NHS & HealthTech Assurance
NHS DTAC Readiness & Assurance
- Current state
- Evidence gaps
- Remediation
- Readiness
- Readiness challenge
18+ yearsSenior practitioner experience
Published NHS & HealthTech evidenceRelated engagements: accuRx · UCL · NHS England
Global audit deliveryInternational assurance and audit experience
ISO/IEC 27001:2022Certified information-security management
Readiness and evidence preparation for one product, with a separate senior challenge before NHS buyer review — the buyer still carries out the DTAC assessment.
What DTAC is — and what it is not
Where are you now?
Find your starting point
Current state
- What happens
- We confirm the product, version and intended use in scope and baseline what DTAC evidence already exists.
- What IG-Smart does
- Scopes the review and gathers existing documents across the five DTAC areas.
- What the organisation owns
- Access to product documentation, owners and the current DTAC form, if one exists.
- Typical output
- Agreed scope and evidence inventory.
- Likely starting point
- Gap analysis — if you are not sure how ready you are.
Evidence gaps
- What happens
- Existing answers are tested against the evidence behind them, area by area.
- What IG-Smart does
- Identifies where evidence is missing, out of date or broader than the answer claims.
- What the organisation owns
- Confirming facts about the product and how it is deployed.
- Typical output
- Evidence gap register with buyer impact and named owners.
- Likely starting point
- Gap analysis — if answers exist but evidence has not been tested.
Remediation
- What happens
- Gaps are closed in priority order against the buyer deadline.
- What IG-Smart does
- Advises on and helps prepare the evidence needed; tracks progress.
- What the organisation owns
- Decisions, technical changes and sign-off of all documents and answers.
- Typical output
- Prioritised remediation plan and updated evidence.
- Likely starting point
- Readiness & remediation — if gaps are already known.
Readiness
- What happens
- The DTAC form is brought together with current evidence for each answer.
- What IG-Smart does
- Helps structure a complete, current form and evidence pack for the product version.
- What the organisation owns
- The final DTAC form, which remains the manufacturer’s.
- Typical output
- Buyer-ready DTAC form and evidence map.
- Likely starting point
- Readiness & remediation — if the form needs bringing together.
Assurance readiness
- What happens
- A senior practitioner challenges each answer before buyer scrutiny.
- What IG-Smart does
- Provides a readiness challenge — never over work IG-Smart managed or delivered; independent assurance is scoped separately where required.
- What the organisation owns
- Acting on findings. The NHS buyer still carries out the DTAC assessment.
- Typical output
- Readiness challenge log with resolutions.
- Likely starting point
- Readiness challenge — if you think you are ready.
After stage 05, the NHS buyer carries out the DTAC assessment. Any independent assurance is scoped separately and never covers work IG-Smart managed or delivered. Every engagement is one defined scope at the approved investment — the starting point changes where work begins, not the quotation.
When organisations engage us
Signals that it is time to act
- An NHS buyer has asked for a completed DTAC form
- DTAC answers exist but supporting evidence is thin
- There is no named Clinical Safety Officer or clinical safety case
- A DPIA has not been completed for the product
- Security testing evidence is out of date
- Your DTAC form predates the refreshed April 2026 version
What the service covers
Outcomes the service is built to deliver
- Clinical safety
- Readiness of your DCB0129 clinical risk management evidence, hazard log and Clinical Safety Officer arrangements behind the clinical-safety answers.
- Data protection
- DPIA, lawful basis, transparency, DPO arrangements and data-flow evidence for the product as deployed.
- Technical security
- Review of the security evidence your answers rely on, including testing results and your DSPT position, with gaps prioritised.
- Interoperability
- Clarity on the standards, APIs and integration evidence the product relies on, and how they are documented.
- Usability and accessibility
- A check that usability and accessibility answers are evidenced rather than asserted.
- Readiness challenge
- Senior challenge of every answer against its supporting evidence before the form reaches a buyer, kept separate from any work we prepared.
How we deliver
Assess → Build → Manage → Assure → Improve
Assess
Confirm product scope and baseline evidence across the DTAC areas.
Build
Agree owners and a prioritised evidence and remediation plan.
