Digital health technology is transforming how care is delivered across the NHS. From AI-powered diagnostics to remote patient monitoring platforms, the pace of innovation in healthtech has never been faster. But with that pace comes an important question: how does the NHS know which technologies are safe, secure, and genuinely fit for purpose?
That is what DTAC is designed to answer. If you are selling or deploying a digital health product within the NHS, DTAC is almost certainly in your future — and the sooner you understand it, the better prepared you will be.
DTAC stands for Digital Technology Assessment Criteria. It is the NHS's assurance framework for evaluating digital health technologies before they are adopted or deployed across health and social care settings.
Think of DTAC as the NHS's minimum quality standard for digital products. It assesses whether a technology meets baseline requirements across five key areas: clinical safety, data protection, cyber security, interoperability, and usability and accessibility.
DTAC was developed by NHS England and NHS Improvement to create consistency in how NHS organisations evaluate digital products during procurement. Rather than every trust running its own ad hoc assessment, DTAC provides a shared standard that any NHS buyer can use to evaluate any supplier.
DTAC applies to innovators and suppliers offering digital health technologies that the NHS will use. NHS England describes DTAC as:
"Designed to be used by healthcare organisations to assess suppliers as part of a due diligence process, to make sure digital technologies meet our minimum baseline standards."
In practice, if you are building a product — whether software, an app, an AI tool, or a connected device — that an NHS organisation will use in any care setting, you will likely need to demonstrate DTAC compliance before you can deploy or go live. Importantly, DTAC is required before pilots as well as before full procurement. Even seemingly low-risk tools often fall within scope, because NHS buyers use DTAC as their standard due diligence benchmark.
In February 2026, NHS England released an updated version of DTAC — widely referred to as DTAC 2.0. The update introduced important changes to the DTAC form and revised the scope of the framework. Key changes include:
If you completed DTAC prior to 2026, it is worth reviewing your documentation against the updated DTAC 2.0 requirements. Some sections may need to be updated or re-evidenced.
DTAC is structured around five assessment areas. Each must be addressed in your compliance submission. Here is what each component involves:
1 |
Clinical Safety (DCB0129)Demonstrates that your product has been developed with clinical safety at its core, following the NHS clinical risk management standard DCB0129. |
Clinical safety is the most complex component of DTAC and is governed by NHS information standard DCB0129. This standard requires any manufacturer of a health IT system to systematically identify, assess, and mitigate clinical risks that might arise from using the software.
To meet DCB0129, you must produce and maintain three core documents:
1. A document setting out how your organisation will manage clinical safety throughout the product's lifecycle, including roles, responsibilities, and governance.Clinical Risk Management Plan (CRMP) —
2. A structured record of all identified clinical risks, their potential causes and consequences, the likelihood and severity of each, and the controls put in place to mitigate them.Hazard Log —
3. A formal argument, reviewed and signed off by a qualified Clinical Safety Officer (CSO), that your product is sufficiently safe for its intended clinical use.Clinical Safety Case Report —
All three documents must be approved by a named Clinical Safety Officer (CSO) — a registered clinician who has completed NHS-recognised clinical safety training. Many early-stage healthtech companies use an external or fractional CSO to fulfil this requirement cost-effectively.
2 |
Data ProtectionDemonstrates lawful, GDPR-compliant handling of personal and health data, and compliance with the NHS Data Security and Protection Toolkit (DSPT). |
Data protection is a core pillar of DTAC, reflecting the sensitivity of health and care data and the legal obligations that come with processing it. To meet this component, you need to:
DSPT and DTAC are closely linked: DSPT is embedded within DTAC as a data protection requirement. You cannot achieve DTAC compliance without also completing DSPT.
3 |
Cyber SecurityDemonstrates technical security controls sufficient to protect NHS data, including Cyber Essentials certification and penetration testing. |
Healthcare data is one of the most targeted by cybercriminals, making cyber security a non-negotiable element of DTAC. The cyber security component assesses whether your technology and organisation have the technical controls needed to protect NHS data from attack. Requirements include:
4 |
InteroperabilityDemonstrates how your product interacts with other NHS systems and data platforms, using recognised standards where applicable. |
Interoperability assesses how well your product integrates with the broader NHS digital ecosystem. The NHS has a strong interest in avoiding siloed tools that cannot share data with other clinical systems. This component requires you to demonstrate:
For products that are genuinely standalone and do not integrate with other clinical systems, the justification for this approach must be clearly evidenced.
5 |
Usability & AccessibilityThe only scored component — demonstrates that your product is accessible and usable for all intended users, including those with disabilities. |
Usability and Accessibility is unique within DTAC: it is the only scored section, and it is acceptable to be "working towards" compliance in some areas rather than fully meeting all requirements from day one.
This component recognises that digital health tools must be genuinely usable by all clinicians, patients, and carers who need them — including those with disabilities or lower digital literacy. To score well, you should demonstrate:
Do not overlook this section. Strong usability and accessibility is not just a compliance requirement — it directly supports safer and more effective clinical use of your product.
Unlike ISO 27001 or Cyber Essentials, there is no central DTAC certification body and no formal accreditation. DTAC compliance is demonstrated directly to the NHS buyer, typically a trust, Integrated Care Board (ICB), or commissioning organisation.
Here is how the process typically works:
Work through all five components, producing the required documentation and evidence for each. Complete the DTAC requirements.
The DTAC 2.0 form guides you through each component and requires you to provide evidence against each requirement. Complete the DTAC questionnaire.
Compile supporting documentation, policies, certificates, test results, clinical safety documents, and so on, alongside your completed form. Assemble your evidence pack.
Your DTAC form and evidence are submitted directly to the NHS organisation you are working with, not to a central body. Submit to the NHS buyer.
The NHS buyer reviews your submission and may raise questions or ask for additional evidence. Respond to queries.
Any changes to your product that affect clinical risk, data flows, or security architecture require you to update your DTAC documents. Keep it current.
The honest answer is: it depends. Companies with little existing compliance documentation can take three to six months or more for a first DTAC submission. Those with existing policies, Cyber Essentials certification, and some clinical safety groundwork can move considerably faster — often within six to eight weeks with focused support.
Starting DTAC early, before an NHS buyer asks for it, puts you in a far stronger position during procurement conversations.
Without DTAC, most NHS procurement teams will pause or decline to proceed. In practice, missing DTAC can mean:
The message from the NHS market is consistent: DTAC is the entry ticket, not an optional extra. Companies that treat it as such lose deals to competitors who are already prepared.
One of the most common points of confusion for digital health companies is the relationship between DTAC and DSPT. Here is a simple way to think about it:
DTAC is the overarching NHS assurance framework for digital health products. DSPT is one of the specific requirements within DTAC's data protection component. You cannot be DTAC compliant without having a valid DSPT submission. But DSPT alone does not make you DTAC compliant.
Achieving both DSPT and DTAC compliance together, ideally alongside Cyber Essentials and DCB0129, represents a strong, comprehensive compliance position for any digital health company selling to the NHS.
From our experience supporting digital health companies through DTAC, these are the pitfalls that cause the most delays:
Our team combines clinical safety expertise, data protection knowledge, and cyber security experience to help you build a DTAC submission that genuinely reflects your product's safety and security posture.