DTAC compliance testing for the NHS means producing evidence, not just answers: the Digital Technology Assessment Criteria is a form you complete, but every claim on it needs testing behind it covering clinical safety, data protection, technical security, interoperability, and usability and accessibility. Buyers in the NHS and adult social care use your completed DTAC to decide whether your product is safe to procure, so weak or untested answers show up as delays, follow-up questions, or a lost deal.
Here is what the current DTAC asks for, and what each area means for your test plan.
What DTAC is, and what it isn’t?
DTAC is the NHS England baseline for digital health technologies. Manufacturers complete the form and keep it up to date for each version of their product. Care providers and commissioners then assess it as part of procurement.
Two things are easy to get wrong:
- It isn’t a certificate. NHS England does not currently endorse any third-party DTAC certification scheme, so be cautious about anyone selling you one. What you hold is your own completed form and the evidence behind it.
- It doesn’t replace other approvals. Depending on what your product does, you may still need medical device certification or registration with the Information Commissioner’s Office.
The version to use now.
NHS England published an updated DTAC form on 24 February 2026, and the previous form should not be used from 6 April 2026. The new version has roughly a quarter fewer questions, removes duplication with the Data Security and Protection Toolkit (DSPT) and the Pre-Acquisition Questionnaire, and aligns its scope with NICE for software-based digital health technologies.
If your team completed a DTAC before April, it’s worth checking you are working from the current form. Always download it at the point of use, as NHS England updates it.
What each area asks for, and what to test?
The form covers five areas. The wording of the questions is NHS England’s, so work from the current form itself; the testing view below is how we approach the evidence.
Clinical safety. DTAC supports compliance with DCB0129, the clinical risk management standard for manufacturers. The evidence is a managed safety case: hazard log, risk assessment, and a named Clinical Safety Officer. The testing job is verifying that each risk control actually works in the product. A mitigation written in the hazard log but never tested is a gap an assessor can find. Note that the requirement for Clinical Safety Officers to complete NHS Digital training has been removed in the new version, but the officer must still be a registered clinician with appropriate competence in clinical risk management. DCB0129 and DCB0160 are both under review, so expect change.
Data protection. This covers your data protection impact assessment, data flows, and the DSPT where your product accesses NHS systems or patient data. The testing job is proving the controls described in those documents exist in the build: access restrictions, retention and deletion behaviour, consent handling, and that data only travels where your data-flow diagram says it does.
Technical security. This is where most HealthTech teams expect scrutiny, and it’s the area where independent evidence carries the most weight. In practice buyers commonly look for evidence such as Cyber Essentials, DSPT completion and recent penetration testing. The sources we reviewed do not set a new penetration-testing mandate in the 2026 update, so check the current form and your buyer’s own requirements for what they will ask to see. Our security testing work covers the technical side: penetration testing, vulnerability scanning, authentication and access control, and encryption in transit and at rest.
Interoperability. If your product exchanges data with NHS systems or other health technology, you’ll need to show it does so using the standards it claims to support. The testing job is conformance and integration testing against those standards, with real message and API behaviour rather than a specification read-through. Note that some device-oriented standards may no longer apply to software-only products.
Usability and accessibility. The evidence here covers how the product has been designed and tested for the people who will use it, including users with disabilities. The testing job is accessibility testing with assistive technology and usability testing with representative users. We cover the accessibility standard in more detail in our guide to WCAG 2.2 requirements, and the same principles apply to patient-facing and clinician-facing health apps.
Where HealthTech teams struggle?
In our experience of DTAC compliance testing for NHS-bound products, the same gaps come up repeatedly:
- Treating DTAC as paperwork. Answers are drafted by whoever has time, and nobody checks that the product behaves the way the answers say.
- Clinical safety tested late. Hazards are logged at the start and mitigations are never verified before submission.
- Out-of-date evidence. A penetration test from two releases ago, or a form completed for a previous version of the product.
- Accessibility left to the end. Found during procurement, when fixing it is slowest and most expensive.
- Unclear ownership. Each area has its own accountable officer and subject-matter expert, and when nobody owns an area, its answers go stale.
None of these need exotic tooling. They need a test plan that is mapped to the form and rerun when the product changes.
Mapping DTAC to a test plan?
A practical way to work is to treat each area as a workstream with its own evidence pack:
- List the questions for each area on the current form and who owns the answer.
- Identify the evidence each answer relies on: a test report, a scan, a conformance result, a signed-off safety case.
- Test what is missing or out of date, starting with the areas buyers press hardest: technical security and clinical safety.
- Version the evidence against the product release it covers, so it can be reused or refreshed when the product changes.
- Rerun on significant change, because the form needs to be kept current for each version of the product.
This also pays off beyond the NHS. The same evidence supports other regulated buyers and the wider range of solutions we provide for HealthTech and other regulated sectors.
The practical starting point
If you’re preparing for an NHS procurement, start DTAC compliance testing with a gap review: take the current DTAC form, mark which answers have recent independent test evidence behind them, and which rely on assertion alone. Fix the technical security and clinical safety gaps first, then accessibility, then the remainder.
It is much cheaper to find those gaps in your own review than in a buyer’s.
Selling into the NHS and need DTAC evidence that stands up to scrutiny? We test against the areas buyers actually press on. Get in touch.