Who conducts an NHS DTAC assessment, and what happens next?

The manufacturer prepares a current DTAC form and its supporting evidence. The care provider or commissioner assesses the product as part of its own assurance and due diligence before purchasing or deploying it. That separation matters: submitting a form is the start of the buyer's assessment, not the end of it. NHS England: how DTAC works.

A typical assessment sequence

NHS England does not prescribe these exact steps; each organisation applies its own governance. This is a practical outline.

1. Define the product. The buyer confirms which product, version, intended use and deployment it is considering.
2. Request the standard form. The manufacturer supplies the current NHS England DTAC form and supporting documents. A reseller should obtain the manufacturer's input and documentation where needed. NHS England says buyers should accept the standard form rather than creating amended versions, and put any additional requirements in separate supplemental requests.
3. Review each domain. Relevant clinical safety, data protection, security, interoperability, and usability/accessibility specialists examine the answers and evidence.
4. Resolve questions and conditions. The buyer asks for clarification or missing material and records any conditions in its governance process.
5. Record the decision. The assessed version and outcome are recorded so later changes can be evaluated against them.
6. Reassess when necessary. Expiring evidence, upgrades and material changes may require renewed review.

NHS England says DTAC assessment should still be carried out for products offered on a trial basis or outside normal procurement. It also advises recording the product version and assessment result. Products built in house under internal governance that checks these standards during design and build need no additional DTAC assessment on completion, unless they are offered to other providers. See its assessment guidance.

Can one organisation do the assessment for several buyers?

A lead organisation can assess a product acquired on behalf of others, but the receiving and deploying organisations retain duties to ensure the product meets relevant requirements. They may participate in the lead assessment or review the resulting documentation themselves. Local clinical risk work under DCB0160 may still be required because workflows and configurations differ.

What does an assessor need from the supplier?

A coherent pack: a complete current form, evidence matched to the exact version, named contacts who understand each domain, and candid statements about gaps or limits. A clinical safety case that refers to a different release, or an unsupported assertion that a product is “certified”, makes review harder.

NHS England does not currently endorse third-party DTAC certification schemes, although it says it is exploring a certification scheme of its own. A specialist can help prepare or review evidence, but the buyer still needs confidence in the method and must make its own governance decision. See our separate explanation of DTAC certification and our DTAC readiness support.