The NHS checks every digital health product against DTAC before buying it. Naq maps the questions for you, fills in the answers from your evidence, and puts it all in one pack.
DTAC with Naq, a three-minute walkthrough of the product · Narrated, with captions
DTAC, the Digital Technology Assessment Criteria, is how the NHS checks a digital health product before buying it. The buyer assesses your answers, and there is no certificate.
Clinical safety, data protection, technical security, interoperability, and usability and accessibility.
When the refreshed DTAC form, with fewer questions, came into use.
You answer it for each product you sell to the NHS.
This is everything DTAC asks of you. For each step, here is what you do and what Naq does.
Create a DTAC instance on your product's scope.
Maps it for you: 58 questions across seven sections, linked to 34 ready-made controls.
Keep your hazard log, with every hazard rated and approved by your Clinical Safety Officer.
Uses your hazard log to back your clinical safety answers.
Keep a register of the personal data your product handles, the lawful basis for each use, and how long you hold it.
Flags any activity that has no lawful basis or retention period.
Add your Cyber Essentials certificate, penetration test and multi-factor sign-in evidence.
Lists what the NHS asks for, and shows which items are done.
Answer the questions that still need you.
Fills in the DTAC form from your evidence. Each answer shows where it came from.
Download the DTAC pack when a buyer asks.
Puts your hazard log, safety case, policies and evidence in one file.
When an NHS buyer asks for your DTAC evidence, download the DTAC pack. It holds your answers and the documents that back them.
One download
An example DTAC pack. The contents depend on your own records.
Publish your DTAC controls and documents on your own Trust Centre. NHS buyers answer their own questions before they ask you.
They see which DTAC controls are in place.
For example your data protection impact assessment, with their name and the reason they need it.
Naq emails them a link straight away, and nothing reaches them until you decide.
Mapped to the 2026 DTAC form.
And 25 more.
And 25 more.
Every document you link as evidence is also checked automatically: its current version must be approved, staff acknowledgements must be complete, and its review date must not have passed.
Built from the Naq control library for DTAC.
See the six steps in your own workspace, with your own product.
