Digital Technology Assessment Criteria (DTAC)

The Digital Technology Assessment Criteria (DTAC) is NHS England's national baseline that NHS and adult social care organisations in England use when assessing digital health technologies before buying or deploying them. It gives commissioners a consistent set of questions and gives suppliers a single, predictable format instead of a different assessment from every Trust.

The current form, version 2.0, was introduced in February 2026. Its scope follows the NICE Evidence Standards Framework definition of software-based digital health technology, which includes software as a service and web and mobile apps but excludes general-purpose software, such as HR or finance systems, and software embedded in hardware.

DTAC is an assurance and procurement tool that sits alongside regulatory approval. It does not replace UKCA or CE marking, and completing it does not make a product a lawful medical device if it was not one already. Equally, being a regulated device does not exempt a supplier from DTAC, because the criteria cover areas regulation does not, such as NHS interoperability standards.

The five core areas

• Clinical safety: evidence of compliance with DCB0129, the clinical risk management standard for health IT manufacturers, including a named clinical safety officer, hazard log and clinical safety case report. The buying organisation's own duties sit under the companion standard, DCB0160.
• Data protection: UK GDPR compliance, including a data protection impact assessment where requested, and completion of the Data Security and Protection Toolkit.
• Technical security: the security of the product and of the supplier's development practice.
• Interoperability: use of open standards and NHS technical standards.
• Usability and accessibility: conformance with accessibility requirements and evidence of user research and testing.

How it is assessed

Sections are completed by the supplier and reviewed by the buying organisation, with an accountable officer for each area, such as the chief clinical information officer for clinical safety. Buyers should reassess elements that expire or change with product upgrades. NHS England does not currently endorse any third-party DTAC certification schemes.

Version 2.0 has around 25% fewer questions than the original form and removes duplication with the Data Security and Protection Toolkit and the pre-acquisition questionnaire used for medical devices. The previous form should not be used from 6 April 2026.

Preparing well

DTAC is easiest to complete when the evidence is built alongside development and not assembled at the end of a sales cycle. The clinical safety case and the data protection impact assessment in particular take time to produce properly and are difficult to reconstruct after the event, so suppliers who prepare them early can respond to a DTAC request much faster.