That is where the NHS DTAC becomes important. It gives NHS organisations a structured way to assess digital technologies across clinical safety, data protection, technical assurance, interoperability, usability, and accessibility. For vendors, it is important to have the right evidence ready when an NHS buyer asks for it.
This blog focuses on the security side of that assessment, including what NHS DTAC asks vendors to show, what evidence is worth preparing before procurement, where common misunderstandings arise, and how to approach the assessment without treating it as a form to complete at the last minute.
Why Does NHS DTAC Matter?
NHS DTAC (Digital Technology Assessment Criteria) matters especially for technical security. A vendor might have penetration testing, vulnerability management, access controls, and security policies in place. Those controls still need to be explained and supported with the right evidence.
For vendors reviewing NHS England cyber security expectations, the assessment is tied to the product being considered, so generic company-level security claims may not tell the NHS enough about the technology it is actually procuring. NHS guidance also requires manufacturers to consider the criteria throughout the product lifecycle and maintain the relevant documentation and evidence.
DTAC 2026 Update
The 2026 update makes this even more relevant for vendors working from older DTAC material. NHS England introduced a refreshed DTAC form in February 2026, reducing the number of questions and removing some duplication with other assurance processes. The previous form was due to be retired by 6 April 2026.
The changes include:
New Digital Technology Assessment Criteria form with reduction of questions by 25%.
Clear guidance explaining the scope, purpose, and way of completing the DTAC assessment
Scope matches NICE guidance and covers software-based digital health technologies under DTAC.
Source: https://qualysec.com/nhs-dtac/