The Digital Technology Assessment Criteria explained for suppliers

The Digital Technology Assessment Criteria explained for suppliers

If you sell digital health technology into the NHS, DTAC is the baseline assurance standard that determines whether NHS organisations can procure your product. It is not optional, not self-executing, and not a one-time exercise. The five areas it covers are clinical safety, data protection, technical security, interoperability, and usability and accessibility.

If you sell digital health technology into the NHS, DTAC is the baseline assurance standard that determines whether NHS organisations can procure your product. It is not optional, not self-executing, and not a one-time exercise. The five areas it covers are clinical safety, data protection, technical security, interoperability, and usability and accessibility.

DTAC was refreshed in 2026. If your assessment was completed on the previous form, it is no longer current.

DTAC was refreshed in 2026. If your assessment was completed on the previous form, it is no longer current.

What is NHS DTAC?

NHS DTAC, the Digital Technology Assessment Criteria, is the NHS's national baseline standard for evaluating whether digital health technologies meet the minimum requirements for clinical safety, data protection, technical security, interoperability, and usability before they are adopted or deployed across NHS and social care settings.

NHS DTAC, the Digital Technology Assessment Criteria, is the NHS's national baseline standard for evaluating whether digital health technologies meet the minimum requirements for clinical safety, data protection, technical security, interoperability, and usability before they are adopted or deployed across NHS and social care settings.

It was developed by NHS England and NHS Improvement to create a consistent standard that any NHS organisation could use to evaluate any digital supplier, replacing the previous situation where individual trusts ran their own ad hoc assessments. DTAC provides a shared framework that suppliers can complete once and reference across multiple NHS procurement conversations, replacing the previous situation where individual trusts ran their own ad hoc assessments.

It was developed by NHS England and NHS Improvement to create a consistent standard that any NHS organisation could use to evaluate any digital supplier, replacing the previous situation where individual trusts ran their own ad hoc assessments. DTAC provides a shared framework that suppliers can complete once and reference across multiple NHS procurement conversations, replacing the previous situation where individual trusts ran their own ad hoc assessments.

DTAC is a self-assessment, supported by evidence. It is not a third-party audit in the first instance, though NHS trusts may request independent verification of specific elements. The assessment is the supplier's responsibility to complete and maintain.

DTAC is a self-assessment, supported by evidence. It is not a third-party audit in the first instance, though NHS trusts may request independent verification of specific elements. The assessment is the supplier's responsibility to complete and maintain.

Why DTAC is important for digital health suppliers

DTAC is the gateway to NHS procurement for most digital health technologies. It is required or expected across the major NHS procurement routes that digital health suppliers use:

DTAC is the gateway to NHS procurement for most digital health technologies. It is required or expected across the major NHS procurement routes that digital health suppliers use:

NHS SBS frameworks: NHS SBS framework lots for digital and clinical technology typically require DTAC evidence as part of qualification. Suppliers without a current DTAC assessment will not meet the qualification criteria.

NHS SBS frameworks: NHS SBS framework lots for digital and clinical technology typically require DTAC evidence as part of qualification. Suppliers without a current DTAC assessment will not meet the qualification criteria.

G-Cloud: NHS buyers calling off digital health software through G-Cloud expect DTAC evidence. It is not a mandatory G-Cloud qualification requirement, but NHS trust procurement teams routinely request it before awarding a call-off.

G-Cloud: NHS buyers calling off digital health software through G-Cloud expect DTAC evidence. It is not a mandatory G-Cloud qualification requirement, but NHS trust procurement teams routinely request it before awarding a call-off.

NHS AI frameworks: the NHS SBS Healthcare AI Solutions framework, which launched in May 2026 for supplier admission from March 2027, includes DTAC requirements as part of the assurance evidence for clinical and clinical-adjacent AI suppliers.

NHS AI frameworks: the NHS SBS Healthcare AI Solutions framework, which launched in May 2026 for supplier admission from March 2027, includes DTAC requirements as part of the assurance evidence for clinical and clinical-adjacent AI suppliers.

Direct NHS trust procurement: even below-threshold procurements and pilot arrangements with NHS trusts will typically involve a trust requesting a DTAC assessment before signing a contract. NHS England guidance describes DTAC as an essential activity for digital health suppliers, even where it is not formally required.

