Free resource · NHS England DTAC

DTAC Evidence Preparation Matrix

Prepare for NHS Digital Technology Assessment Criteria (DTAC) with a practical, interactive guide to organising evidence across clinical safety, data protection, technical security, interoperability, and usability and accessibility.

Explore the five assessment areas, review suggested supporting evidence, identify documents that may need attention and create a printable preparation checklist. The matrix combines references to NHS England guidance with clearly labelled IG-Smart practitioner recommendations.

Open the matrix Official DTAC form (NHS England)

Aligned to DTAC form v2.0

Checked against the official NHS England form (updated 24 February 2026) and DTAC guidance on 15 October 2026.

Your selections stay in this browser tab. They are not saved, sent or recorded, and are cleared when you leave or reload the page.

This independent preparation tool is not the official NHS DTAC form, a complete compliance assessment or evidence of NHS approval. Requirements depend on the product and intended use. Always refer to the current NHS England DTAC form and the assessment requirements of the relevant purchasing organisation.

What NHS England says about DTAC

DTAC is an assessment framework for care commissioners and providers to use when assuring digital health technology products, across five areas: clinical safety, data protection, technical security, interoperability, and usability and accessibility.[S1]
The current form is version 2.0, updated 24 February 2026. Manufacturers must provide it instead of version 1.0 from 6 April 2026 when health and care organisations request it.[F][S2]
Sections C1–C4 are the core criteria a product must meet to pass. Section D (usability and accessibility) provides a scored element to inform choices between products.[F]
Manufacturers keep an up-to-date DTAC form and supporting documents for each product version and provide them on request. Care providers and commissioners carry out the assessment.[S2][S3]
DTAC focuses on software-based digital health technologies. It does not cover general-purpose software such as HR or finance systems, or firmware embedded in hardware devices.[S1][S2]
DTAC applies alongside, not instead of, other requirements such as medical device regulation, ICO registration, the DSPT and DCB0129/DCB0160. NHS England does not currently endorse any third-party certification schemes for DTAC.[S1][S3][S4]

Who does what

Manufacturer or supplier: Completes the DTAC form for the specific product version, keeps it current with supporting documents and provides it on request. A reseller must share it, with manufacturer input if needed.[F][S2]
Care provider or commissioner: Assesses the product using the standard NHS England form, records product, version and result, and re-assesses items that expire or change with upgrades.[S2][S3]
Subject-matter experts: Provide professional oversight for each DTAC section. NHS England gives example roles, shown in each area below; each organisation sets its own approach.[S3]
Deploying organisation: Remains accountable for local deployment, including DCB0160 clinical risk management. Where a lead organisation buys on others' behalf, receiving organisations keep their duty to ensure requirements are met.[F][S3][S4]

Interactive matrix

Five areas, 26 evidence items

Evidence preparation progress: 0 of 26 items marked

0 in place · 0 partly · 0 not yet · 0 not applicable · 26 not marked

Your own record of preparation, not a DTAC result, compliance score or risk rating. "In place" means you report having relevant material; it does not mean IG-Smart or the NHS has reviewed or accepted it. "Not applicable" is available only for conditional items and the practitioner recommendation; it records your own judgement. Unmarked items are not counted.

Highlight evidence that may also support:

Reused evidence must stay current and sufficient for each purpose. DTAC does not replace the DSPT, DCB0160 or medical device requirements.

C1 · Clinical safety

Has the manufacturer managed the clinical risk of this product version?

NHS England says

Responses and documents must relate to the specific product version being assessed. Where the product is part of a health IT system with hardware, DCB0129 documentation must cover the whole system.[F][S2]
DCB0160 applies to the deploying organisation, which must ensure the manufacturer complies with DCB0129 before deployment. A supplier's DCB0129 evidence supports that work but does not replace it.[F][S4]
The previous requirement for the Clinical Safety Officer to complete NHS England training no longer stands. DCB0129 and DCB0160 are under strategic review.[S3][S4]

Example buyer-side roles: accountable officer — Chief clinical information officer, chief nursing information officer, executive nurse or clinician; subject-matter expert — Clinical safety officer or engineer. Each organisation sets its own approach.[S3]