Manage
Track remediation and evidence production to the buyer deadline.
Assure
Challenge each response against its evidence before buyer review.
Improve
Set review triggers so answers stay accurate as the product changes.
Scope boundaries
Included, and separately scoped where required
Included in the core service
- Readiness assessment across all five DTAC areas
- Evidence gap register with named owners
- Prioritised remediation plan
- Senior challenge of answers before buyer review
Separately scoped where required
- Acting as your Clinical Safety Officer
- Penetration testing and technical remediation
- Building interoperability or integration work
- Formal accessibility audits
- Ongoing managed information governance
What you receive
Outputs you can picture before you engage
Illustrative structure — not a client document
Example content shown for illustration only.
DTAC evidence map
| Area | Evidence held | Status | Owner |
|---|---|---|---|
| Area A | Draft document, not approved | Partly evidenced | Product lead |
| Area B | Assessment completed | Evidenced | Privacy lead |
| Area C | Test report out of date | Gap | Engineering lead |
Relevant evidence
Related NHS & HealthTech evidence
Selected published engagements demonstrating relevant governance, privacy, assurance and NHS/HealthTech capability. They are not presented as DTAC engagements unless the underlying approved case evidence expressly states that.
View the evidence: accuRxNamed client · Healthcare / NHS
accuRx
Retained DPO and NHS IG support
Retained DPO services · privacy and NHS information-governance support during growth
View the evidence: UCLNamed client · Higher Education / Research
UCL
IG audit, improvement plan, training and physical-security audit
Helped shape and focus the final DSPT submission
View the evidence: NHS EnglandNamed client · Healthcare / NHS
NHS England
Strategic data-privacy and data-sharing advisory
National privacy-by-design framework · multiple national workstreams
Service lead
Michael Abtar · CEO and Founder
LLB (Hons), PG.Dip.Law, Cert. DPO
Governance, risk and assurance specialist with more than 18 years' experience spanning privacy, cyber resilience, AI governance, digital transformation, healthcare and complex regulated organisations.
Experience includes governance and assurance work involving more than 100 million consumer records.
View profileInvestment
Starting investment: £7,500 + VAT
Typical investment: £7,500–£10,000 + VAT, depending on scope and existing evidence. One defined-scope engagement; you start at the stage that matches where you are. Scope, deliverables, assumptions and fees are agreed in writing before work begins.
Talk to a Senior Practitioner How engagements & investment work
Stages within one engagement
- DTAC Gap Analysis — not sure how ready you are: current position and evidence gaps
- DTAC Readiness & Remediation — gaps known: evidence preparation for buyer review
- DTAC Readiness Challenge — think you are ready: senior challenge before buyer scrutiny, never over work we managed or delivered
- The fee reflects scope and existing evidence
Questions
Frequently asked questions
Who carries out the DTAC assessment?
NHS England describes DTAC as an assessment framework used by care commissioners and providers. The buyer carries out the assessment using the manufacturer’s current DTAC form and supporting documents.
Do you complete the DTAC form for us?
No. The form and its answers remain the manufacturer’s, and the NHS buyer carries out the assessment. We help you assess, evidence and challenge your answers so each one can be substantiated.
What changed in the refreshed DTAC?
NHS England published a refreshed form and guidance in early 2026, with fewer questions, less duplication with the DSPT and pre-acquisition questionnaire, and a focus on software-based digital health technologies. The previous form was retired from 6 April 2026. Reviews of some underlying standards, including DCB0129 and DCB0160, are continuing.
How does DTAC relate to DSPT and DCB0129?
DTAC assesses a specific product. The DSPT is organisational assurance used alongside it. DCB0129 (manufacturers) and DCB0160 (deploying organisations) are the clinical risk management standards behind clinical safety. We map where one piece of evidence supports several requirements, so work is not duplicated.
Can you act as our Clinical Safety Officer?
Clinical Safety Officer support is scoped separately. DTAC readiness focuses on whether your clinical-safety evidence will stand up to buyer review.
What if the product changes after the form is shared?
Manufacturers are expected to keep the DTAC form current for each product version. We agree review triggers — new functionality, integrations, AI or deployment context — so your answers stay accurate.
Next step