Skip to main content

NHS & HealthTech Assurance

NHS DTAC Readiness & Assurance

Senior support for digital health manufacturers who need a complete, current DTAC form an NHS buyer can test — backed by real evidence across all five DTAC areas, not answers written for the form.
DTAC evidence path
  1. Current state
  2. Evidence gaps
  3. Remediation
  4. Readiness
  5. Readiness challenge

  • 18+ yearsSenior practitioner experience

  • Published NHS & HealthTech evidenceRelated engagements: accuRx · UCL · NHS England

  • Global audit deliveryInternational assurance and audit experience

  • ISO/IEC 27001:2022Certified information-security management

Readiness and evidence preparation for one product, with a separate senior challenge before NHS buyer review — the buyer still carries out the DTAC assessment.

What DTAC is — and what it is not

The Digital Technology Assessment Criteria (DTAC) are an NHS England assessment framework that care commissioners and providers use when assuring digital health technology products. DTAC covers five areas: clinical safety, data protection, technical security, interoperability, and usability and accessibility. Manufacturers keep an up-to-date DTAC form and supporting documents for each product version and provide them on request; the buyer carries out the assessment. A refreshed form, with fewer questions and less duplication with the DSPT and the medical-device pre-acquisition questionnaire, replaced the previous version from 6 April 2026. DTAC applies alongside, not instead of, other requirements such as medical-device certification or ICO registration.

Where are you now?

Find your starting point

Select the stage that describes your product today. Each shows what happens, who owns what and the typical output.

Current state

What happens
We confirm the product, version and intended use in scope and baseline what DTAC evidence already exists.
What IG-Smart does
Scopes the review and gathers existing documents across the five DTAC areas.
What the organisation owns
Access to product documentation, owners and the current DTAC form, if one exists.
Typical output
Agreed scope and evidence inventory.
Likely starting point
Gap analysis — if you are not sure how ready you are.

Evidence gaps

What happens
Existing answers are tested against the evidence behind them, area by area.
What IG-Smart does
Identifies where evidence is missing, out of date or broader than the answer claims.
What the organisation owns
Confirming facts about the product and how it is deployed.
Typical output
Evidence gap register with buyer impact and named owners.
Likely starting point
Gap analysis — if answers exist but evidence has not been tested.

Remediation

What happens
Gaps are closed in priority order against the buyer deadline.
What IG-Smart does
Advises on and helps prepare the evidence needed; tracks progress.
What the organisation owns
Decisions, technical changes and sign-off of all documents and answers.
Typical output
Prioritised remediation plan and updated evidence.
Likely starting point
Readiness & remediation — if gaps are already known.

Readiness

What happens
The DTAC form is brought together with current evidence for each answer.
What IG-Smart does
Helps structure a complete, current form and evidence pack for the product version.
What the organisation owns
The final DTAC form, which remains the manufacturer’s.
Typical output
Buyer-ready DTAC form and evidence map.
Likely starting point
Readiness & remediation — if the form needs bringing together.

Assurance readiness

What happens
A senior practitioner challenges each answer before buyer scrutiny.
What IG-Smart does
Provides a readiness challenge — never over work IG-Smart managed or delivered; independent assurance is scoped separately where required.
What the organisation owns
Acting on findings. The NHS buyer still carries out the DTAC assessment.
Typical output
Readiness challenge log with resolutions.
Likely starting point
Readiness challenge — if you think you are ready.

After stage 05, the NHS buyer carries out the DTAC assessment. Any independent assurance is scoped separately and never covers work IG-Smart managed or delivered. Every engagement is one defined scope at the approved investment — the starting point changes where work begins, not the quotation.

When organisations engage us

Signals that it is time to act

  1. An NHS buyer has asked for a completed DTAC form

  2. DTAC answers exist but supporting evidence is thin

  3. There is no named Clinical Safety Officer or clinical safety case

  4. A DPIA has not been completed for the product

  5. Security testing evidence is out of date

  6. Your DTAC form predates the refreshed April 2026 version

What the service covers

Outcomes the service is built to deliver

Clinical safety
Readiness of your DCB0129 clinical risk management evidence, hazard log and Clinical Safety Officer arrangements behind the clinical-safety answers.
Data protection
DPIA, lawful basis, transparency, DPO arrangements and data-flow evidence for the product as deployed.
Technical security
Review of the security evidence your answers rely on, including testing results and your DSPT position, with gaps prioritised.
Interoperability
Clarity on the standards, APIs and integration evidence the product relies on, and how they are documented.
Usability and accessibility
A check that usability and accessibility answers are evidenced rather than asserted.
Readiness challenge
Senior challenge of every answer against its supporting evidence before the form reaches a buyer, kept separate from any work we prepared.

How we deliver

Assess → Build → Manage → Assure → Improve

  1. Assess

    Confirm product scope and baseline evidence across the DTAC areas.

  2. Build

    Agree owners and a prioritised evidence and remediation plan.

  3. Manage

    Track remediation and evidence production to the buyer deadline.

  4. Assure

    Challenge each response against its evidence before buyer review.

  5. Improve

    Set review triggers so answers stay accurate as the product changes.

Scope boundaries

Included, and separately scoped where required

Included in the core service

  • Readiness assessment across all five DTAC areas
  • Evidence gap register with named owners
  • Prioritised remediation plan
  • Senior challenge of answers before buyer review

Separately scoped where required

  • Acting as your Clinical Safety Officer
  • Penetration testing and technical remediation
  • Building interoperability or integration work
  • Formal accessibility audits
  • Ongoing managed information governance

Sample outputs

Example outputs you may receive

Illustrative examples of the reports, registers, dashboards and working records that may be provided, depending on scope. DTAC is not a certification and IG-Smart is not the NHS assessor.

