Skip to content
Introduction
Addressing the NHS Digital Technology Assessment Criteria can feel overwhelming, but it doesn’t have to be. As an enabling framework for digital technology suppliers to the NHS, it helps businesses of all sizes understand the minimum standards of compliance and governance required to work effectively with healthcare services.
Based on our experience working with businesses of all sizes to develop ‘NHS Ready’ documentation, our Commercial Director, Ryan Palmer, has pulled together 6 recommendations for businesses looking to address or maintain compliance with the NHS DTAC.
What is the NHS DTAC?
First deployed in 2021 by NHSX, and later revised in March 2026 following extensive industry and supplier engagement, the DTAC is the national baseline criteria for Health IT Systems which will be used to support the UK’s health and social care system. Encompassing many statutory, regulatory and policy requirements which apply to the UK’s health and social care system, its main focus is on safety and security. It is broken down into 5 key domains; Clinical Safety, Data Protection, Technical Security, Interoperability and Usability & Accessibility.
Some elements of the DTAC apply to the specific product (Health IT System) being assessed whilst others apply to the organisation (developer) which is responsible for the product’s development and maintenance. All requirements need to be maintained over time, particularly as organisations grow and develop and new versions or features are developed and released. It is therefore important to understand which of the compliance activities required by DTAC need to be completed for each product (and each version of a product) and which need to be completed at an organisational level in a way that applies to all products which are being developed, maintained and sold.
Who does it apply to?
There has been some confusion in the supplier community about how DTAC compliance applies to certain products or industries with the criteria only initially being applied to digital health apps. As per the Transformation Directorates website, however:
“All new digital technology should be assessed using the DTAC, even if you are piloting or trialling it. If a developer has multiple products, each one would need to be assessed against the DTAC. Examples of products include: staff-facing and patient-facing digital health tech, health apps, medtech and devices with an associated app, systems, web-based portals and more.”
NHS Transformation Directorate, ‘Products that should be assessed using DTAC’.
How to address the NHS DTAC.
DTAC is not a simple framework to address but is the culmination of several standards and certifications covering a vast array of subject matter. We often see businesses considering the DTAC as a single requirement and not accounting for the many dependencies of each domain.
Based on working with hundreds of companies to become DTAC compliant, we would recommend the following:
1
Treat DTAC as an enabler for your business and product
DTAC has been designed to ensure developers and their products are safe and effective and draws on key legislative and regulatory requirements which support these outcomes. Treating DTAC as a set of criteria your organisation wants to adopt and adhere to, enables you to build and cement value, rather than simply ‘tick a box’ to satisfy the UK’s Health and Social Care sector, which will ensure the process brings maximum value to your business.
2
Perform an Internal or External Gap Analysis
Understanding where there are gaps in your compliance portfolio will help quickly identify the areas requiring the most focus for you to address the DTAC requirements.
3
Address the Mandatory first
There are several mandatory requirements set out in UK law which will need to be in place to do business with the NHS. By ensuring these are priority requirements, manufacturers can provide at a minimum, assurance to prospective customers that they fulfil their statutory obligations.
4
Be proactive
Rushing through a DTAC is a stressful process given its impacts and therefore requires resources from many different areas of a business. By taking proactive steps to identify gaps in your submission and plan activities to meet the requirements, businesses can prevent a hasty submission which is more likely to solicit questions from NHS stakeholders and delay commercial activity.
5
Invest in Expertise
Working with a trusted partner, invest in their expertise to expedite the process of DTAC compliance. This may save you valuable time and resources to be NHS-ready. The DTAC process does not end once the submission is completed.
6
Plan for continuity
DTAC is an ongoing process that requires maintenance throughout the product lifecycle. Ensuring there is a schedule aligned to review and internally audit your DTAC will ensure you’re in a ‘market ready’ position when the request is made from potential customers. Developing a compliance timeline or roadmap to meet the annual expectations can be a simple but highly effective means of ensuring all stakeholders know when investments need to be made in re-certification or resources to complete the necessary activities.
Need help?
Our team of experts have a wealth of experience covering each element of the DTAC and we’ve supported businesses from all over the world at every stage, to address the requirements. Check out our Case Studies page to learn more.
We’re the experts that have your back.
Let us help you find a route from from where you are, to where you need to go. We’re here to help.
