DTAC: a clear guide to the NHS digital technology assessment in 2026

DTAC, the Digital Technology Assessment Criteria, is the baseline check that NHS and social care buyers in England apply before they buy or deploy a digital health product. For a supplier, a missing or out-of-date DTAC form can hold up a sale. For a trust or integrated care board, a thin review can leave clinical safety, data protection and cyber security risks unexamined. This guide explains what the criteria cover, who must complete them, how they connect to other NHS assurance processes, and what changed when NHS England refreshed the form in February 2026.

What DTAC is and who runs it

NHS England describes DTAC as an assessment framework for care commissioners and providers to use when they assure digital health technology (DHT) products. It brings together the standards and policies a product must meet, so that different buyers check the same things in the same way. The official DTAC page on the NHS Transformation Directorate site sets out the scope, the five assessment areas, the roles involved and the move to the current form.

The criteria were first published by NHSX. The trade publication HTN reported on 24 February 2021 that NHSX had formally launched DTAC, which it had launched in beta in October 2020, and the NHSX announcement said the first version reflected feedback from over 800 stakeholders. A Transformation Directorate blog said the criteria were intended to consolidate and replace existing baseline assessments such as the Digital Assessment Questionnaire (DAQ), rather than add a new one.

At launch, NHSX said tools would receive a pass or fail in four categories, clinical safety, data protection, technical security and interoperability, and a score on usability and accessibility. It described DTAC as a rapid process that could be completed in days. NHS England now publishes the criteria. It reviewed DTAC in 2024, engaging with industry, and introduced an updated form on 24 February 2026.

DTAC is guidance rather than law. The AI and Digital Regulations Service guidance on using DTAC, marked as from NHS England, tells developers that although DTAC is not legally required, completing it is an essential activity, and says adopters will review a completed DTAC to judge whether a technology meets minimum baseline standards. NHS England’s own wording puts the duty on buyers: commissioners and providers must ensure any digital health product they use or recommend for use meets all national standards and requirements.

Who must complete the DTAC form

The duty falls on both sides of a sale. NHS England says commissioners or providers of health and social care services should apply DTAC to any DHT products, and sets out the roles as follows:

• Commissioners and providers must ensure that any DHT they use or recommend for use meets all national standards and requirements, and should use a completed DTAC form provided by the manufacturer when assessing products.
• Manufacturers must show their product meets DTAC’s minimum standards by keeping an up-to-date DTAC form and the required supporting documents for each product version, and should provide the form on request.
• Lead organisations that buy on behalf of others have a responsibility to assess the product against DTAC, while the organisations receiving and deploying the product keep their duty to ensure it meets relevant requirements.
• In-house developers must build products to meet the standards and requirements in DTAC. NHS England says a healthcare organisation that offers an in-house product to other organisations is acting as a manufacturer and should maintain and provide DTAC documentation on request.

The Transformation Directorate’s guidance on how to use the criteria, written at the 2021 launch, said digital health technologies should be assessed against DTAC regardless of procurement route, with buyers asking the developer to complete the question set and supply evidence. It also said DTAC is not intended to be the complete question set for procurements. Buyers are expected to add their own specifications, policy and regulatory requirements, and to consider the efficacy, impact and evidence of a technology separately. The guidance said NHSX was working with NICE to build on the Evidence Standards Framework for digital health technologies.

Which products are in scope

For DTAC purposes, NHS England defines DHT products as software products, including software-as-a-service and web or mobile apps. Electronic hardware devices and software embedded in hardware devices, such as CT scanners, are out of scope. So is software sold for a general purpose that happens to be used in healthcare settings, such as HR or finance systems. Where a supplier sells hardware and software as one package, NHS England says the DCB0129 documentation in section C1 must cover the combined hardware and software system.

The five core areas of DTAC

The form assesses products across five areas. For each one, NHS England’s guidance names an accountable officer and the subject matter expert who should review the evidence. The table reproduces that allocation as published.

