# What is DTAC, and what does a digital tool need for NHS use?

> The Digital Technology Assessment Criteria, the 2026 update, and related checks like DSPT, Cyber Essentials and DPIAs.

URL: https://theautismkit.com/guides/nhs-dtac
By The Autism Kit team · Updated 2026-09-27

**Short answer:** DTAC (Digital Technology Assessment Criteria) is the NHS baseline for assessing digital health technologies, like apps and platforms, before pilots or procurement. It covers clinical safety, data protection, technical security, interoperability, and usability and accessibility. An updated DTAC form replaced the previous version from 6 April 2026. NHS buyers may also ask about the DSPT, Cyber Essentials and a data protection impact assessment.

**Key takeaways**
- DTAC is the **NHS baseline** for assessing digital health technologies.
- It covers **clinical safety, data protection, security, interoperability** and **usability**.
- An **updated form** replaced the old one from **6 April 2026**.
- Buyers may also ask for **DSPT**, **Cyber Essentials** and a **DPIA**.

## What is DTAC?

The Digital Technology Assessment Criteria bring together legislation and good practice into a baseline that NHS organisations use when assessing digital health technologies.[1] The core areas are:

- Clinical safety
- Data protection
- Technical security
- Interoperability
- Usability and accessibility

## What changed in 2026?

An updated DTAC form and guidance replaced the previous version from **6 April 2026**, with clearer guidance on scope, pilots and multi-organisation procurements.[1]

## What related checks might buyers ask for?

| Check | What it is |
| --- | --- |
| DSPT | The Data Security and Protection Toolkit, an online self-assessment of data security |
| Cyber Essentials | A UK government-backed scheme covering basic cyber security controls |
| DPIA | A data protection impact assessment under UK GDPR for higher-risk processing |
| Clinical safety (DCB0129/DCB0160) | Clinical risk management standards for health IT |

Sources: NHS DSPT, NCSC and ICO.[2][3][4]

**Where The Autism Kit stands.** Children's routines and photos stay on the device, and we don't run a cloud database of children's data. We haven't
  completed DTAC, DSPT or Cyber Essentials yet. If your organisation needs them, we'll work through the process with
  your team.

**For buyers.** Ask suppliers early which assurances they hold and which are in progress, so pilots don't stall later.

## What can we do next?

- [ ] Download the current DTAC form
- [ ] List the assurances your procurement needs
- [ ] Ask suppliers for their status and timelines

Talk to us about your organisation: [For schools and services](https://theautismkit.com/schools#contact)

## Common questions

### Is DTAC needed for a pilot?

NHS guidance describes DTAC as the baseline before pilots as well as before full procurement, and explains how to apply it in different situations.

### Has The Autism Kit completed DTAC?

Not yet. If your organisation needs DTAC, DSPT or Cyber Essentials, tell us what your process requires and we'll work through it with your team.

### Is DTAC a certification?

It's an assessment framework that NHS organisations use to check a technology against baseline standards, rather than a certificate issued once.

## Sources

1. NHS AI and Digital Regulations Service: Using the Digital Technology Assessment Criteria (DTAC). https://digitalregulations.innovation.nhs.uk/regulations-and-guidance-for-developers/all-developers-guidance/using-the-digital-technology-assessment-criteria-dtac/
2. NHS Data Security and Protection Toolkit. https://www.dsptoolkit.nhs.uk/
3. National Cyber Security Centre: Cyber Essentials. https://www.ncsc.gov.uk/cyberessentials/overview
4. Information Commissioner's Office: Data protection impact assessments. https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/data-protection-impact-assessments-dpias/

General guidance, not a diagnosis or treatment plan. Talk with your pediatrician or a developmental specialist about your child's care.