Direct NHS trust procurement: even below-threshold procurements and pilot arrangements with NHS trusts will typically involve a trust requesting a DTAC assessment before signing a contract. NHS England guidance describes DTAC as an essential activity for digital health suppliers, even where it is not formally required.

What DTAC covers: the five assessment areas

Clinical safety

Clinical safety

Suppliers must demonstrate that their product meets the relevant clinical safety standards. For software that qualifies as a medical device, this means following DCB0129 for clinical risk management by manufacturers and DCB0160 for clinical risk management by deployers. The updated DTAC includes a decision tree to help suppliers work out whether their product is classified as a medical device. The previous requirement for an NHS-specific Clinical Safety Officer training course has been removed in the 2026 update.

Suppliers must demonstrate that their product meets the relevant clinical safety standards. For software that qualifies as a medical device, this means following DCB0129 for clinical risk management by manufacturers and DCB0160 for clinical risk management by deployers. The updated DTAC includes a decision tree to help suppliers work out whether their product is classified as a medical device. The previous requirement for an NHS-specific Clinical Safety Officer training course has been removed in the 2026 update.

Data protection

Data protection

Suppliers must complete a Data Protection Impact Assessment (DPIA) identifying risks to individuals' privacy, with sign-off from their Data Protection Officer. Requirements around international data transfers have been expanded to reflect the UK's current legal framework, including the International Data Transfer Agreement and Transfer Risk Assessment. Suppliers must also provide transparency materials such as privacy notices and their terms and conditions.

Suppliers must complete a Data Protection Impact Assessment (DPIA) identifying risks to individuals' privacy, with sign-off from their Data Protection Officer. Requirements around international data transfers have been expanded to reflect the UK's current legal framework, including the International Data Transfer Agreement and Transfer Risk Assessment. Suppliers must also provide transparency materials such as privacy notices and their terms and conditions.

Technical security

Technical security

Suppliers must confirm compliance with the government's Software Security Code of Practice, published by DSIT and the National Cyber Security Centre. This replaces elements of the previous technical security section and reflects updated government security expectations for software supplied to the public sector.

Suppliers must confirm compliance with the government's Software Security Code of Practice, published by DSIT and the National Cyber Security Centre. This replaces elements of the previous technical security section and reflects updated government security expectations for software supplied to the public sector.

Interoperability

Interoperability

Suppliers must explain why their chosen technical interfaces (APIs) and data standards are appropriate, using recognised NHS guidance. This requirement was strengthened in the 2026 update. Suppliers must now justify their technical choices rather than simply listing the standards they support.

Suppliers must explain why their chosen technical interfaces (APIs) and data standards are appropriate, using recognised NHS guidance. This requirement was strengthened in the 2026 update. Suppliers must now justify their technical choices rather than simply listing the standards they support.

Usability and accessibility

Usability and accessibility

The usability section has been updated to the latest web accessibility standard (WCAG 2.2 AA) and now requires suppliers to show they have considered the Accessible Information Standard, ensuring information is provided in formats people can understand.

The usability section has been updated to the latest web accessibility standard (WCAG 2.2 AA) and now requires suppliers to show they have considered the Accessible Information Standard, ensuring information is provided in formats people can understand.

What changed in the 2026 DTAC refresh

NHS England refreshed DTAC in February 2026, with the new form replacing the previous version from 6 April 2026. The previous DTAC form should not be used from that date onwards.

NHS England refreshed DTAC in February 2026, with the new form replacing the previous version from 6 April 2026. The previous DTAC form should not be used from that date onwards.

The key changes:

The key changes:

• The new form contains 25% fewer questions than the previous version. NHS England removed items that duplicated the Data Security and Protection Toolkit and the Pre-Acquisition Questionnaire.

  The new form contains 25% fewer questions than the previous version. NHS England removed items that duplicated the Data Security and Protection Toolkit and the Pre-Acquisition Questionnaire.

• The requirement for the clinical safety officer named in the DTAC to have completed NHS Digital-specific training has been removed.

  The requirement for the clinical safety officer named in the DTAC to have completed NHS Digital-specific training has been removed.

• Interoperability requirements have been strengthened, with suppliers now required to justify technical interface choices rather than simply declare them.

  Interoperability requirements have been strengthened, with suppliers now required to justify technical interface choices rather than simply declare them.

• The usability section has been updated to WCAG 2.2 AA and the Accessible Information Standard.