Section	Area	Accountable officer	Subject matter expert
C1	Clinical safety	Chief clinical information officer, chief nursing information officer, executive nurse or clinician	Clinical safety officer or engineer
C2	Data protection	Data protection officer	Information governance officer or manager
C3	Technical security	Chief information security officer, chief technology officer	Technical architect, cyber security manager
C4	Interoperability	Chief information officer, chief technology officer, chief clinical or nursing information officer	Technical architect, business analyst, clinical or nursing informatician
D1	Usability and accessibility	Chief technology officer, chief information officer	Technical architect, business analyst

The assessed-section page on the Transformation Directorate site, which carries no version date and does not include the 2026 additions described later in this guide, shows the kind of evidence each section has asked for. In clinical safety it asks whether the product falls within the mandated scope of DCB0129, and for the risk management plan, clinical safety case report and hazard log. It asks for the details of a nominated Clinical Safety Officer, who must be a clinician with a current registration with a professional body, and whether the MHRA classifies the product as a medical device, with the certificate and class where it does.

In data protection, the same page asks for evidence of Information Commissioner’s Office registration and payment, a nominated data protection officer and, where the product has access to NHS-held patient data, confirmation of compliance with the annual Data Security and Protection Toolkit assessment and whether a DPIA has been carried out. It also asks for a documented lawful basis for processing, a breach management process and adequate contracts with sub-processors.

In technical security, the page says Cyber Essentials certification will be required, and asks for evidence that vulnerability, load and penetration testing has been carried out, how often, and whether internally or by a third party. In interoperability, it asks whether the product exposes APIs, whether they follow Government Digital Service open API best practice, whether the product uses the NHS Number and NHS Login, and whether it adopts healthcare data standards such as HL7 or FHIR. Suppliers should check each item against the current form, because the February 2026 refresh removed or reworded questions.

How DTAC links to DCB0129, DSPT, DPIA and Cyber Essentials

DTAC does not replace the underlying standards. It collects evidence that a product meets them, in one place, for a buyer. The main connections are set out below.

Clinical safety: DCB0129 and DCB0160

DCB0129 sets clinical risk management requirements for manufacturers of health IT systems, and DCB0160 sets them for the organisations that deploy and use those systems. NHS England says both are information standards published under section 250 of the Health and Social Care Act 2012, first introduced in 2009, with the current versions published in 2018. The form’s clinical safety section is where a manufacturer shows DCB0129 compliance. NHS England is conducting a national review of DCB0129 and DCB0160 and says it will update the criteria when the standards change.

Data protection: the DSPT and DPIAs

The Data Security and Protection Toolkit is an online self-assessment tool that lets organisations measure their performance against the National Data Guardian’s 10 data security standards, and all organisations that have access to NHS patient data and systems must use it. As of November 2026 the toolkit site carries the outcomes, assertions and evidence items for the 2026-27 edition, version 9, published on 2 October 2026. NHS England says that, for products with access to NHS systems or patient data, suppliers must also complete and return the toolkit, and that the DTAC form includes questions to identify when this is required while dropping questions the toolkit already covers.

Suppliers may also be asked to complete and attach further documents, such as a Data Protection Impact Assessment (DPIA). NHS England tells buyers to use the centrally produced standardised templates when they ask for one.

Technical security: Cyber Essentials and testing

The assessed-section page lists Cyber Essentials certification and penetration testing evidence under C3. According to a March 2026 analysis by the law firm Burges Salmon, the 2026 form also asks suppliers to confirm compliance with the government’s Software Security Code of Practice and to extend multi-factor authentication to administrator and remote access accounts.

Medical devices: MHRA regulation and the PAQ

Where a product is both a DHT and a medical device, the criteria run alongside device regulation. NHS England says DTAC is not intended to replace or be an alternative to medical device regulations, and provides a Pre-Acquisition Questionnaire (PAQ) for manufacturers of medical devices to complete ahead of procurement. Public sector bodies must also follow other applicable standards, such as the Government Service Standard and the NHS Service Standard. On the regulator’s own plans, see our report on the MHRA Centre for AI and Digital Health under its 2030 strategy.

