| name | arckit-uk-nhs-dtac |
| description | [COMMUNITY] Generate an NHS Digital Technology Assessment Criteria (DTAC v3) assessment for a digital health product being procured or assured by an NHS organisation. |
⚠️ Community-contributed command — not part of the officially-maintained ArcKit baseline. Output is not procurement, regulatory, or clinical advice. DTAC v3 is the current published version as at writing (2026-05) — verify against https://transform.england.nhs.uk/key-tools-and-info/digital-technology-assessment-criteria-dtac/ for any subsequent revisions before submission to an NHS buyer or assurance team. DTAC outputs MUST be reviewed by the product's Clinical Safety Officer, DPO, and engineering lead before submission.
You are an enterprise architect generating an NHS Digital Technology Assessment Criteria (DTAC v3) assessment for a digital health product. DTAC is the NHS England assessment used by NHS organisations to confirm new digital products meet a baseline standard for clinical safety, data protection, technical security, interoperability, and usability/accessibility before purchase or deployment.
User Input
$ARGUMENTS
Context
DTAC was introduced by NHSX (now part of NHS England's Transformation Directorate) and is the de facto national NHS procurement-assurance baseline for digital products. It is consumed by NHS Trust procurement teams, ICS digital teams, NHS Supply Chain framework buyers, and is referenced by NHS England innovation pathways. DTAC overlaps but does not replace MHRA medical-device regulation ($arckit-uk-mdr-classification) or the GDS Service Standard ($arckit-service-assessment).
Authoritative anchors:
DTAC v3 structure (5 sections + AI annex):
| Section | Title | Approximate criteria | ArcKit cross-references |
|---|
| 1 | Clinical Safety | DCB0129 (manufacturer) + DCB0160 (deployer) compliance | $arckit-uk-nhs-dcb0129, $arckit-uk-nhs-dcb0160 |
| 2 | Data Protection | UK GDPR, DPA 2018, DSPT, DPIA | $arckit-dpia |
| 3 | Technical Assurance | Security, cloud, software lifecycle, business continuity | $arckit-secure, $arckit-hld-review, $arckit-dld-review |
| 4 | Interoperability | FHIR UK Core, SNOMED CT, NHS Number, NHS APIs (PDS, e-RS, GP Connect) | $arckit-data-model, $arckit-adr |
| 5 | Usability and Accessibility | NHS Service Standard, WCAG 2.2 AA | $arckit-service-assessment |
| AI annex | AI / ML components | Model governance, ATRS, training-data provenance, fairness, drift monitoring | $arckit-atrs |
Process
-
Read prerequisites:
projects/000-global/ARC-000-PRIN-*.mdARC-{PID}-REQ-*.md, ARC-{PID}-DATA-*.md, ARC-{PID}-STKE-*.mdARC-{PID}-HLDR-*.md and ARC-{PID}-DLDR-*.md if presentARC-{PID}-DPIA-*.md if present (Section 2)ARC-{PID}-ATRS-*.md if present (AI annex)ARC-{PID}-SECD-*.md if present (Section 3)clinical-safety/SAFETY-CASE.md and clinical-safety/HAZARD-LOG.md if present (Section 1).arckit/templates/_partials/RENDERING.md
-
Read the template:
templates-custom/uk-nhs-dtac-template.md → .arckit/templates-custom/uk-nhs-dtac-template.md → .arckit/templates/uk-nhs-dtac-template.md
-
Resolve the project: locate the target projects/{NNN}-<slug>/ from the ArcKit Project Context; only if no project exists, create one with scripts/bash/create-project.sh --json --name "<project-name>". create-project.sh is create-only — invoked with no --name it exits 1 without returning a path.
-
Generate the filename via node scripts/generate-document-id.mjs <PROJECT_ID> NHSDTAC --filename (this is a single-instance artefact; no --next-num).
-
Resolve the <!-- DOC-CONTROL-HEADER --> marker per RENDERING.md. The DTAC artefact is a conventional ArcKit ARC-{NNN}-NHSDTAC-v1.0.md file.
-
Generate the five sections (each with explicit pass / partial / fail status and evidence):
Important Notes
- DTAC is procurement assurance, not regulation: a passing DTAC does not constitute MHRA medical-device approval (run
$arckit-uk-mdr-classification if the product is a medical device) and does not constitute DCB0129/0160 compliance (run those commands explicitly).
- DTAC version pinning: DTAC has been revised periodically (v3 current as at 2026-05). Confirm the version against the NHS England Transformation Directorate page before submission. If a new version is published, the section structure may have changed.
[PENDING] markers: many DTAC items depend on activities that the deploying NHS organisation must complete (DSPT submission, local Caldicott Guardian sign-off). The artefact uses [PENDING — organisation responsibility] clearly; do not assert these are complete from product-side evidence alone.- AI annex: omit cleanly if the product is non-AI. Do not fabricate AI compliance content. If the product uses third-party AI features (e.g. embedded LLM for free-text summarisation), the annex applies and the third-party provider's assurances should be referenced.
- Reuse the DCB0129/0160 outputs: Section 1 is materially incomplete without a real DCB0129/0160 case. If those files are absent at runtime, the artefact must state so explicitly rather than hand-waving compliance.
Suggested Next Steps
After completing this command, consider running:
$arckit-uk-nhs-dcb0129 -- DTAC Section 1 (Clinical Safety) references SAFETY-CASE.md and HAZARD-LOG.md — run uk-nhs-dcb0129 first if not present.$arckit-dpia -- DTAC Section 2 (Data Protection) references a UK GDPR DPIA — run dpia first if not present.$arckit-atrs -- DTAC AI annex references an Algorithmic Transparency Recording Standard (ATRS) entry if the product uses AI/ML.$arckit-secure -- DTAC Section 3 (Technical Assurance) cross-references the Secure by Design assessment.$arckit-service-assessment -- DTAC overlaps the GDS Service Standard; run service-assessment if the product is also a GDS-assessed service.
