Method
How a Novatib safety case is made.
Five steps in a workspace built for them. The instrument we use inside it proposes; it never scores a risk, never disposes of a hazard, and never signs. A clinician does each of those, and the record shows who and when.
From your documentation we produce a structured description of the product: what it does, for whom, in which workflow, with which data and integrations, and any AI component with its model documentation. You confirm it before anything else happens.
For each function, hazards are proposed through three lenses: a library of hazards seen in comparable systems, seeded from NHS England’s own generic hazard log; a fixed set of questions about what happens when information is wrong, missing, late, attributed to the wrong patient, unavailable, misread, or acted on without the check the workflow assumes; and, for AI features, the hazards particular to them, hallucination, drift, bias, explainability, automation bias and data provenance. Every proposal cites the passage of your documentation it came from.
Proposals are generated twice by independent means, and disagreements are shown, not hidden.
A clinician accepts, amends or rejects every proposal, sets severity and likelihood, and states the controls, with their name and the time against each line.
The safety case report is generated from the disposed log on NHS England’s template, reviewed by the officer, and signed. Every later change is a recorded difference, and release reviews are triggered by what changed, not by a model’s opinion.
Confidentiality
Your documentation is never used to train anything. It is processed in the United Kingdom, under terms that exclude its use for model training, and deleted ninety days after an enquiry that does not become an engagement. The results of our own validation of the method are published as they accrue.
What the standards require
DCB0129 applies to the manufacturer of a health IT system and DCB0160 to the organisation that deploys it. Both are mandated under section 250 of the Health and Social Care Act 2012, and both require a Clinical Safety Officer who is a registered clinician trained in clinical risk management, a hazard log, and a clinical safety case report signed by that officer. Deploying organisations can ask a supplier for its DCB0129 documentation and should be given it. The standards are under national review, with artificial intelligence within scope.