Meet every requirement for
NHS DTAC with Assuric compliance software

The Digital Technology Assessment Criteria (DTAC) is the national baseline NHS and social care organisations in England use to assess digital health technologies before they buy them. NHS England published version 2.0 in February 2026, and buyers have used it instead of the original 2021 form since 6 April 2026. It covers five areas: clinical safety, data protection, technical security, interoperability, and usability and accessibility.

Clinical safety: apply DCB0129, required under the Health and Social Care Act 2012, with a registered Clinical Safety Officer. Data protection: comply with UK GDPR, register with the ICO, provide a DPIA for your product and, if you access patient data or NHS systems, meet the Data Security and Protection Toolkit (DSPT). Technical security: hold a valid Cyber Essentials certificate and, if your product is accessed over the internet, an external penetration test from the last 12 months. Interoperability: show how your product works with existing NHS systems. Usability and accessibility: show you follow best practice; buyers use this to compare products, but it doesn’t decide whether you pass.

DTAC isn’t a law, but it’s the national baseline NHS organisations are expected to use when assessing digital health technologies, so in practice you’ll need it to sell into the NHS. Much of what it asks for, such as DCB0129 and UK GDPR, is a legal requirement in its own right.

Usually, yes. Most NHS organisations ask for DTAC before a pilot as well as a full rollout.

No. There is no DTAC certificate. Each health or care organisation that buys your product assesses your completed DTAC form itself. Some criteria rely on external evidence, such as a valid Cyber Essentials certificate and an independent penetration test. Using the Assuric platform will ensure all the requirements are met.

DTAC asks you to meet DCB0129, the clinical risk management standard for manufacturers of health IT. DCB0160 is its counterpart for the health and care organisations deploying your product. Under DCB0129 your clinical safety team completes a clinical risk management plan, a hazard log and a clinical safety case report, signed off by your Clinical Safety Officer, and you submit the hazard log and safety case report with your DTAC. Your CSO must be a suitably qualified clinician with a current professional registration, and can be provided through an outsourced arrangement. Clinical safety is a continuous process, so you also need to monitor your product once it’s deployed. Contact us for advice on DCB0129 or on Clinical Safety Officers.

You need to comply with UK GDPR. DTAC asks for evidence of your ICO registration, a Data Protection Impact Assessment for your product, transparency materials such as a privacy notice, and confirmation of where your data is stored and processed, with safeguards for anything outside the UK. Behind that, you need a lawful basis under Article 6 to process personal data, an Article 9 condition for special category data such as health data, a Data Protection Officer where required, and an Information Asset Register and Record of Processing Activities. If you access patient data or NHS systems, you also need DSPT Standards Met or Exceeded for the current or previous year. Contact us for advice on data protection.

DTAC asks for a valid Cyber Essentials certificate. If your product is accessed over the internet, such as a website, mobile app or SaaS product, you also need the summary report of an external penetration test from the last 12 months. It must cover the OWASP Top 10 and show no vulnerabilities scoring 7.0 or above on CVSS. You also confirm that your software follows the Software Security Code of Practice and that you have a plan for multi-factor authentication. Cyber Essentials Plus isn’t required, but some buyers ask for it, and if you access patient data or NHS systems you also need to meet the Data Security and Protection Toolkit (DSPT).

Technologies in health and social care should work together, in terms of hardware, software and the data they hold, especially where they interface with clinical record systems. APIs should follow the Government Digital Service Open API Best Practices, be documented and freely available, and give third parties reasonable access to integrate. Some NHS trusts ask for integration before a pilot. To pass DTAC, you list and justify the interoperability standards your product uses, explain how patients are correctly identified and data stays accurate when you integrate with other systems, and, if patients use your product directly, use NHS login or explain how you authenticate them securely. Make sure your answers are easy for the trust’s assessors to understand. Contact us for advice on interoperability.

Usability and accessibility are about making sure everyone can use your product, whatever their physical, mental health, social, cultural or learning needs, and whether it’s for the public or staff. That includes people who don’t have internet access or lack the skills or confidence to use it. DTAC asks for your user journeys, confirmation that you’ve considered the Accessible Information Standard, and whether your web or mobile app meets WCAG 2.2 AA, or your plan and timeline to get there. This section doesn’t decide whether you pass, but buyers use it to compare products, and UK Government policy expects digital public services to meet WCAG 2.2 AA.