If you’re building a digital health product for the NHS, Standard 1 of the NICE Evidence Standards Framework is the one that decides whether you ever get to talk about clinical outcomes. It’s also the one most founders treat as paperwork — a documentation exercise to be sorted out before a tender. That misreading is expensive.
Here’s the argument this post makes: Standard 1 isn’t a compliance layer. It’s the moment your product stops being ‘an app’ and becomes regulated NHS infrastructure. The companies that build safety and quality discipline into their organisation early gain a compounding advantage. The ones that defer it discover, late, that NHS procurement is no longer a slide deck competition — and that retrofitting a Clinical Safety Case onto an existing product roadmap is the kind of project that breaks startups.
What Standard 1 Actually Requires
Standard 1 sits in the Design Factors group of the framework — Standards 1 to 9 — and applies across all tiers, from a Tier A workflow tool to a Tier C diagnostic AI. The wording is deliberately broad: a DHT must comply with all relevant safety and quality standards applicable to its tier, function, and regulatory classification. NICE doesn’t prescribe a single standard, because the right standards depend entirely on what your product does and who is exposed to it.
In practice, for any DHT operating in the NHS ecosystem, four pillars dominate. Clinical risk management is governed by DCB0129, the NHS England standard that requires every manufacturer of health software used in NHS-funded care to maintain a documented Clinical Risk Management System, a Hazard Log, and a Clinical Safety Case Report signed off by a qualified Clinical Safety Officer. This is information standard issued under section 250 of the Health and Social Care Act 2012 — it has statutory force, not just guidance status.
Data security sits with the NHS Data Security and Protection Toolkit (DSPT), which any organisation handling NHS patient data must complete annually. Software lifecycle and quality is anchored in IEC 82304-1 for health software, BS EN 62304 for medical device software, and ISO 13485 for the underlying quality management system. And every DHT entering NHS procurement is now assessed against the Digital Technology Assessment Criteria (DTAC), which bundles clinical safety, data protection, technical security, interoperability and usability into a single buyer-side checklist.
The table below shows how these obligations land across the three DHT tiers — and where the line shifts from ‘best practice’ to ‘mandatory’.
The Reason This Standard Got Sharper Teeth
Standard 1 didn’t acquire its current weight by accident. It hardened in response to a series of safety and security incidents that demonstrated, expensively, what happens when health software is treated like consumer software.
The most consequential was WannaCry in May 2017. The ransomware attack disrupted services at at least 80 of the 236 NHS trusts in England, along with hundreds of GP practices, leading to thousands of cancelled appointments and operations. The National Audit Office’s investigation found the NHS had been warned about the vulnerability and had not patched. The Department of Health and Social Care later estimated the financial impact at around £92 million, but the deeper cost was reputational: the public watched the NHS take days to recover from a security incident that should have been a non-event. The political response was a step-change in cyber and clinical safety expectations for any technology entering the NHS estate.
The pattern keeps repeating. The June 2024 cyber attack on Synnovis, the pathology supplier to King’s College Hospital and Guy’s and St Thomas’, forced major London trusts to postpone over 1,500 acute outpatient appointments and elective procedures in a single week — and the disruption stretched on for months. Suppliers have moved from being treated as IT vendors to being treated as critical national infrastructure. That is the regulatory weather Standard 1 is now operating in.
The intent behind the standard isn’t bureaucratic gatekeeping. It reflects a real asymmetry: a software defect in a triage tool or a remote monitoring algorithm can affect thousands of patients simultaneously, before anyone notices a pattern. NHS England designed Standard 1, DCB0129, and DTAC to make sure that before a DHT enters the NHS ecosystem, the manufacturer has thought systematically about how things could go wrong and has built processes to prevent them. It’s the NHS’s handshake. Prove you’ve taken safety seriously, and we’ll talk about everything else.
Where Founders Get This Wrong
Five mistakes show up repeatedly in evaluations and procurement reviews. They are correctable in early-stage companies, and brutally expensive to correct in late-stage ones.
- Starting compliance late. A surprising number of companies first engage with DCB0129 when they’re already deep in a procurement conversation. By that point, you don’t have a Clinical Safety Case Report — you have a rushed document that experienced NHS evaluators can spot immediately. A credible CSCR tells a story across the product lifecycle: hazards identified during design, mitigations engineered into the build, residual risk assessed against clinical benefit. Trying to assemble that retrospectively, in six weeks, against a tender deadline, produces something that reads exactly like what it is.
- Confusing MHRA classification with NICE compliance. Some teams assume that because their product isn’t a regulated medical device under the MHRA, safety standards don’t apply. This is a category error. Standard 1 covers all DHTs — including Tier A workflow tools — and DTAC covers every supplier to the NHS regardless of regulatory status. ‘We’re not a medical device’ is not a compliance argument; it’s a statement about which specific standards apply most heavily. Cyber, data, clinical safety governance and quality management still do.
