DTAC explained for commissioners

The Digital Technology Assessment Criteria (DTAC) are the national baseline for digital health technology in England. Under version 2.0 they are called “DTAC for Health and Social Care”, so they apply when councils and care providers commission care technology, as well as when NHS organisations do.

Who does what

The maker of the product completes the DTAC form. The commissioner or care provider who will use it assesses the answers. Version 2.0 of the form was last updated on 24 February 2026, and makers have had to use it since 6 April 2026.

What it covers

• A and B: company information and value proposition. Context only, not assessed.
• C1: clinical safety. Pass or fail.
• C2: data protection. Pass or fail.
• C3: technical security. Pass or fail.
• C4: interoperability. Pass or fail.
• D: usability and accessibility. Scored rather than pass or fail.

What changed in version 2.0

• About a quarter fewer questions.
• Less overlap with the Data Security and Protection Toolkit and the pre-acquisition questionnaire.
• Cyber Essentials certification is now required to pass.
• The requirement for the clinical safety officer to have NHS training was dropped.

Clinical safety: DCB0129 and DCB0160

DCB0129 applies to the maker of health IT and DCB0160 to the organisation deploying it. The current versions are DCB0129 v4.2 and DCB0160 v3.2. NHS England consulted on a national review of both standards between 29 June and 11 September 2026, and is expected to make compliance a firmer legal duty once revised versions are published. Ask for the maker’s hazard log and clinical safety case, and the name and registration of their clinical safety officer.

Data protection and the DSPT

Under DTAC 2.0, a supplier with access to patient data or NHS systems must have a Data Security and Protection Toolkit assessment at “Standards Met”. The 2026-27 Toolkit is version 9, with a deadline of 30 June 2027. NHS trusts and similar bodies now complete a version aligned with the National Cyber Security Centre’s Cyber Assessment Framework. Suppliers, councils and social care providers keep the standard version. You can check a supplier’s status on the Toolkit website.

Accessibility

Public sector websites and apps are expected to meet WCAG 2.2 at level AA and to publish an accessibility statement. Ask the maker for their statement and for when the product was last tested.

Practical tips for commissioners

• Ask for evidence behind each answer, not just “yes”.
• Check Cyber Essentials certificates on the IASME certificate search.
• Check whether the product might be a medical device before you rely on DTAC alone (see Is your app a medical device?).
• Reassess when the product changes significantly, not just at purchase.
• Treat DTAC as a baseline. It tells you a product meets minimum standards, not that it will work for your residents or patients.

We prepare DTAC evidence alongside the products we build, and can review another supplier’s submission independently. See our work with the NHS and councils.

Sources

• NHS England: Digital Technology Assessment Criteria (DTAC)
• NHS England: National review of DCB0129 and DCB0160
• NHS England: DCB0129 clinical risk management standard
• Data Security and Protection Toolkit: changes
• GOV.UK: Accessibility requirements for public sector websites and apps

This article is general guidance, correct as of the date shown. It is not legal advice. Rules and frameworks change, so check the sources before relying on it.