Illustrative output

DTAC Readiness Assessment

Current position

Readiness across the five DTAC areas, with evidence position and blockers.

What it helps you see and do

  • Readiness by DTAC area
  • Evidence position
  • Material gaps
  • Blockers

Likely format

  • IG-Smart branded PDF
  • Evidence pack

Illustrative output

DTAC Evidence Tracker

Evidence readiness

Each requirement, the evidence needed and who is producing it.

What it helps you see and do

  • Requirement
  • Evidence needed and available
  • Owner and status
  • Gap and action

Likely format

  • Spreadsheet / register
  • Evidence pack

Illustrative output

DTAC Remediation Plan

Gap closure

Gaps closed in priority order, by DTAC area.

What it helps you see and do

  • Issue and DTAC area
  • Priority
  • Owner and due date
  • Dependency and status

Likely format

  • Action tracker

Illustrative output

DTAC Readiness Summary

Buyer & executive view

A clear view of submission readiness for leadership and NHS buyer conversations.

What it helps you see and do

  • Readiness by area
  • Unresolved issues
  • Evidence completion
  • Next actions

Likely format

  • IG-Smart branded PDF
  • Evidence pack

Illustrative structure — not a client document. Exact outputs and formats depend on the agreed scope.

Relevant evidence

Related NHS & HealthTech evidence

Selected published engagements demonstrating relevant governance, privacy, assurance and NHS/HealthTech capability. They are not presented as DTAC engagements unless the underlying approved case evidence expressly states that.

  • Named client · Healthcare / NHS

    accuRx

    Retained DPO and NHS IG support

    Retained DPO services · privacy and NHS information-governance support during growth

    View the evidence: accuRx

  • Named client · Higher Education / Research

    UCL

    IG audit, improvement plan, training and physical-security audit

    Helped shape and focus the final DSPT submission

    View the evidence: UCL

  • Named client · Healthcare / NHS

    NHS England

    Strategic data-privacy and data-sharing advisory

    National privacy-by-design framework · multiple national workstreams

    View the evidence: NHS England

Explore all case studies →Request Relevant Evidence →

Your IG-Smart team

Specialist expertise, coordinated around your requirement

Subject-matter expertise is paired with a clear client and programme contact from initial scoping through delivery.

Subject-matter expert

Michael Abtar

CEO and Founder

Governance, risk and assurance specialist with more than 18 years' experience spanning privacy, cyber resilience, AI governance, digital transformation, healthcare and complex regulated organisations.

Experience includes governance and assurance work involving more than 100 million consumer records.

View profile

Subject-matter expert

Himanshu Desai

Strategic Health Informatics Leader & Clinical Safety Officer

Healthcare informatics and clinical safety specialist with extensive experience across NHS, healthcare technology, clinical applications and international health systems.

View profile

Subject-matter expert

Shaista Peart

Senior Data Privacy & Information Governance Consultant

Privacy and information governance specialist advising organisations on data protection, DPO responsibilities and practical governance across healthcare and regulated environments.

View profile

Client & programme contact

Julia Andrade

Head of Client & Programme Success

A key point of contact from prospective-client scoping through programme and project delivery, coordinating practitioners, workstreams and client stakeholders.

View profile

Investment

Starting investment: £7,500 + VAT

Typical investment: £7,500–£10,000 + VAT, depending on scope and existing evidence. One defined-scope engagement; you start at the stage that matches where you are. Scope, deliverables, assumptions and fees are agreed in writing before work begins.

Talk to a Senior Practitioner How engagements & investment work

Stages within one engagement

  • DTAC Gap Analysis — not sure how ready you are: current position and evidence gaps
  • DTAC Readiness & Remediation — gaps known: evidence preparation for buyer review
  • DTAC Readiness Challenge — think you are ready: senior challenge before buyer scrutiny, never over work we managed or delivered
  • The fee reflects scope and existing evidence

Questions

Frequently asked questions

Who carries out the DTAC assessment?

NHS England describes DTAC as an assessment framework used by care commissioners and providers. The buyer carries out the assessment using the manufacturer’s current DTAC form and supporting documents.

Do you complete the DTAC form for us?

No. The form and its answers remain the manufacturer’s, and the NHS buyer carries out the assessment. We help you assess, evidence and challenge your answers so each one can be substantiated.

What changed in the refreshed DTAC?

NHS England published a refreshed form and guidance in early 2026, with fewer questions, less duplication with the DSPT and pre-acquisition questionnaire, and a focus on software-based digital health technologies. The previous form was retired from 6 April 2026. Reviews of some underlying standards, including DCB0129 and DCB0160, are continuing.

How does DTAC relate to DSPT and DCB0129?

DTAC assesses a specific product. The DSPT is organisational assurance used alongside it. DCB0129 (manufacturers) and DCB0160 (deploying organisations) are the clinical risk management standards behind clinical safety. We map where one piece of evidence supports several requirements, so work is not duplicated.

Can you act as our Clinical Safety Officer?

Clinical Safety Officer support is scoped separately. DTAC readiness focuses on whether your clinical-safety evidence will stand up to buyer review.

What if the product changes after the form is shared?

Manufacturers are expected to keep the DTAC form current for each product version. We agree review triggers — new functionality, integrations, AI or deployment context — so your answers stay accurate.

Next step

Need DTAC answers that stand up to NHS buyer scrutiny?

Still defining the requirementTalk to a Senior PractitionerDefined scope, RFP or tenderSubmit a Requirement

Not sure what applies?Find the Right Service