Medical device position and PAQForm C1.1.1–C1.1.2
A recorded answer on whether the product, or any component, qualifies as software or AI as a medical device. If it does, a completed Pre-Acquisition Questionnaire supplied with the form.
DTAC form requirement · if applicableApplies: PAQ required if the product or a component is a medical deviceMay also support: Medical device / PAQ
Status (self-reported): Not marked
DCB0129 applicability decisionForm C1.2–C1.2.1
Whether the product influences, supports or manages direct care in real or near-real time. If you consider it out of scope, a written justification.
DTAC form requirementMay also support: DCB0129
Status (self-reported): Not marked
Clinical risk management systemForm C1.2.2–C1.2.3
A DCB0129-compliant system, adhered to throughout development, showing risks identified and mitigated.
DTAC form requirement · if applicableApplies: Products in scope of DCB0129May also support: DCB0129
Status (self-reported): Not marked
Clinical Safety Case Report and Hazard LogForm C1.2.4
DCB0129-compliant documents for this version, proportionate to its scale and clinical functionality.
DTAC form requirement · if applicableApplies: Products in scope of DCB0129May also support: DCB0129May also support: DCB0160
Status (self-reported): Not marked
Named Clinical Safety OfficerForm C1.2.5
Name, profession and registration details. A suitably qualified and experienced clinician with current professional registration; may be provided through an outsourced arrangement.
DTAC form requirement · if applicableApplies: Products in scope of DCB0129May also support: DCB0129
Status (self-reported): Not marked

Related service: HealthTech Governance & Clinical Safety

C2 · Data protection

Is personal data handled in line with UK GDPR and related law?

NHS England says

Questions covered by the DSPT were removed from DTAC; DTAC asks when the DSPT applies. Suppliers with access to NHS systems or patient data must also complete the DSPT.[F][S4]
The DPIA must give enough detail for the assessing organisation to decide whether it agrees the processing is UK GDPR compliant and whether it accepts any risks. A drafted DPIA alone is not automatically sufficient.[F]

Example buyer-side roles: accountable officer — Data protection officer; subject-matter expert — Information governance officer or manager. Each organisation sets its own approach.[S3]

DSPT: Standards Met or ExceededForm C2.1
Confirmed status for the current year (or previous year if the current return is not yet due), which assessors validate against the DSPT database.
DTAC form requirement · if applicableApplies: Your organisation has or will have access to patient data or NHS systemsMay also support: DSPT
Status (self-reported): Not marked
ICO registration evidenceForm C2.2.1
Evidence of current ICO registration, such as the registration number with its expiry date. Where a statutory exemption from the data protection fee genuinely applies, a documented explanation of that exemption.
DTAC form requirement · if applicableApplies: The product processes personal data, including via sub-processorsMay also support: ICO / UK GDPR
Status (self-reported): Not marked
Product DPIAForm C2.2.2
A DPIA for this product that matches its real data flows and deployment, detailed enough for the buyer to reach its own view.
DTAC form requirement · if applicableApplies: The product processes personal dataMay also support: ICO / UK GDPR
Status (self-reported): Not marked
Transparency informationForm C2.2.3
A copy or link to the privacy information that explains how the product uses personal data.
DTAC form requirement · if applicableApplies: The product processes personal dataMay also support: ICO / UK GDPR
Status (self-reported): Not marked
Terms on use of user dataForm C2.2.4
Product terms, end user licence or equivalent that are clear and fair on privacy and data use — or a reasoned statement that this does not apply.
DTAC form requirement · if applicableApplies: The product processes personal data
Status (self-reported): Not marked
Data location and transfer safeguardsForm C2.2.5–C2.2.6
Where the product and any relevant third-party components store or process data. Where data is transferred internationally, identify the relevant countries and explain the applicable transfer mechanism and safeguards.
DTAC form requirement · if applicableApplies: Safeguards needed only if data is stored or processed outside the UKMay also support: ICO / UK GDPR
Status (self-reported): Not marked

Related service: Data Protection Consultancy

C3 · Technical security

Does this product meet the baseline security criteria?

NHS England says

A valid Cyber Essentials certificate is a C3 pass criterion. Its scope should include all systems and services under the supplier's control that support the product.[F]
Suppliers that have signed the Cyber Security Charter for Suppliers to the NHS skip the remaining C3 questions after C3.2. Cyber Essentials at C3.1 still applies.[F]
The Charter is a voluntary supplier commitment. Signing it is not independent verification of cyber controls, certification, endorsement or procurement approval, and does not waive separate legal or contractual obligations.[F]
Answers must relate to the specific product, not the organisation in general. The form recommends contract terms for problem resolution, incident management and disaster recovery, depending on the product.[F]

Example buyer-side roles: accountable officer — Chief information security officer, chief technology officer; subject-matter expert — Technical architect, cyber security manager. Each organisation sets its own approach.[S3]

