NHS DTAC: how to pass the Digital Technology Assessment Criteria (v2.0, 2026)

How to pass NHS DTAC: what each section (C1-C4, D) asks for, the evidence buyers check, what changed in DTAC v2.0 from 6 April 2026, and how long it takes.

Short answer. DTAC (Digital Technology Assessment Criteria) is the form NHS and social care buyers use to check a digital health product before they buy it. You, the manufacturer, complete it; the buyer assesses it. Since 6 April 2026 only DTAC version 2.0 may be used. It covers five assessed areas: clinical safety (DCB0129 and a Clinical Safety Officer), data protection (DSPT, ICO registration, DPIA), technical security (Cyber Essentials, a penetration test in the last 12 months), interoperability (APIs, NHS number, NHS login) and usability and accessibility. The form is quick to complete if the evidence exists; producing the evidence is the real work.

This guide is for healthtech founders, product owners and CTOs preparing to sell to the NHS. It explains what is in scope, what each section asks for and why, what changed in version 2.0, and how to build the product so the answers are straightforward.

Last checked: 2 November 2026.

This is a general guide for suppliers, not legal or regulatory advice. Magora is a software developer, not your regulatory advisor. NHS requirements change from time to time, so check the current version on the official pages linked below before you submit anything.

Does DTAC apply to your product?

DTAC applies to software-based digital health technologies: apps, web applications and software as a service designed or marketed to improve health outcomes or how the health and care system works. That includes patient-facing apps, clinician tools, remote monitoring, booking and referral tools.

It does not apply to generic software that happens to be used in healthcare, such as HR or finance systems, or to firmware embedded in hardware. If your product combines hardware and software, the clinical safety work under DCB0129 has to cover both.

DTAC does not replace other approvals. If your software has a medical purpose, it is also a medical device and needs MHRA registration; DTAC then asks for a pre-acquisition questionnaire (PAQ). Our guide to software as a medical device explains how to tell.

What changed in DTAC version 2.0?

• Published 24 February 2026, mandatory from 6 April 2026: the previous form should not be used after that date.
• About 25% fewer questions, with duplication against the DSPT and the PAQ removed.
• Scope aligned with NICE and its evidence standards framework for software-based digital health technologies.
• No NHS-specific CSO training requirement. The named Clinical Safety Officer no longer has to have completed NHS England's training, though suitable training is still strongly recommended.
• More change is coming. NHS England says it will update DTAC again when the review of DCB0129 and DCB0160 concludes and as medical device rules change.

What each DTAC section asks for

Based on the NHS England DTAC pages and the DTAC v2.0 form. Download the form from NHS England at the time you complete it, as details are updated.

C1 clinical safety: the section that takes longest

If your product provides information that influences, supports or manages the direct care of patients, you must show compliance with DCB0129, or justify why it does not apply, and the buyer can challenge that justification. That means:

• a named Clinical Safety Officer: a registered clinician with training in clinical risk management, who can be outsourced;
• a clinical risk management system and plan;
• a Hazard Log covering every identified hazard, its impact, controls and residual risk;
• a Clinical Safety Case Report signed off by the CSO.

This work is easiest if it runs alongside development rather than after it. Our DCB0129 and Clinical Safety Officer guide covers it in detail.

C2 and C3: data protection and security

These two sections are where engineering decisions show. Buyers want evidence, not promises:

• DSPT. If your product accesses NHS patient data or systems, publish a DSPT status of Standards Met or Exceeded first; assessors check the national database. See our DSPT guide.
• DPIA. Most digital health products need one. It should describe the data fields, flows, security controls, countries involved, sub-processors and retention.
• Data location. Say whether data is stored and processed only in the UK, and justify any transfer outside it.
• Penetration test. An external test in the previous 12 months covering the OWASP Top 10. Book it before launch, not after the buyer asks.
• Cyber Essentials. Certificates last 12 months, so put the renewal in the calendar.

C4 and D: interoperability, usability and accessibility

For C4, use recognised standards and document why. In NHS integrations that usually means HL7 FHIR APIs, the NHS number as the patient identifier, the Personal Demographics Service and NHS login for patient sign-in. The slowest part is often getting access to a sandbox, so prove the hardest integration early.

For section D, buyers look for evidence that real users were involved and that the product meets WCAG 2.2 AA. An accessibility statement and a plan with dates are acceptable if you are not there yet.

How long does DTAC take, and what does it cost?

The DTAC form is free to download and there is no official timescale. If the evidence already exists, completing the form takes days. If it does not, the timeline is set by the slowest items:

Third-party fees vary by provider, so get quotes. For the build itself, Magora's published bands apply:

Rates behind the bands: from £49 an hour per developer, and £65–£70 an hour for a full team with QA and product ownership. Source: Magora UK software development pricing, 2 November 2026. Figures exclude VAT.

How to build a product that passes DTAC

1. Write the intended purpose in week one. It decides whether you are a medical device and how much clinical safety work you need.
2. Start the hazard log with the backlog and review it at the end of every sprint.
3. Design for audit: role-based access, MFA, audit trail on every record, encryption, UK or EU hosting.
4. Prove integrations early with NHS login and the systems you must connect to.
5. Keep a DTAC pack per release: the manufacturer must keep an up-to-date form and evidence for each product version.

That is how we work at Magora on health products: the evidence is produced alongside the code. For the full picture of NHS requirements, see NHS software compliance: DTAC, DCB0129 and DSPT.

Preparing a product for NHS buyers? Send us a brief: we will build a free working prototype of the core journey in 5–10 working days, then scope integrations, hosting and DTAC evidence in Discovery. More about our healthcare software development.

Frequently asked questions

What is DTAC?

The Digital Technology Assessment Criteria is NHS England's baseline for assuring digital health technologies. The manufacturer completes a standard form, and the NHS or social care organisation buying the product assesses it before purchase and deployment.

What is the current version of DTAC?

DTAC form version 2.0, published on 24 February 2026. The previous form should not be used from 6 April 2026. Version 2.0 has about 25% fewer questions and removes overlap with the DSPT and the medical device pre-acquisition questionnaire.

Is DTAC mandatory?

DTAC is the standard framework NHS and social care buyers use to assess digital health products, so in practice you will be asked for the form. The legally binding requirements sit underneath it: clinical safety standards DCB0129 and DCB0160, UK GDPR and, if your product has a medical purpose, medical device regulations.

Who carries out a DTAC assessment?

The buyer: the care provider or commissioner. The manufacturer completes the form and keeps it up to date for each product version; the buyer reviews it as part of its due diligence.

Is there a DTAC certificate?

No. NHS England does not endorse any third-party DTAC certification scheme. It has said it is exploring a certification scheme and a central repository for DTAC documents.

How long does DTAC take?

NHS England does not publish an official timescale. If the underlying evidence exists, filling in the form is quick. The time goes on the evidence: a DCB0129 safety case and hazard log, a DSPT status, a DPIA, Cyber Essentials and a recent penetration test.

Does DTAC still require NHS clinical safety training for the CSO?

No. The earlier requirement for the named Clinical Safety Officer to complete NHS England training no longer stands in DTAC version 2.0, although appropriate training is still expected.

Sources

• NHS England: Digital Technology Assessment Criteria (DTAC)
• NHS England: how DTAC works
• NHS England: conduct a DTAC assessment
• NHS England: DTAC and other regulatory and assurance processes
• NHS Innovation Service: updated DTAC form and guidance (4 Mar 2026)
• NHS England: clinical risk management standards