  The usability section has been updated to WCAG 2.2 AA and the Accessible Information Standard.

• Data protection requirements have been updated to reflect current UK requirements.

  Data protection requirements have been updated to reflect current UK requirements.

NHS England has stated that further changes are expected as reviews of DCB0129 and DCB0160 continue, and has committed to work on standards for technology used in social care.

NHS England has stated that further changes are expected as reviews of DCB0129 and DCB0160 continue, and has committed to work on standards for technology used in social care.

How to complete a DTAC assessment

The DTAC is completed by the supplier and submitted to the NHS buyer as part of the procurement process. The assessment is available from the NHS Digital Regulations Service.

The DTAC is completed by the supplier and submitted to the NHS buyer as part of the procurement process. The assessment is available from the NHS Digital Regulations Service.

NHS England guidance recommends that suppliers work through the DTAC during product development rather than treating it as a final step before a procurement. Many of the requirements, particularly clinical safety, data protection, and technical security, are most efficiently addressed as part of product and operations processes rather than retrospectively assembled for a specific tender.

NHS England guidance recommends that suppliers work through the DTAC during product development rather than treating it as a final step before a procurement. Many of the requirements, particularly clinical safety, data protection, and technical security, are most efficiently addressed as part of product and operations processes rather than retrospectively assembled for a specific tender.

Where a DTAC assessment reveals a gap in current compliance, addressing it takes time. Suppliers who discover during a procurement process that they cannot evidence clinical safety standards, do not have a current DPIA, or have not met the interoperability requirements are in a weaker position than those who have maintained DTAC readiness as a standing operational standard.

Where a DTAC assessment reveals a gap in current compliance, addressing it takes time. Suppliers who discover during a procurement process that they cannot evidence clinical safety standards, do not have a current DPIA, or have not met the interoperability requirements are in a weaker position than those who have maintained DTAC readiness as a standing operational standard.

NHS trusts may request reassessment where evidence expires or product updates trigger revalidation. Building DTAC review into your release and update processes is more efficient than starting from scratch each time a significant change occurs.

NHS trusts may request reassessment where evidence expires or product updates trigger revalidation. Building DTAC review into your release and update processes is more efficient than starting from scratch each time a significant change occurs.

DTAC and the broader assurance picture

DTAC is one element of the assurance landscape for digital health suppliers, not the complete picture. Other requirements that sit alongside it include the Data Security and Protection Toolkit, Cyber Essentials certification (mandatory for most NHS digital framework lots), and where relevant, MHRA medical device registration and CQC requirements.

DTAC is one element of the assurance landscape for digital health suppliers, not the complete picture. Other requirements that sit alongside it include the Data Security and Protection Toolkit, Cyber Essentials certification (mandatory for most NHS digital framework lots), and where relevant, MHRA medical device registration and CQC requirements.

For suppliers selling AI-enabled clinical tools, the NHS's AI in Health and Care programme maintains the AI and Digital Regulations Service, which includes DTAC as part of a broader evidence framework covering AI-specific safety and governance requirements.

For suppliers selling AI-enabled clinical tools, the NHS's AI in Health and Care programme maintains the AI and Digital Regulations Service, which includes DTAC as part of a broader evidence framework covering AI-specific safety and governance requirements.

Understanding which assurance requirements apply to your specific product, procurement route, and buyer type, and maintaining current evidence for each, is one of the less visible but most commercially significant aspects of selling digital health technology into the NHS. A supplier without current DTAC evidence who discovers a framework application deadline in four weeks is in a materially worse position than one who has maintained the assessment as an ongoing requirement.

Understanding which assurance requirements apply to your specific product, procurement route, and buyer type, and maintaining current evidence for each, is one of the less visible but most commercially significant aspects of selling digital health technology into the NHS. A supplier without current DTAC evidence who discovers a framework application deadline in four weeks is in a materially worse position than one who has maintained the assessment as an ongoing requirement.

Getting DTAC right is the cost of entry. Knowing which NHS buyers are actively procuring in your category, which frameworks carry spend, and when contracts are approaching renewal is the commercial layer on top of it. This is the intelligence Arcamus provides.. See how we can help.

Getting DTAC right is the cost of entry. Knowing which NHS buyers are actively procuring in your category, which frameworks carry spend, and when contracts are approaching renewal is the commercial layer on top of it. This is the intelligence Arcamus provides.. See how we can help.