129. A device can be perfectly conformant and still be deployed in a way that creates clinical hazards, for example by surfacing a result at the wrong moment in a workflow. DCB 0129 exists to catch exactly that.
Here is the practical decision.
If you sell clinical AI into NHS trusts, assume you are in the first row until a regulatory assessment tells you otherwise.
They cover different failure modes. Device regulation asks: is this thing built and validated to be what it claims to be? Clinical safety asks: deployed into this messy human workflow, could it still hurt someone, and have you designed that risk down? A product can pass one and fail the other. That is why NHS buyers, through DTAC, ask for both your device status and your clinical safety case. For how all of this gets packaged at procurement, see DTAC explained in plain English.
We are pre-revenue, can we defer this? You can defer registration, but not the thinking. Classification and hazard analysis should shape the design. Deferring them just means reworking the product later under a deadline.
Does CE marking still count in the UK? CE marking is accepted during the current transition period; UKCA is the UK route. Confirm the current position for your class before relying on it, as timelines have shifted more than once.
Who decides if we are a medical device? Classification is your responsibility as the manufacturer, against MHRA guidance. Get it confirmed rather than assumed, because the answer changes your whole obligations stack.
I help digital health teams untangle exactly this, then handle the NHS clinical safety side end to end as a contracted Clinical Safety Officer. Fixed scope, fixed fee.