DTAC compliance and readiness.

The NHS Digital Technology Assessment Criteria (DTAC) is a mandatory assurance requirement for digital health technologies operating within, or seeking adoption into, NHS settings. It covers five domains which together form the core criteria used to assess whether a digital health tool is safe, secure, and ready to be used by the NHS.

DPM Digital Health Consultancy supports both sides of a DTAC assessment.

We help manufacturers build the evidence and governance needed to submit and sustain compliance, and we help health organisations independently review the submitted DTAC assessment for compliance and acceptance.

We combine regulatory expertise with clinical safety experience and real-world NHS insight, so DTAC becomes a foundation for sustainable governance.

What we cover.

We provide support across all five of the DTAC domains, working in partnership to ensure clinical safety, data protection, technical security, interoperability, and usability & accessibility.

  • Clinical Safety — DCB0129 alignment and Clinical Risk Management evidence
  • Data Protection — Data Security and Protection Toolkit (DSPT) readiness, Data
  • Protection Impact Assessment (DPIA) development and review
  • Technical Security — Cyber Essentials / Cyber Essentials Plus, penetration testing evidence review
  • Interoperability — review of API evidence and NHS integration alignment
  • Usability & Accessibility — WCAG 2.1 AA assessment and remediation guidance

Support for manufacturers.

We support manufacturers end-to-end across every DTAC domain — from baseline gap assessment through evidence development to submission readiness and ongoing compliance maintenance. Our approach is proportionate to your organisation’s maturity and delivery timeline, not a one-size-fits-all checklist.

We can also act on your behalf in communication with the deploying NHS or health organisation, supporting the review of your submission from their side of the table and fielding queries or clarification requests as they arise.

That means fewer delays caused by ongoing queries, and a more coherent, defensible evidence set going into procurement.

Includes:

  • Baseline and gap assessment against DTAC criteria
  • Penetration testing evidence review and remediation prioritisation
  • Full DTAC evidence file and questionnaire completion across all five sections
  • Submission readiness review and post-submission compliance maintenance

Support for health organisations.

Where you’re on the receiving end of a DTAC submission from a manufacturer or supplier, we provide independent review and reporting, giving your team clarity on what has been submitted. Is it appropriate, complete, and defensible before you rely on it

Includes:

  • Review of manufacturer DTAC submissions against the five domains
  • Reporting on appropriateness, completeness, and compliance gaps
  • Identification of residual risk and areas requiring further assurance or evidence
  • Support engaging with the manufacturer to close identified gaps
  • Advice on how DTAC findings should inform your own DCB0160 and clinical risk management position

Why DPM?

Our DTAC work is led by experienced Clinical Safety Officers (CSOs) and regulatory specialists with extensive NHS experience. We understand how DTAC’s five domains interact with wider obligations like DCB0129, DCB0160, and UK MDR — because we work across all of them.

We treat DTAC as the foundation of a sustainable compliance position. Whether you’re submitting or reviewing, our role is to give you proportionate, evidence-based assurance and to be clear about residual risk.

What our clients say.

What our clients say.

Get clarity on your DTAC position.

Book a call to discuss your submission, your risk profile, and what you need.