The DTAC process step by step

NHS England does not publish a single mandatory workflow. The sequence below follows its rules on scope, roles, evidence and re-assessment, and the developer guidance from the AI and Digital Regulations Service.

1. Confirm scope. Check that the product is software-based and not general-purpose or embedded software. If it is sold with hardware, plan DCB0129 documentation that covers the whole system.
2. Check medical device status. The AI and Digital Regulations Service notes that technology and software may be considered a medical device depending on its intended purpose. If the product is a device, prepare NHS England’s PAQ as well.
3. Use the current form. NHS England introduced the updated form on 24 February 2026 and says the previous version should not be used from 6 April 2026.
4. Assemble evidence for the product version. Gather DCB0129 documents, DSPT status, any DPIA, security testing results and accessibility evidence, matched to the version being sold.
5. Submit to the buyer. The manufacturer provides the completed form and documents. The buying organisation reviews each area with the kinds of accountable officer and subject matter expert NHS England lists.
6. Add local requirements. Buyers supplement DTAC with their own procurement specifications, policy and regulatory requirements, because it is not the complete question set.
7. Re-assess over time. NHS England tells organisations to put in place processes to re-assess elements that have an expiry date or change due to upgrades.

Fees and timelines

NHS England’s DTAC page does not publish a fee or an official review timescale, as of November 2026. At the 2021 launch, NHSX described DTAC as a process that could be completed in days, but that is not a service standard for individual buyers. NHS England says it does not currently endorse any third-party certification schemes for DTAC.

What changed in the February 2026 DTAC refresh

NHS England reviewed DTAC in 2024, engaging with industry, and its DTAC page lists three resulting changes:

• a new DTAC form with a 25% reduction in questions, de-duplicated against processes such as the Data Security and Protection Toolkit and the Pre-Acquisition Questionnaire;
• clearer guidance explaining DTAC’s purpose, scope and how to complete assessments;
• confirmed scope alignment with NICE, focusing DTAC on software-based digital health technologies.

The updated form was introduced on 24 February 2026. A news item published on innovation.nhs.uk on 4 March 2026 said the previous form should be retired, with full transition to the updated form by 6 April 2026.

NHS England’s DTAC page also says the previous form required the clinical safety officer named in the clinical safety section to undertake training provided by NHS Digital, and that this requirement no longer stands. It also says NHS England identified and removed elements in DTAC where there is overlap with the Medical Device Regulations. The page adds that the Transformation Directorate site would no longer be updated from 31 March 2026, and that from April 2026 links to it would redirect to digital.nhs.uk.

What the trade and legal press reported

Burges Salmon’s analysis, published on 20 March 2026, said the usability and accessibility section is no longer scored and is reviewed only comparatively, has moved to WCAG 2.2 AA, and that a new filter in the data protection section lets lower-risk products skip further questions.

techUK, in a 17 March 2026 roundup of a webinar it hosted with the Department of Health and Social Care and NHS England’s Joint Policy Unit, reported that buyers were encouraged, but not required, to use the new form for new procurements during the transition, and that procurements already using the previous version did not need to restart or resubmit documentation.

How DTAC compares with other NHS assurance checks

Suppliers selling software into the NHS usually face several overlapping regimes. The table summarises who each applies to and how it relates to DTAC, based on the official sources cited in this guide.

