The NHS Digital Technology Assessment Criteria (DTAC) is a framework used by care commissioners and providers to assess digital health technology. It covers clinical safety, data protection, technical security, interoperability, and usability and accessibility. DTAC brings existing requirements into one assessment; it applies alongside, and does not replace, other approvals such as medical device certification or ICO registration. It is aimed at software-based digital health technology, not general-purpose software such as a generic HR system, or firmware embedded in hardware. NHS England's DTAC overview is the authoritative starting point.
The quickest way to stall an assessment is to complete the form before locating the evidence behind each answer. Build one inventory for the product and version under review, then have the right owner check each domain.
Five-domain evidence inventory
| Area | Questions to settle before completing the form | Typical evidence to locate |
|---|---|---|
| Clinical safety | Who is the manufacturer? What is the intended use? Which product release is assessed? | Applicable DCB0129 clinical risk management plan, hazard log, clinical safety case report and CSO arrangements. |
| Data protection | What personal data is processed, by whom and where? | Data flows, privacy information, a DPIA where requested, contracts and retention arrangements. Use NHS England's standard DPIA and Pre-Acquisition Questionnaire templates if asked for them. |
| Technical security | How are vulnerabilities found, fixed and monitored? | Security policies, access controls, testing evidence, remediation records and incident process. |
| Interoperability | What systems and standards are supported? What happens when an interface fails? | Interface specification, terminology and identifier handling, test results and failure behaviour. |
| Usability and accessibility | Can intended users use the product safely and accessibly? | User research, accessibility testing, known issues and remediation evidence. |
These are preparation prompts, not a replacement for the questions in the current DTAC form. Download that form directly from NHS England at the point of use. The updated form, introduced on 24 February 2026, has 25% fewer questions, and the previous version should not be used from 6 April 2026 onwards.
Put product scope before paperwork
Write a one-page product record: legal manufacturer, product name, version, intended users, purpose, deployment model and material integrations. Use the same record across the form and supporting documents. A safety case for one release and a penetration test for another may both be valid documents, but the mismatch needs explanation before the buyer can rely on them.
NHS England says manufacturers should keep an up-to-date form and supporting documents for each product version and provide the form on request. The care provider or commissioner then assesses it as part of its own due diligence. How DTAC works.
What to do with a gap
Record the missing evidence, the owner, the risk it creates and the date by which it can be produced. Avoid a confident “yes” that the evidence cannot support. If a specialist opinion is needed—for example on medical device status or data protection—obtain it from the appropriate professional. A clinical safety review can explain the clinical risk implications; it does not substitute for every DTAC domain.
For a domain-by-domain discussion of likely blockers, use our DTAC readiness guide. When the inventory is ready, follow our DTAC form workflow. If a buyer request is already live, start with a defined NHS readiness review.
Primary sources