MHRA Releases AI Airlock Sandbox Phase 2 Programme Report
The UK Medicines and Healthcare products Regulatory Agency (MHRA) has published its AI Airlock Sandbox Phase 2 Programme Report, outlining key technical and regulatory insights derived from its standalone regulatory sandbox project.
Running from April 2025 to May 2026, Phase 2 builds upon the 2024–25 pilot by evaluating seven candidate case studies of artificial intelligence medical devices (AIaMD) across three priority regulatory challenges: intended purpose and validation, AI-powered in vitro diagnostic (IVD) performance, and Predetermined Change Control Plans (PCCPs) integrated with post-market surveillance (PMS).
Purpose and Scope of Phase 2 Evaluation
The primary objective of the AI Airlock project is to identify regulatory challenges associated with advanced medical software and test potential solutions in a controlled, non-prejudicial environment.
By engaging directly with innovators, notified bodies, and the AI Airlock Committee of Experts (ACE), the MHRA assessed how existing medical device regulations apply to complex AI technologies, including adaptive algorithms, large language models (LLMs), and generative AI platforms.
The report concludes that traditional static approval models are insufficient for AI technologies. Instead, regulatory frameworks must evolve toward a lifecycle approach, where robust pre-market validation is paired with continuous, structured real-world monitoring.
Real-World Validation, Human Oversight, and Intended Purpose
The Phase 2 findings highlight critical considerations for validating AI algorithms prior to market entry:
Real-World Deployment Conditions: Validation studies must accurately reflect actual clinical workflows and diverse patient populations rather than relying exclusively on curated, retrospective test datasets.
Dynamic Nature of Human Oversight: The report notes that clinician oversight—often cited as a primary risk mitigation factor—is non-static. Over time, user trust in AI recommendations may lead to automation bias or reduced vigilance, requiring manufacturers to monitor human-AI interactions as part of risk management.
Managing Intended Purpose Drift: Generative AI and LLM-based applications carry a high risk of expanding beyond their declared intended purpose due to open-ended user prompts. Effective technical guardrails and governance controls are essential to constrain system outputs within regulatory boundaries.
Clinically Meaningful Metrics: Evaluators emphasized that statistical significance alone does not guarantee clinical utility. Performance thresholds must align with meaningful clinical outcomes in practice.
Predetermined Change Control Plans (PCCPs) and Post-Market Surveillance
Managing algorithm updates and performance drift represents a central challenge for medical software developers. The Phase 2 report provides strong support for integrating PCCPs into the UK regulatory framework:
UK-Specific PCCP Guidance: The report recommends that the MHRA develop detailed guidance defining acceptable boundaries for pre-approved AI modifications, documentation standards, and clear criteria for what constitutes a "significant change" requiring re-assessment.
Proactive Post-Market Surveillance (PMS): To complement PCCPs, manufacturers must implement proactive PMS protocols using clinically relevant parameters to detect performance degradation, subtle data shifts, and changes in clinician usage patterns.
Recommendations for AI-Powered In Vitro Diagnostics (IVDs)
A dedicated stream of Phase 2 focused on AI-driven diagnostic tools, leading to specific recommendations for IVD manufacturers:
Development of specialized MHRA guidance addressing analytical performance metrics and validation strategies tailored to AI/ML diagnostics;
Establishing benchmark requirements for training and testing datasets in diagnostic software;
Updating software qualification guidance to clarify when adaptive diagnostic tools fall under medical device regulations versus general healthcare IT.
Transition to Phase 3 and Policy Implementation
The MHRA confirmed that Phase 3 of the AI Airlock programme (initiated in April 2026) will focus on translating sandbox learnings into concrete regulatory outputs. This includes updating MHRA guidance documents, informing recommendations for the UK National Commission on AI in Healthcare, and establishing sustainable regulatory pathways for innovative digital health technologies.
Impact on Medical Device and SaMD Developers
For software developers, regulatory directors, and healthtech companies operating or planning to launch in the UK, the AI Airlock Phase 2 report provides actionable guidance for product development pipelines.
Manufacturers should focus on:
Designing pre-market validation studies that mirror real-world clinical environments;
Implementing technical guardrails for generative AI products to prevent intended purpose drift;
Developing PCCPs early in the product lifecycle to streamline post-market algorithm updates;
Establishing proactive post-market surveillance systems capable of tracking clinical impact and user behavior;
Ensuring clinician oversight mechanisms account for potential automation bias over time;
Monitoring upcoming MHRA guidance releases regarding software qualification, PCCPs, and AI-IVDs.
By aligning development workflows with the lifecycle principles identified in the AI Airlock report, manufacturers can accelerate regulatory review times and ensure long-term compliance in the evolving UK digital health market.
