NHS DTAC: What the 2026 Form Asks Health App Suppliers

NHS DTAC (the Digital Technology Assessment Criteria) is the set of questions an NHS trust, ICB or care provider asks before it buys or pilots your digital health product. It covers clinical safety, data protection, technical security, interoperability, and usability and accessibility. NHS England replaced the form in March 2026 with a version that has 25% fewer questions, and buyers had to move to it by 6 April 2026.

This guide is for founders and product owners who are about to sell into the NHS for the first time: a health-tech startup, a physio or rehab app, a digital mental health tool, or a wellness product being pitched to an NHS service. It explains what the current form asks, what evidence sits behind each answer, which parts take longest, and the order we'd do them in. Everything below was checked against the sources listed at the end on 12 November 2026.

A note on what's out of date. Several of the pages that rank for "DTAC" were written before the 2026 update. One widely read supplier guide from December 2025 still says the review is ongoing and "we don't currently know the exact changes". The changes are now published, and they matter, because some questions you may have prepared for have been merged into other NHS assurance processes.

What changed in the 2026 DTAC form

NHS England published the updated form and guidance on 4 March 2026, through the NHS Innovation Service. The announcement lists four changes:

1. About a quarter of the questions were removed.
2. Questions that duplicated the Data Security and Protection Toolkit (DSPT) and the pre-acquisition questionnaire were taken out, so you aren't asked the same thing three times.
3. The guidance now explains more clearly what DTAC is for, what's in scope and how to complete it.
4. The scope was aligned with NICE, so DTAC now focuses on software-based digital health technologies.

The old form "should now be retired", and the full transition was due by 6 April 2026. If a trust sends you the previous version, it is worth asking whether they meant to. The current form and buyer/supplier guidance are on NHS England's DTAC page.

The practical effect for a supplier is that DTAC leans more on evidence you already hold elsewhere, especially your DSPT submission. If your DSPT is weak or missing, the shorter form doesn't save you work. It moves the work to the toolkit.

Is DTAC mandatory?

It depends on who you ask, and that gap causes a lot of confusion.

The NHS's own AI and Digital Regulations Service labels DTAC as best practice: not a legal requirement, but "an essential activity", and it says technology needs to meet the standards to be used in NHS and social care. Some assessment companies describe it as mandatory for anything an NHS organisation procures.

In practice the difference rarely helps you. There is no law that forces you to fill in the form, but the buyer uses it as their due-diligence baseline, and a trust's information governance or clinical safety lead can stop a pilot until it's done. Treat it as required if you want NHS revenue.

Two other points people get wrong:

• There is no DTAC certificate. There is no central body that approves your DTAC. You complete the form, attach evidence, and send it to each NHS buyer, who reviews it. A consultancy can check it for you, but its sign-off is not an NHS approval.
• Several items inside DTAC are legal requirements in their own right. UK GDPR, the ICO data protection fee and medical device regulation apply whether or not anyone sends you a DTAC form. DTAC asks you to show you've met them.

Does your product need a DTAC at all?

The 2026 update narrowed DTAC to software-based digital health technologies, in line with NICE's scope. A useful rule of thumb from the LFH Regulatory guide: purely administrative systems such as payroll are generally outside it, and software embedded in a hardware device may be assessed differently.

For the businesses we work with, this is how it usually splits:

If you aren't sure, the quickest check is to ask the NHS contact whether DTAC is part of their procurement, and which version of the form they use. NHS England's DTAC team can be reached at england.dtac@nhs.net, as listed on the AI and Digital Regulations Service page.

What the five DTAC sections ask for

The NHS guide groups the criteria into five core areas. The form itself also asks about your value proposition and a few general points about how you build. The best way to see the real questions is a completed form that a supplier has published. Concentric Health's public DTAC, last updated 22 May 2026, follows the current structure, and the questions below come from it.

1. Clinical safety

The form asks:

• Does the product qualify as software or AI as a medical device under the UK Medical Devices Regulations 2002?
• Does it provide electronic information that influences, supports or manages real-time direct patient care?
• Have you carried out clinical risk management that complies with DCB0129?
• Where is your clinical risk management system, your clinical safety case report and your hazard log?
• Who is your Clinical Safety Officer, and what are their profession and registration details?

DCB0129 is the NHS clinical risk management standard for manufacturers of health IT. Its core documents are a clinical risk management plan, a hazard log and a clinical safety case report. All three are signed off by a named Clinical Safety Officer (CSO), a registered clinician who has completed CSO training (Assuric). Many startups use a part-time or fractional CSO rather than hiring one.

