If an NHS buyer requests a DTAC form, begin with the current form on NHS England's website. Download it at the point of use; do not reuse an old copy from another product or procurement. NHS England introduced the updated form on 24 February 2026 and says the previous version should not be used from 6 April 2026.
A seven-step supplier workflow
1. Confirm the product in scope
Record its legal manufacturer, name, version, intended purpose, users, care setting, hosting model and integrations. Check whether a reseller or another party will submit the documents. NHS England expects the manufacturer to maintain the form and supporting evidence for each product version. How DTAC works.
2. Assign a domain owner
Give clinical safety, data protection, security, interoperability and usability/accessibility to people able to explain the answers. A single bid writer can coordinate the return but should not silently make a clinical or security judgement on someone else's behalf.
3. Build an evidence index
For each answer, record the document title, version, date, owner and relevant section. Make it possible for the assessor to follow an answer to the evidence without searching a folder of files. Start with our five-domain evidence checklist.
4. Resolve contradictions
Check that the form, clinical safety case, privacy notice, security material and product description refer to the same capabilities and release. If a document predates a significant change, assess whether it remains valid and record the rationale.
5. Answer every question honestly
NHS England advises manufacturers to provide the completed form and to refrain from submitting incomplete forms or deleting sections or questions. Close evidence gaps before you submit. If you cannot, tell the buyer what is missing and how it will be addressed rather than leaving an answer blank or overstating it, and do not treat the form as a passed assessment. How DTAC works.
6. Have the right specialists review it
The clinical safety section should be checked against the relevant DCB0129 evidence and CSO arrangements. Other domains need their corresponding data protection, security, interoperability and accessibility owners. NHS England sets out example professional oversight roles in its assessment guidance.
7. Control the submitted version
Keep a record of what was sent, to whom, when, and for which product version. Plan how you will revisit evidence that expires or changes after a release. The buyer conducts its own due diligence; submitting a form does not itself confer an approval. See how an NHS DTAC assessment works for what happens next.
A useful final check
Can another person answer, from the pack alone: what product was assessed, what evidence supports each material answer, which gaps remain, and who is accountable for closing them? If not, the pack needs another review.
For help with the clinical safety and evidence-readiness parts of the process, see our DTAC support and scope and pricing.
Primary sources