Regime	Who it applies to	Status	Relation to DTAC
DTAC	Buyers of software-based DHTs and their suppliers	NHS England guidance; not legally required, per the AI and Digital Regulations Service	The baseline form itself
DCB0129	Manufacturers of health IT systems	Information standard under section 250 of the Health and Social Care Act 2012	Evidenced in section C1
DCB0160	Organisations deploying and using health IT	Information standard under section 250	The buyer’s own clinical risk work
DSPT	All organisations with access to NHS patient data and systems	Annual online self-assessment	Required where applicable; duplicate questions removed from DTAC
Medical device regulation and PAQ	Manufacturers of software regulated as a medical device	Regulated by the MHRA; PAQ provided by NHS England	Separate; DTAC does not replace it

The innovator passport announced by the Department of Health and Social Care on 2 July 2025 targets the same duplication from a different angle. The government said the passport would allow technology assessed by one NHS organisation to be rolled out to others, that further NHS organisations would not be able to insist on repeated assessments, and that it would be introduced over the next two years. techUK reported in March 2026 that NHS England was exploring an online DTAC repository as part of the Innovator Passport programme.

The MHRA treats many software products as medical devices, and its software and AI as a medical device guidance sits in a separate regulatory track with its own change programme. A pass on the form therefore does not show that a product meets device regulation, and NHS England says the criteria are not intended to replace or be an alternative to it.

What DTAC means for suppliers and NHS buyers

For suppliers, the manufacturer duty is mostly about version control. NHS England expects an up-to-date form and supporting documents for each product version, and tells buyers to re-assess elements that expire or change with upgrades. Product releases and certificate renewals can therefore reopen assurance with existing customers. Burges Salmon advised suppliers to embed DTAC into product development and release processes from the outset.

For trusts and integrated care boards, a form with 25% fewer questions means less evidence to read, but the accountability does not move. The buying organisation, or each receiving organisation where a lead buyer acts for others, keeps its own duty to ensure the product meets relevant requirements. techUK reported that procurements already using the previous version of the form would not need to restart or resubmit documentation.

For investors and acquirers in UK digital health, a supplier’s assurance pack is a practical due diligence document: it shows whether a Clinical Safety Officer is named, whether DSPT submissions are current, and how security testing is done. The Healthcare Daily’s Suppliers Guide profiles vendors selling into the NHS, and our digital health section reports contract awards such as the Surrey and Borders NHS trust ambient voice AI contract with Accurx.

Practical DTAC submission tips from official guidance

The following points come from NHS England’s DTAC page and the AI and Digital Regulations Service guidance for developers.

• Start early. Developers should meet the criteria during technology conceptualisation and throughout the technology’s lifecycle, and plan how to build the required standards into the design of the technology.
• Use NHS components. The guidance points developers to the NHS digital service manual, including its design system for usability and accessibility, and to NHS login and the Personal Demographics Service where relevant.
• Keep one pack per version. Maintain the form and supporting documents for each product version, ready to provide on request.
• Track expiry dates. Certificates, test results and assessments that expire, and changes from upgrades, should trigger re-assessment.
• Know what moved out of DTAC. The refreshed form was de-duplicated against the toolkit and the PAQ, and NHS England says suppliers of products with access to NHS systems or patient data must still complete and return the toolkit.
• Document processes. The AI and Digital Regulations Service tells developers to document all their processes to produce evidence demonstrating that the technology meets the required standards.
• Ask NHS England. The guidance gives england.dtac@nhs.net as the contact for DTAC questions.

What to watch next

As of November 2026, four developments will shape DTAC over the coming year.

• The clinical safety standards review. NHS England’s consultation on DCB0129 and DCB0160 opened on 29 June 2026 and closed on 11 September 2026. NHS England has said it will publish a consultation response report and will update DTAC when the standards change.
• A central repository. NHS England says it is exploring a centralised repository for hosting and maintaining DTAC documentation.
• Certification. NHS England is exploring a certification scheme for DHTs. techUK reported that NHS England was also exploring the feasibility of a certification-based approach that would let suppliers tell the NHS once.
• The innovator passport. The government said on 2 July 2025 that the passport would be introduced over the next two years.

NHS England’s DTAC page also notes commitments to set standards for technology used in social care and to update medical device rules. For AI suppliers, the government’s response on AI regulation, covered in our report that the UK accepted all 44 recommendations on regulating AI in healthcare, is a related thread. Related policy changes can be followed in The Healthcare Daily’s Tracker.