DTAC Version 2: Your Questions Answered
NHS England published an updated Digital Technology Assessment Criteria form on 24 February 2026. If you supply software-based digital health technology to the NHS, the changes affect you directly, and the deadline to transition is 6 April 2026.
We have pulled together the most common questions we are hearing from suppliers to help you understand what has changed, what stays the same, and what you need to do next.
What is DTAC?
The Digital Technology Assessment Criteria is the national baseline framework that NHS organisations use to assess digital health technologies during procurement. It covers five core domains: clinical safety, data protection, technical security, interoperability, and usability and accessibility. Any software-based digital health technology being procured by an NHS body needs a completed and current DTAC form.
DTAC was first introduced in 2021 by NHSX. It replaced the earlier Digital Assessment Questionnaire, which had been criticised for inefficiency and misalignment with NHS priorities.
What has actually changed in Version 2?
NHS England reviewed DTAC throughout 2024, engaging directly with industry and NHS organisations. The changes published in February 2026 fall into three main areas.
First, the form itself has been reduced by 25%. Questions that overlapped with the Data Security and Protection Toolkit and the Pre-Acquisition Questionnaire have been removed. If you were previously answering the same thing in multiple places, that duplication is now gone.
Second, the guidance has been rewritten. NHS England has published clearer documentation explaining what DTAC is for, what falls within its scope, and how both suppliers and buying organisations should complete and use assessments.
Third, the scope has been formally aligned with NICE. DTAC now explicitly focuses on software-based digital health technologies. This confirms what many suppliers had already assumed, but it removes any remaining ambiguity about which products the framework applies to.
Have the clinical safety requirements changed?
Yes, in two ways.
The previous requirement for a named Clinical Safety Officer to have completed training provided by NHS Digital has been removed. CSOs still need to be suitably qualified registered clinicians with clinical risk management experience, but the specific NHS Digital training mandate no longer applies under DTAC V2.
NHS England has also removed elements within the clinical safety sections where DTAC previously overlapped with Medical Device Regulations. Further removal is planned for Class IIa medical devices and above as part of future work.
It is worth noting that the underlying clinical safety standards, DCB0129 and DCB0160, are still under active review. Updates to these standards will feed into DTAC as they happen, so this area will continue to evolve.
When does the old form stop being accepted?
6 April 2026. After that date, the previous version of the DTAC form must not be used. NHS buying organisations should only accept submissions using the new V2 form from that point onwards.
What if I already have a completed DTAC submission under V1?
You will need to update it. The new form is shorter and more focused, but it still needs to be accurate, current, and supported by the right evidence. Treating this as a simple copy-and-paste exercise is not advisable. Take the opportunity to review your evidence pack against the updated question set and make sure everything is aligned.
Do I still need to submit supporting documents alongside the DTAC form?
Yes. As part of your submission, you may be asked to complete and attach additional documentation. This typically includes a Data Protection Impact Assessment and, where your product is a medical device, a Pre-Acquisition Questionnaire. Where both apply, both forms may need to be completed.
NHS England has also been clear that buying organisations should use the centrally produced standardised templates for these documents and should not be creating their own amended versions. If you encounter an NHS body requesting a non-standard form, you are within your rights to push back.
Does DTAC replace other compliance requirements?
No. DTAC sits alongside other required approvals, not in place of them. Products may still need medical device certification, ICO registration, or other regulatory clearance depending on what they do and how they process data. If your product accesses NHS systems or patient data, you will also need a completed DSPT submission.
DTAC is a procurement assurance tool. It helps NHS organisations verify that a product meets baseline safety and security standards. It is not a certification in itself, and passing DTAC alone is not sufficient to sell into the NHS.
Is NHS England planning any further changes?
Several things are in motion.
NHS England is exploring the use of a centralised repository for hosting and maintaining DTAC documentation for individual products. The aim is to reduce the overhead of submitting the same documents to multiple NHS organisations and to drive greater standardisation across the system.
Reviews of DCB0129 and DCB0160 are ongoing, and any changes to these clinical safety standards will be reflected in future DTAC updates.
There are also commitments to set standards for technology used in social care, updates to medical device rules, and further work to simplify how different standards interact with one another.
What is the Innovator Passport and how does it relate to DTAC?
The UK Government announced in July 2025 that it will introduce an Innovator Passport over the next two years. The concept is straightforward: a digital health technology that has been thoroughly assessed by one NHS organisation should be able to roll out to others without repeating the same compliance checks.
The passport will be supported by a new digital platform called MedTech Compass, developed by the Department of Health and Social Care. It will serve as a centralised hub where NHS buyers can find, compare, and evaluate technologies with clear visibility of their evidence and compliance status.
This is still in development, but the direction is clear. DTAC V2 is a step toward that more portable compliance model, and the Innovator Passport is the longer-term destination.
Are NHS organisations still allowed to add their own questions on top of DTAC?
NHS England has stated that care providers should accept the standard DTAC form and should not create their own amended versions covering the same requirements. Where an organisation has additional needs beyond what DTAC covers, those should be included as supplemental requests, not layered on top of or duplicated within the DTAC submission itself.
In practice, this has been a persistent frustration for suppliers. Different trusts and ICBs have historically interpreted DTAC differently, adding extra requirements that created duplication and inconsistency. V2, combined with the stronger guidance, is intended to reduce this, though it remains to be seen how consistently buying organisations adopt the new approach.
What should I do right now?
If you supply digital health technology to the NHS, the immediate priority is clear.
Download the new DTAC V2 form from the NHS Transformation Directorate website. Review the updated question set against your existing evidence and documentation. Identify any gaps and address them before 6 April 2026. If your product is also a medical device, check whether you also need to complete the Pre-Acquisition Questionnaire.
If you hold a completed V1 submission, do not assume it will carry over. Rebuild your submission against the V2 form and make sure your supporting evidence is current.
And if you are earlier in your compliance journey, there is a silver lining. V2 is a lighter framework than its predecessor. Starting now means you are building against the current standard from the outset, rather than retrofitting old work.
How Naq can help
Naq's platform automates the majority of the evidence required for DTAC compliance, covering data protection, technical security, clinical safety, interoperability, and usability. For the areas that cannot be automated, our NHS compliance experts and Clinical Safety Officers guide you through the process.
If you need to update your DTAC submission for V2 or are starting from scratch, book a demo and we will show you how the platform works.