- Under-resourced quality management. ISO 13485 is not a one-off audit pass. It requires document control, internal audits, corrective and preventive action processes, and management reviews running on a defined cadence. Many startups achieve certification, then quietly let the QMS atrophy as the engineering team moves fast. This shows up in due diligence and in surveillance audits — and increasingly in NHS commercial reviews, where buyers ask to see post-market surveillance reports as evidence the QMS is alive.
- Ignoring the deployment side. DCB0160 is the companion to DCB0129 — it covers clinical safety obligations on the deploying organisation (the trust or commissioner implementing your product). Manufacturers who don’t understand DCB0160 routinely create friction at the point of deployment because they haven’t produced the artefacts their NHS customer needs to complete its own safety case. A well-prepared supplier hands the trust a deployment safety pack on day one. A poorly prepared supplier waits to be asked, then scrambles for three months.
- Treating cyber as an IT problem. NHS cyber security under DTAC and DSPT covers governance, incident response, supplier assurance, and staff training — not just technical controls. The Synnovis incident was not a failure of firewalls; it was a failure of the broader supplier security posture. Commissioners now expect to see incident response plans, breach notification procedures, and evidence of tabletop exercises. Treating this as a CTO checkbox is the fastest way to fail a procurement on a non-clinical issue.
What Good Looks Like
The strongest Standard 1 submissions look organisationally different from the weak ones, not just better-documented. The difference is visible across the product lifecycle.
A Clinical Safety Officer — ideally a registered clinician — is appointed early and is involved in product decisions, not just sign-off. The Hazard Log isn’t a static document from 18 months ago; it’s reviewed at every product release, with new hazards logged, mitigations re-evaluated, and the residual risk position re-stated. The Clinical Safety Case Report reads as a coherent narrative: this is what the product does, here are the ways it could harm a patient, here is the engineering and process evidence that we’ve reduced those risks to an acceptable level. Evaluators can tell within five minutes whether they are reading a real CSCR or a procurement deliverable.
On the QMS side, certification from a UKAS-accredited body is the floor, not the ceiling. What matters more is whether the organisation behaves like one that takes quality seriously: visible post-market surveillance, a complaints log that actually gets reviewed, change-control discipline on the codebase, and a CAPA process that closes the loop on incidents rather than archiving them.
For Tier C and AI-enabled products, this connects directly to Standard 4 (bias mitigation) and Standard 16 (post-market performance monitoring). The best companies treat these as a single governance system rather than three separate workstreams. Algorithmic safety — version-controlled training data, subgroup performance testing, drift monitoring, defined escalation thresholds — sits inside the same Hazard Log and CSCR that governs the rest of the product. The figure below shows how this lifecycle integration looks when it’s working.
The Strategic Angle
There’s a competitive dynamic here that founders consistently undervalue. As NHS procurement matures — through DTAC, the Transformation Directorate’s supplier assurance work, and increasingly sophisticated buying teams — the baseline for safety and quality compliance is rising every year. Companies that built their governance early have a compounding advantage: they’ve lived with it long enough that it’s embedded in how they ship product, not performed for an audit.
The companies that struggle most are typically those that scaled user acquisition before scaling governance. They built a user base on direct-to-consumer or private-sector channels where these standards don’t apply, and then discovered that entering the NHS requires a near-complete rebuild of their internal processes — clinical safety, QMS, post-market surveillance, supplier assurance. That is an expensive and slow problem to fix when you are trying to close your first NHS contract on a runway timeline.
The signal extends past procurement. For investors doing health tech due diligence, DTAC compliance and a credible Clinical Safety Case are increasingly used as proxies for operational maturity. They are not the primary valuation driver, but the absence of them introduces risk into the investment thesis — particularly for any company pitching an NHS-anchored go-to-market. The cleanest decks I’ve seen have a one-page summary of their Standard 1 posture in the appendix. The messiest don’t know the question is coming.
Conclusion
Standard 1 is the foundation standard for a reason. The other twenty standards in the framework — bias mitigation, real-world evidence, cost-effectiveness, post-market monitoring — assume that the basic question of ‘is this product safely built and competently operated?’ has already been answered. If it hasn’t, none of the rest matters.
If you’re building a DHT for the NHS, the practical move is to stop thinking of Standard 1 as a documentation phase and start thinking of it as an operating model. Appoint your Clinical Safety Officer in year one, not year three. Stand up a real QMS before you scale your engineering team. Build the Hazard Log into your release process, not your procurement process. The companies that do this don’t win deals because their compliance is better. They win because compliance was never the bottleneck.
If you’d like a second pair of eyes on your DCB0129 posture or your DTAC readiness, get in touch — it’s the kind of conversation that’s better had eighteen months before a tender than three weeks before one.