Valid Cyber Essentials certificateForm C3.1
In date (certification lasts 12 months) and correctly scoped; assessors validate it against the IASME database.
DTAC form requirement
Status (self-reported): Not marked
Cyber Security Charter decisionForm C3.2
Whether you have signed the Cyber Security Charter for Suppliers to the NHS. If yes, the form skips the questions after C3.2; C3.1 Cyber Essentials still applies. The Charter is a voluntary commitment, not certification or verification of controls.
DTAC form requirement
Status (self-reported): Not marked
External penetration test summaryForm C3.3
Third-party test of the product within the last 12 months, including the OWASP Top 10, showing no vulnerabilities scoring CVSS 7.0 or above.
DTAC form requirement · if applicableApplies: Internet-facing products, unless the Charter has been signed
Status (self-reported): Not marked
Software Security Code of PracticeForm C3.4
Confirmation that development follows the DSIT/NCSC Software Security Code of Practice and its principles.
DTAC form requirement · if applicableApplies: Unless the Charter has been signed
Status (self-reported): Not marked
Multi-factor authenticationForm C3.5–C3.5.1
A plan for MFA on all account types, and MFA enforced on all privileged supplier access to the product.
DTAC form requirement · if applicableApplies: Unless the Charter has been signed; supplier MFA only where you have privileged access
Status (self-reported): Not marked
Logging and reportingForm C3.6
Defined logging and reporting requirements, including audit trails of access.
DTAC form requirement · if applicableApplies: Unless the Charter has been signed
Status (self-reported): Not marked

Related service: Penetration Testing

C4 · Interoperability

Can the product exchange data safely and identify patients correctly?

NHS England says

Interoperability questions apply where the product exposes APIs or integration channels, or exchanges data where patient identity matters.[F]

Example buyer-side roles: accountable officer — Chief information officer, chief technology officer, chief clinical or nursing information officer; subject-matter expert — Technical architect, business analyst, clinical/nursing informatician. Each organisation sets its own approach.[S3]

API standards and documentationForm C4.1–C4.1.3
Listed, justified interoperability standards; APIs that follow GDS Open API best practice and are openly documented — or the basis on which they are made available to third parties.
DTAC form requirement · if applicableApplies: The product exposes APIs or integration channels
Status (self-reported): Not marked
Patient identificationForm C4.2–C4.2.3
Use of the NHS number and validation through the Personal Demographics Service or local records — or an alternative approach that keeps identification and data quality correct.
DTAC form requirement · if applicableApplies: The product exchanges data where patient identity is relevant
Status (self-reported): Not marked
User authenticationForm C4.2.4–C4.2.6
NHS login for patient-facing use, DAPB3051 identity standard support where relevant, or your alternative authentication approach and its data protection measures.
DTAC form requirement · if applicableApplies: Patient-facing products, or public health / adult social care use
Status (self-reported): Not marked
Integration change control
How integration changes are tested, communicated to buyers and reflected in the hazard log. Not a DTAC question — it helps keep answers current between versions.
IG-Smart practitioner recommendationApplies: Where integrations exist, are planned or are materially changedMay also support: DCB0129
Status (self-reported): Not marked

Related service: NHS DTAC Readiness & Assurance

Items needing attention

Mark any item "Partly" or "Not yet" and it will appear here, grouped by DTAC area. 26 items are not yet marked.

Want a senior challenge before your buyer sees it?

We test your DTAC answers against the evidence behind them and help close the gaps. Your form stays yours, and the NHS buyer still carries out the assessment. About DTAC Readiness

Talk to a Senior Practitioner

Sources

[F] NHS England, DTAC form, version 2.0 (opens in a new tab) — Last updated 24 February 2026; read 15 October 2026.
[S1] NHS England, Digital Technology Assessment Criteria (DTAC) guidance for buyers and suppliers (opens in a new tab) — Last edited 21 September 2026; read 15 October 2026.
[S2] NHS England, How DTAC works (opens in a new tab) — Last edited 21 September 2026; read 15 October 2026.
[S3] NHS England, Conduct a DTAC assessment (opens in a new tab) — Read 15 October 2026.
[S4] NHS England, DTAC in relation to other regulatory and assurance processes (opens in a new tab) — Read 15 October 2026.

General guidance for England, not legal, clinical or regulatory advice. NHS England updates DTAC and its underlying standards; download the form from the NHS England DTAC page at the point of use.

DTAC Evidence Preparation Matrix

What NHS England says about DTAC

Who does what

Five areas, 26 evidence items

Has the manufacturer managed the clinical risk of this product version?

Is personal data handled in line with UK GDPR and related law?

Does this product meet the baseline security criteria?

Can the product exchange data safely and identify patients correctly?

Can the people who need the product actually use it?

Items needing attention

Want a senior challenge before your buyer sees it?

Sources