Clinical safety and assurance
The DTAC (Digital Technology Assessment Criteria) explained
The Digital Technology Assessment Criteria (DTAC) is NHS England's framework for care commissioners and providers to assure digital health technology products before they buy and deploy them. It covers five areas: clinical safety, data protection, technical security, interoperability, and usability and accessibility. Manufacturers keep a completed DTAC form for each product version and provide it on request.
What changed in 2026
NHS England reviewed DTAC in 2024 with industry. As of February 2026 it introduced a new form with 25% fewer questions, de-duplicated against the Data Security and Protection Toolkit and the medical device pre-acquisition questionnaire, with clearer guidance and a scope aligned with NICE on software-based digital health technologies. The updated form came in on 24 February 2026, and the previous version should not be used from 6 April 2026. The guidance now lives on NHS England Digital's site.
What DTAC covers, and what it doesn't
DTAC applies to digital health technology (DHT) products as NICE defines them: software, including software as a service and web or mobile apps, used by patients, clinicians or staff to improve health outcomes or how services are provided or managed. NHS England's examples include AI clinical decision support, self-management apps, and software that helps the system run more efficiently or helps staff manage time, staffing or resources.
It isn't meant for general-purpose software that happens to be used in healthcare (a generic HR or finance system) or for firmware and software embedded in hardware such as a CT scanner. Where a DHT is sold with the manufacturer's hardware as one system, the DCB0129 documentation in DTAC section C1 must cover the combined system.
Who assesses each section
| Section | Accountable officer (examples) | Subject matter expert |
|---|---|---|
| C1 Clinical safety | CCIO, CNIO, executive nurse or clinician | Clinical safety officer or engineer |
| C2 Data protection | Data protection officer | IG officer or manager |
| C3 Technical security | CISO, CTO | Technical architect, cyber security manager |
| C4 Interoperability | CIO, CTO, CCIO or CNIO | Technical architect, business analyst, informatician |
| D1 Usability and accessibility | CTO, CIO | Technical architect, business analyst |
NHS England asks buyers to use its standard form rather than their own versions, to add any extra requirements as separate requests, and to assess products offered on a trial basis too, recording the product, version and result.
Other points buyers miss
- A product a trust builds in house must meet DTAC's standards; if the trust then offers it to other organisations, it is acting as a manufacturer and should keep DTAC documentation.
- A lead organisation buying for others assesses the product, but each receiving organisation keeps its own duty.
- Suppliers may be asked to attach a DPIA or the pre-acquisition questionnaire, using the central templates.
- NHS England doesn't currently endorse any third-party DTAC certification scheme, and is exploring a certification scheme of its own.
What it does not mean
- DTAC isn't a certificate. NHS England endorses no third-party DTAC certification; a buyer assesses a completed form.
- It doesn't replace other approvals. Products may still need medical device certification or ICO registration, and DTAC works alongside the DSPT and DCB0129/DCB0160.
- Passing DTAC doesn't mean a product is right for you. NHS England says buyers must still judge value for money and fit for their context.
Where Thalix fits
Thalix doesn't have a completed DTAC assessment to show you today, and we won't imply otherwise. What the code does give a DTAC reviewer: clinical data held as FHIR R4 and HL7 v2 in and out (C4); TLS 1.2/1.3 with mutual TLS, token roles, secrets held as references, PHI kept out of logs and audited raw-message reveals (C3); data that stays on your own servers, with a hash-chained audit of every read (C2); and agents that can't make clinical decisions, with changes reviewed by your clinical safety officer (C1).
Thalix is at pilot stage. Demos run on synthetic data, and a hospital deployment needs its own clinical safety case, information governance approval and security review. We don't claim any certification or assessment result the product doesn't have.
Questions people ask
Is DTAC mandatory?
NHS England says care commissioners and providers must ensure the digital health products they use meet national standards, and should use a completed DTAC form from the manufacturer when assessing them. Manufacturers must keep an up-to-date form for each product version and provide it on request.
When did the new DTAC form come in?
NHS England introduced the updated form on 24 February 2026, and the previous version should not be used from 6 April 2026.
Is there an official DTAC certification?
No. NHS England says it doesn't currently endorse any third-party certification schemes for DTAC, and is exploring a certification scheme for digital health technologies.
Sources
Each source below is an official page, read and checked in October 2026. Where a page and this guide differ, the official page wins.
- Digital Technology Assessment Criteria (DTAC) guidance for buyers and suppliers NHS England Digital · checked October 2026
- How DTAC works NHS England Digital · checked October 2026
- Conduct a DTAC assessment NHS England Digital · checked October 2026
- DTAC in relation to other regulatory and assurance processes NHS England Digital · checked October 2026
General information only, written for hospital digital, IT, operations and clinical safety teams. It isn't legal, regulatory, information governance or clinical safety advice, and it doesn't replace your own organisation's processes or the official guidance linked above.