Summary
DTAC is the Digital Technology Assessment Criteria. It is the baseline the NHS uses to judge a digital health product before an organisation brings it in. If you buy an AI scribe in the UK, this is the framework a serious buyer will hold it against.
It is not a certificate and not a badge. It is a structured self-assessment that the buying organisation reviews. A vendor completes it, the clinic checks it, and the answers either hold up or they do not.
There are five areas. Clinical safety, data protection, technical security, interoperability, and usability and accessibility. Read them in that order because that is roughly the order in which a weak product falls down.
WA\ is built for UK GDPR and the DTAC areas from the start. Ask us for our completed assessment on a call.
Book a demoClinical safety
This is the one most scribe vendors are weakest on. UK clinical safety runs on two standards, DCB0129 for the manufacturer and DCB0160 for the deploying organisation. Together they ask a supplier to appoint a named clinical safety officer, keep a hazard log, and produce a clinical safety case report.
For an AI scribe the hazards are concrete. A missed negation, a hallucinated finding, a dose transcribed wrongly. A vendor that cannot show you a hazard log and a safety case has not done this work. Ask for both by name.
Data protection
This area maps to UK GDPR and the Data Security and Protection Toolkit, the DSPT. The questions that matter are where the audio and the transcript are processed, how long they are kept, who can access them, and whether the data ever trains a model.
A patient consultation is special category data. The right answers are UK or EU processing, a clear retention limit, role-based access, and no training on identifiable data without an explicit lawful basis. Vague answers here are a reason to walk.
Technical security
Encryption in transit and at rest, penetration testing, access control and a route to report vulnerabilities. Cyber Essentials Plus is a common signal a UK buyer looks for, and an ISO 27001 certificate carries weight.
None of this is exotic. It is the floor. A vendor should be able to name its certifications and its last penetration test without a follow-up email.
Interoperability
Can the note leave the tool and land where the record lives. In UK primary care that means EMIS and SystmOne, in private practice it often means the clinic's own system. A scribe that only copies to a clipboard is a weaker fit than one that writes back.
Ask what the product does today, not what is on the roadmap. Interoperability claims are the easiest to overstate.
Usability and accessibility
The tool has to work for the clinician in the room and meet accessibility standards. In practice this is about whether the note is trustworthy enough to sign quickly, since a scribe that needs heavy editing gives the time back it was meant to save.
This is also where human review belongs. Every reputable body on ambient scribes treats clinician review and sign-off as a requirement, not a nicety. A product that hides that is selling you a risk.
How WA\ approaches DTAC
WA\ is built for these areas rather than retrofitted to them. Processing and retention are set for UK GDPR, every AI action that affects a patient is reviewable and human-approved, and the clinical safety work is treated as core rather than paperwork.
We will share our completed assessment on a call. If a scribe vendor cannot do the same, that answer is itself the answer.
Frequently asked questions
Is DTAC mandatory to buy an AI scribe in the UK?
DTAC is required when an NHS organisation procures a digital health technology, and it has become the reference point private buyers use too. A private clinic is not legally bound by it, but holding a scribe against the same five areas is the fastest way to separate a serious product from a demo. Clinical safety and data protection are the two that matter most.
What is the difference between DCB0129 and DCB0160?
DCB0129 is the clinical risk management standard for the manufacturer of the software. DCB0160 is the matching standard for the organisation that deploys it. A scribe vendor should meet DCB0129 with a named clinical safety officer, a hazard log and a clinical safety case report. Your clinic carries DCB0160 when you put the tool into use. Ask the vendor for its DCB0129 evidence before you sign.
Does an AI scribe count as a medical device in the UK?
It depends on what the product claims to do. A tool that transcribes and drafts a note for a clinician to review is generally not a medical device, because the clinician makes the clinical decision. A tool that interprets or diagnoses can cross into medical device territory and MHRA regulation. The safe design keeps a human in the loop for every clinical decision, which is how WA\ is built.
Buying a scribe in the UK?
Thirty minutes and we will walk you through our clinical safety, data protection and human-approval design against the five DTAC areas.