NHS Compliance Tools · Preview

DTAC Readiness Playbook

DTAC is the NHS procurement gateway for digital health tools — five assurance domains covering clinical safety, data protection, technical security, interoperability, and usability. You need a defensible pack before any serious procurement conversation. Mine is about 60% there. This is the honest working version.

Working document — read this first

This isn't a finished playbook. It's a live account of my own onboarding, written as I go. Each milestone is marked with one of three positions so you can weight it accordingly:

I've done this — direct lived experience.
I'm here — mid-flight, what I can offer today.
Not yet reached — NHS Digital source only; I'll update when I get there.

Where I am now: Kairos's DTAC v2.0 pack is drafted and version-scoped to product release v1.24.319 — roughly 60% of the way to a defensible formal submission. Strong on the operational baseline: DSPT Standards Met, ICO registered, controller/processor model documented, DCB0129 CSMS live, WCAG 2.2 AA claim via NHS Design System. Named gaps: independent CSO sign-off (C1.2.5), Cyber Essentials certificate (C3), commissioned pen test (C3), formal usability testing (D1), 12-month availability data (D1). All tracked openly in the gap log.

Last reviewed: 30 July 2026

What's in the playbook

Nine milestones across the DTAC v2.0 domains — each marked as lived, in-flight, or not yet reached.
What I actually have evidence for: DSPT Standards Met (Z5G2X), ICO registration (ZB377343), a live DCB0129 CSMS, NHS Design System accessibility, and a documented controller/processor model.
What I don't have yet and why: Cyber Essentials certificate, commissioned pen test, formal usability study, and 12 months of availability data. Named, not papered over.
A downloadable evidence pack when you've worked through all nine milestones.

Scope

This is a free preparation aid, written from my own live DTAC pack. It isn't certification and isn't a substitute for the DTAC framework itself. The DTAC version cited here is v2.0 (February 2026); check for updates before you submit.

Open the playbook