The Digital Technology Assessment Criteria (DTAC) help NHS buyers in England assess digital health technology across clinical safety, data protection, technical security, interoperability, and usability and accessibility. C1–C4 form the core pass/fail criteria; usability and accessibility provide comparative information. A completed supplier form is one part of the assessment, alongside the buyer’s review and other applicable assurance. NHS assessment guidance; DTAC form, introduction and section D
The version 2.0 form records an update on 24 February 2026 and says manufacturers must provide it in place of version 1.0 from 6 April when requested by health and care organisations. The buying question is which product version the evidence covers, who evaluates it and what the deploying organisation still needs to assess. DTAC form, introduction
Which technologies are in scope?
DTAC concerns software-based digital health technologies used by care recipients, clinicians or staff. That includes relevant mobile apps, web services and software supplied alongside hardware. It does not cover every system found in a hospital: general-purpose finance or HR software, electronic hardware itself and embedded firmware are outside its stated assessment scope. NHS England’s scope guidance
This is a boundary around the framework, not a finding that an excluded product needs no assurance. The form’s clinical-safety introduction says that where the software is supplied as part of a health IT system with hardware, the requested DCB0129 documentation should cover the whole system. DTAC form, section C1
Five areas, with different review expertise
The NHS assessment guidance identifies five areas and gives examples of appropriate oversight. These are example functions, rather than a requirement that every organisation use identical job titles. Assessment roles and responsibilities
| Assessment area | Example expertise in the NHS guidance |
|---|---|
| C1: clinical safety | Clinical safety officer or engineer, with clinical leadership accountability |
| C2: data protection | Information governance staff, with data protection officer accountability |
| C3: technical security | Technical architect or cyber security manager |
| C4: interoperability | Technical architect, business analyst or clinical informatician |
| D1: usability and accessibility | Technical architect or business analyst |
The form does not treat all five areas as a single pass/fail checklist. Its introduction identifies C1–C4 as the core assessment criteria that a product must meet to pass. Section D says usability and accessibility provide comparative information and do not contribute to that pass/fail assessment. Sections A and B supply company and product context rather than scored criteria. DTAC form, introduction and section D
A completed supplier document and an organisation’s decision to accept the evidence are separate steps in the published process.
What suppliers provide, and what buyers retain
Manufacturers should maintain a current DTAC form and supporting documents for each product version. A reseller supplying the technology should pass on the completed documentation, involving the manufacturer where needed. NHS England asks buyers to use the standard form; genuinely additional requirements should be supplemental requests that do not duplicate it. Documentation responsibilities
The form identifies the product version in A3 and requests evidence through conditional questions. Examples include the clinical safety case report and hazard log in C1.2.4, the product data protection impact assessment (DPIA) in C2.2.2 and an external penetration-test summary in C3.3. These are not an unconditional attachment list: applicability questions and routing instructions determine which responses are requested. DTAC form, sections A and C
The assessment guidance also covers trials and products offered outside ordinary procurement. Buyers should record the product, version and assessment result, and have processes to revisit evidence that expires or changes following upgrades. Where one organisation buys for others, the receiving organisations retain their duties and need appropriate oversight of the assessment. Conducting an assessment
The guidance links the assessment record to the product version and the organisation’s responsibilities. It does not equate reuse of supplier documentation with approval of every deployment.
How DTAC relates to other assurance
NHS England describes DTAC as complementary to other requirements. Medical-device requirements still apply to products within their scope. Suppliers accessing NHS systems or patient data must also complete the Data Security and Protection Toolkit. Relevant public-service standards and local value-for-money and suitability assessments remain part of the buying decision. Other regulatory and assurance processes
The link to the Pre-Acquisition Questionnaire (PAQ) is explicit in DTAC question C1.1.1. If the product or a component qualifies as software or artificial intelligence as a medical device, the form requires a completed PAQ alongside the DTAC response. DTAC form, C1.1.1
PAQ version 10, dated May 2026, describes its purpose as supporting acquisition of a medical device the NHS organisation has already evaluated and selected. Part I collects product, regulatory, training, technical-support and data-security information; Part II records transaction-specific details. Its F1.1 question asks for an attached DTAC form where applicable. F1.1 uses broad digital-technology wording, while F1.2 and F1.4 explicitly acknowledge embedded software outside DTAC; DTAC’s own introduction sets out its software-scope exclusions. PAQ form, introduction, parts I–II and section F
Clinical-safety responsibilities also differ by role. DCB0129 concerns manufacture and maintenance of health IT systems; DCB0160 concerns their deployment, use, maintenance and decommissioning by health organisations. Both official records still list implementation-stage 2018 releases while a review is underway. A standards review does not itself replace those records. DCB0129, DCB0160
A data protection impact assessment addresses the risks of a particular project’s data use. NHS guidance places that work during planning, with support from the organisation’s data protection or information governance function. A supplier’s product evidence does not describe every local data flow. NHS DPIA guidance
For AI products, our reporting on the UK healthcare AI commission response separately distinguishes policy commitments from reforms that have taken effect. The same care over regulatory status matters when evaluating a supplier’s assurance claims.
What a DTAC claim does not establish
NHS England says it does not currently endorse third-party DTAC certification schemes. It is exploring further certification arrangements, but a commercial certificate should not be presented as national NHS endorsement. Third-party certification guidance
For buyers, the useful distinction is between documented assessment against the framework, any separate regulatory requirements and the local decision about whether the technology fits its intended use. A “DTAC compliant” label alone does not answer all three.