This section usually takes longest, because it needs a clinician's time and because the hazard log has to reflect the product as it really behaves. You can't write it in a week from a template and expect a trust's clinical safety lead to accept it.

If your product might be a medical device, that question comes first, because the answer changes everything else. The MHRA's software and AI as a medical device guidance starts from your intended purpose, and it has separate guidance for digital mental health technologies. Our post on whether a wellness app is a medical device explains the same claims-driven logic from the US side; the UK test follows the same principle that what you claim determines what you are.

2. Data protection

The form asks for:

• Your ICO registration
• Your DSPT status
• Whether the product processes personal data
• Your Data Protection Impact Assessment (DPIA), or how you support the buyer's DPIA
• Your transparency information (privacy notice) and terms
• Where data is stored and processed, and if outside the UK, how that is lawful

Most organisations that process personal information must pay the ICO's data protection fee under the Data Protection (Charges and Information) Regulations 2018, unless they are exempt.

The DSPT is an online self-assessment against the National Data Guardian's 10 data security standards, and every organisation with access to NHS patient data and systems has to use it. The 2026-27 version (v9) was published on 2 October 2026. Because the 2026 DTAC removed questions that overlapped with the DSPT, a published, up-to-date DSPT now does more of the work in this section. It's an annual submission, so put the renewal date in your calendar.

On the DPIA: if you are the processor and the NHS organisation is the controller, the DPIA is technically theirs to complete. Concentric's answer is a good model. It says the controller completes it and that the company provides a DPIA template to help. Buyers will appreciate the template.

3. Technical security

The current form keeps this short. It asks for:

• Your Cyber Essentials certificate
• Whether you've signed the Cyber Security Charter for Suppliers to the NHS

Cyber Essentials is the government-backed baseline scheme run by the NCSC with IASME. It checks five technical controls: firewalls, secure configuration, security update management, user access control and malware protection. Basic certification starts at £320 + VAT, priced by the size of your organisation, and Cyber Essentials Plus adds independent technical testing priced by the size and complexity of your network.

Expect the buyer to ask about more than the form does. Guides written for the earlier form list an external penetration test with a remediation plan, multi-factor authentication, patching and vulnerability management, and secure hosting evidence (Assuric). Some of that now sits in the DSPT and the pre-acquisition questionnaire instead of DTAC. A trust's security team will still want it, so have a recent pen test report ready even though DTAC no longer asks for it directly.

4. Interoperability

The questions are about how your product connects to NHS systems:

• Do you expose APIs or integration channels, and are they documented?
• Do your integrations use recognised standards (HL7, FHIR, OIDC for sign-in)?
• Do your APIs follow GDS Open API best practice, and are they openly available to third parties?
• Do you share or receive data with national or local care systems?
• Can you use the NHS number to identify patients, and do you get it from the Personal Demographics Service (PDS) or a local system?
• Do you use NHS login to verify and authenticate users, and if not, how do you authenticate them?

"No" is an acceptable answer to many of these if you explain why. A standalone patient app with no clinical record integration can say so. What hurts you is an integration story you can't document. If you plan to connect to an EPR, our EHR and FHIR integration cost guide covers the work involved.

5. Usability and accessibility

The form asks whether you:

• Understand how the product fits alongside the other systems in a care setting
• Have read the Accessible Information Standard and reflected it in the design
• Test with real users to validate usability
• Meet WCAG 2.2 at level AA or higher, for web and mobile
• Publish an accessibility statement

WCAG 2.2 became a W3C Recommendation on 5 October 2023. Older DTAC guides still quote WCAG 2.1. If your last accessibility audit was against 2.1, check the new success criteria (focus visibility, target size, dragging alternatives and accessible authentication among them) before you answer yes.

Usability is also where earlier guides noted that "working towards" was acceptable on some points, since it was the only scored section. Don't count on that. An honest answer with a date for the fix reads better than a yes you can't back up.

Value proposition and how you build

Outside the five areas, the form asks what the product is for, what it's designed to do, how it's used, and how data flows between it and other clinical systems. It also asks whether you have a multidisciplinary team, work in an agile way and develop the product continuously. NICE's evidence standards framework (last updated August 2022) is the reference for the evidence a buyer expects behind your value claims, and the DTAC scope now follows NICE.

The DTAC evidence pack: what to prepare and who owns it

This is the table we use to plan a first DTAC. It maps each question to the document behind it and the person who usually owns it. The "lead time" column is a hypothetical planning guide for a small team starting from nothing, not a published figure.

Several of these can run at the same time. Clinical safety and the DSPT are usually the critical path, because they depend on people outside engineering.

