4.8 KiB
| type | title | author | url | date | domain | secondary_domains | format | status | priority | tags | processed_by | processed_date | extraction_model | ||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| source | NHS DTAC V2 (February 2026): Updated Form With 25% Fewer Questions, Mandatory From April 6, 2026 | NHS England / Periculo Cyber / Acorn Compliance | https://www.periculo.co.uk/cyber-security-blog/dtac-version-2-what-digital-health-organisations-need-to-know-before-6th-april-2026 | 2026-02-24 | health | news | enrichment | low |
|
vida | 2026-03-24 | anthropic/claude-sonnet-4.5 |
Content
NHS England published an updated DTAC form on February 24, 2026. Key changes:
What changed:
- 25% reduction in questions
- De-duplicated with: DSPT (Data Security and Protection Toolkit) and pre-acquisition questionnaire
- Clearer guidance on DTAC's purpose, scope, and how to complete assessments
What DIDN'T change:
- The five core DTAC domains: Clinical Safety, Data Protection, Technical Security, Interoperability, Usability & Accessibility
- The substantive clinical safety requirements (DCB0129/DCB0160)
- The requirement for all NHS digital health tool procurement to use DTAC assessment
Implementation:
- Previous version NOT to be used from April 6, 2026 onwards
- Suppliers already on NHS supplier registries must transition to new form
This is a PROCEDURAL update, not a new substantive requirement. The compliance bar for clinical AI tools has not been raised or lowered — it's been streamlined.
Source also: Periculo Cyber (cyber security compliance specialists), Acorn Compliance (healthtech compliance), NHS Transformation Directorate guidance portal.
Agent Notes
Why this matters (or why it matters less than I anticipated): When researching the "April 6 deadline" from Session 11, I expected to find new substantive requirements. Instead, it's a form update — 25% fewer questions, better documentation. This is administrative streamlining, not a regulatory tightening. The "mandatory" framing in NHS communications made this sound like a new compliance gate; it's actually just a form swap.
What surprised me: The de-duplication with DSPT and pre-acquisition questionnaire. This reduces friction for suppliers completing DTAC — it makes compliance EASIER, not harder. This partially undermines the "regulatory pressure forcing OE to disclose safety data" thesis from Session 11 — DTAC V2 is less burdensome, not more.
What I expected but didn't find: New Annex-III-style requirements for clinical AI specifically. The DTAC V2 update is general digital health governance (applies to apps, devices, platforms) — there's no AI-specific clinical safety update analogous to EU AI Act's Annex III. That remains a gap in UK regulation.
KB connections:
- This corrects an overstatement from Session 11: "NHS DTAC V2 is a mandatory clinical safety standard" is accurate but the "April 6, 2026 deadline" was framed as more consequential than it is
- The substantive compliance requirement is DCB0160 (clinical safety risk assessment) — unchanged
- The real regulatory pressure comes from the supplier registry (January 2026) and NHS procurement requirements — not DTAC V2 specifically
- Does NOT represent a new forcing function for OE safety disclosure; suppliers already using previous DTAC form just switch forms
Extraction hints:
- Do NOT create a standalone claim for "DTAC V2 creates new compliance requirements" — it doesn't
- The relevant claim is already in the KB or in the supplier registry source: "NHS procurement of digital health tools requires DTAC assessment + clinical safety case (DCB0160)"
- This source is primarily a CORRECTION of Session 11's slightly elevated framing of the April 6 deadline
Context: Multiple compliance advisory firms (Periculo, Acorn) confirm this interpretation — DTAC V2 is an administrative update, not a new compliance threshold.
Curator Notes
PRIMARY CONNECTION: Session 11 regulatory track finding — corrects overstatement about April 6 deadline significance WHY ARCHIVED: Prevents future sessions from treating the DTAC V2 April 6 deadline as a major regulatory event — it's a form update, not a new substantive requirement EXTRACTION HINT: Do not extract as a standalone claim; use as context correction for Session 11 regulatory track framing
Key Facts
- NHS DTAC V2 published February 24, 2026
- DTAC V2 has 25% fewer questions than V1
- DTAC V2 de-duplicates with DSPT (Data Security and Protection Toolkit) and pre-acquisition questionnaire
- DTAC V2 mandatory from April 6, 2026
- Five core DTAC domains unchanged: Clinical Safety, Data Protection, Technical Security, Interoperability, Usability & Accessibility
- DCB0129/DCB0160 clinical safety requirements unchanged
- Previous DTAC version not to be used from April 6, 2026 onwards