The order to do it in

If we were starting a DTAC for a client today, this is the sequence:

1. Decide the medical device question. Write the intended purpose statement and get a view on whether you're a medical device. If you are, UKCA marking and MHRA registration come before any NHS sale, and DTAC is the smaller job.
2. Appoint a Clinical Safety Officer. Start the hazard log while the product is still changing, since that's when it's most useful and cheapest to act on.
3. Register with the ICO and start the DSPT. Both are prerequisites for the data protection section, and the DSPT takes the longest of the paperwork.
4. Get Cyber Essentials. Doing the readiness work early often finds configuration problems you'd want to fix anyway.
5. Book the accessibility audit and the pen test once the product is close to the version the trust will use. Testing an early build means paying twice.
6. Write the interoperability and value proposition answers, then fill in the form from the evidence you now hold.
7. Set a review trigger. Update your DTAC whenever a release changes clinical risk, architecture or data flows, and when the DSPT renews.

Mistakes we see founders make

Building first and doing clinical safety at the end. A hazard log written after launch tends to describe the product you meant to build. A trust's clinical safety lead can tell, and you'll be asked to redo it.

Using an old form. If you prepared against the pre-2026 form, some of your answers belong in the DSPT now. Re-map your evidence instead of sending the old form.

Treating a consultancy check as NHS approval. Third-party reviews can help you get ready. They don't replace the buyer's own assessment, and each trust may read the same answer differently.

Hosting or analytics outside the UK without an answer ready. The form asks where data is processed and how transfers are lawful. A third-party analytics SDK that sends events to the US needs an explanation, or removing.

Claiming WCAG compliance from a template. Accessible components don't make an accessible product. Audit the real screens.

How this compares with HIPAA

Many of our clients sell in both the UK and the US. The two regimes work differently. HIPAA is a US law with defined roles and a business associate agreement. DTAC is an NHS buying checklist that points to several UK laws and standards. The engineering underneath overlaps a lot: access control, audit logging, encryption, vendor mapping and incident response. If you have already built to our HIPAA compliance checklist for software, much of the technical evidence for DTAC and the DSPT already exists. What's new for the UK is mostly the clinical safety work under DCB0129 and the NHS-specific integrations (NHS number, PDS, NHS login).

Where Zee Palm fits

We build health and wellness software for health-tech startups and clinics, and since 2017 we've shipped products where clinical safety, data protection and accessibility are designed in from the first sprint. For an NHS-bound product, that means building the audit trail, data flows and accessibility early, producing the technical evidence a DTAC and DSPT need, and working alongside your Clinical Safety Officer and data protection lead (we don't replace either). If you're planning a first NHS pilot, our page for health-tech startups explains how we work, and healthtech MVP cost and timeline helps with the budget.

FAQ

What does DTAC stand for? Digital Technology Assessment Criteria. It is NHS England's baseline for digital health technologies used in health and social care, covering clinical safety, data protection, technical security, interoperability, and usability and accessibility.

Is DTAC a certification? No. There's no central DTAC certificate. You complete the form with evidence and give it to each NHS buyer, who assesses it. Some parts of the evidence, such as Cyber Essentials, are certifications.

How long does DTAC take? It depends on what you already have. One supplier-side guide reports a range from a few weeks to six months or more (Assuric). Clinical safety under DCB0129 and a first DSPT submission are usually the slowest parts.

Do I need DTAC if my app isn't a medical device? Often, yes. DTAC applies to digital health technology bought or used by the NHS whether or not it's a medical device. Its first clinical safety question asks whether you are one, and the evidence expected is heavier if you are.

Does DTAC apply in Scotland and Wales? DTAC is an NHS England framework, but it is used elsewhere. Healthcare Improvement Scotland's evidence framework asks for a completed NHS DTAC as one of its domains. Check with the buyer in each nation.

Sources

All opened on 12 November 2026.

1. NHS Innovation Service, Updated NHS England DTAC form and guidance (4 March 2026)
2. AI and Digital Regulations Service, Using the Digital Technology Assessment Criteria (DTAC)
3. NHS England, Digital Technology Assessment Criteria (DTAC) (form and guidance)
4. Concentric Health, published DTAC (updated 22 May 2026)
5. NHS England, Data Security and Protection Toolkit (2026-27 v9)
6. NCSC, Cyber Essentials overview
7. ICO, Data protection fee
8. MHRA, Software and AI as a medical device
9. W3C, What's new in WCAG 2.2
10. NICE, Evidence standards framework for digital health technologies (ECD7)
11. Healthcare Improvement Scotland, Evidence framework, additional domain 1: DTAC
12. Assuric, What is DTAC? (15 December 2025)
13. LFH Regulatory, NHS DTAC explained (2 June 2026)