UK Government Accepts All 44 Recommendations on AI Regulation in Healthcare
The UK Government has published its response to the National Commission into the Regulation of AI in Healthcare, confirming that it will accept all 44 recommendations put forward by the Commission. 1791350236387
The response sets out a broad programme of regulatory reform intended to create a more proportionate, risk-based, lifecycle-oriented and system-wide framework for AI in healthcare. 1791350236387
Why the UK Plans to Reform the Current Framework
The Government states that the current medical device regulations were not designed for the pace and characteristics of modern AI development.
The response explicitly notes that the UK Medical Devices Regulations 2002 are not fit for purpose for the current generation of software and AI-enabled technologies. 1791350236387
The reforms are intended to support earlier access to safe AI technologies while improving patient safety, public trust and regulatory predictability.
Three Core Regulatory Principles
The Government organises its response around three key principles:
proportionate lifecycle regulation;
system-wide responsibility and safe management;
trust, transparency and predictability. 1791350236387
These principles form the basis of the full 44-recommendation action plan.
New Classification and Qualification Approach for AI-Enabled Medical Devices
One of the most significant commitments is a planned reform of the rules used to determine whether software or AI qualifies as a medical device and how it should be classified.
The MHRA intends to consult on a new approach that may include:
an updated definition of a medical device;
clearer exclusions for certain administrative, general wellbeing and decision-support software;
a more proportionate classification system for software and AI-enabled devices;
an updated approach to intended purpose that considers design, functionality and context of use. 1791350236387
The consultation is planned for Spring 2027.
Updated Guidance for Software and AI-Enabled Devices
The MHRA also plans to review and update its existing guidance on stand-alone software, apps and IVD software.
Future guidance is expected to clarify:
device qualification;
AI risk classification;
interpretation of intended purpose;
software and AI products that fall outside medical device regulation. 1791350236387
Shift Toward Lifecycle-Based Regulation
The Government supports a move away from relying heavily on one-time pre-market assessments.
Instead, the future framework is expected to balance:
appropriate pre-market evidence;
continuous evidence generation;
real-world monitoring;
stronger post-market oversight. 1791350236387
This approach is designed to reflect the fact that AI-enabled devices may evolve after market entry.
Predetermined Change Control Plans
The MHRA plans to issue draft guidance on Predetermined Change Control Plans (PCCPs) by December 2026.
The proposed approach would allow manufacturers to define boundaries for acceptable future changes rather than requiring every specific modification to be listed in advance.
This is particularly relevant for adaptive AI-enabled medical devices. 1791350236387
General-Purpose AI Models and Master Files
The Government also accepts the recommendation to explore a Master File approach for general-purpose AI models and platforms.
This could allow reusable information on underlying models or technologies to support multiple medical device assessments.
The MHRA may also pilot a Master File system for general-purpose models or platforms. 1791350236387
Manufacturers may additionally be expected to provide information on:
model provenance;
dependencies;
associated risks;
risk controls;
continuity arrangements. 1791350236387
Cybersecurity Requirements
Cybersecurity is identified as a core component of lifecycle safety.
The MHRA plans to issue draft guidance and educational resources describing cybersecurity expectations for software and AI-enabled medical devices.
The guidance will cover practices that should be considered throughout the product lifecycle to maintain safety and performance. 1791350236387
Human Factors, Usability and Direct-to-Consumer Devices
The Government also accepts recommendations for new guidance covering:
direct-to-consumer applications;
wearables with medical device functionality;
human factors;
usability;
user-centred design. 1791350236387
These areas are expected to become increasingly important as AI-enabled products move closer to patients and consumers.
Health Equity and Representative Data
The MHRA plans to provide guidance on demonstrating that AI-enabled medical devices are safe and effective across relevant population groups.
This includes expectations for:
representative data;
subgroup performance assessment;
ongoing monitoring;
underserved and underrepresented populations. 1791350236387
Staged Authorisations and Regulatory Sandboxes
The Government will explore staged authorisation pathways that may allow earlier patient access while evidence continues to be generated.
The MHRA also plans to expand the use of regulatory sandboxes, including continued development of the AI Airlock programme. 1791350236387
International Recognition and Reliance
The MHRA intends to continue pursuing international harmonisation through cooperation with regulators including:
FDA;
Health Canada;
TGA;
IMDRF partners.
The Government also plans to explore recognition and reliance arrangements for AI-enabled medical devices. 1791350236387
Stronger Post-Market Surveillance
A major theme of the response is stronger post-market oversight.
The MHRA plans to build a more tailored surveillance toolkit for AI-enabled devices, which may include:
enhanced post-market monitoring;
real-world performance data;
ongoing reporting;
earlier detection of safety or quality signals. 1791350236387
Improvements to Yellow Card Reporting
The Government also plans to improve reporting and information sharing across the product lifecycle.
Potential measures include:
additional adverse incident reporting mechanisms;
better reporting for software and AI-enabled devices;
stronger transparency around Yellow Card data;
easier feedback from users. 1791350236387
Public Database of Medical Device Adverse Incidents
One particularly notable proposal is a public-facing database that would allow users to search adverse incident reports related to medical devices, including software and AI-enabled devices.
The system is expected to build on the approach used for the MHRA’s Interactive Drug Analysis Profiles. 1791350236387
UDI and Version Control for AI Software
The MHRA also plans guidance on the mandatory use of Unique Device Identifiers (UDI) for software and AI-enabled medical devices.
The guidance is expected to address:
software version control;
device updates;
traceability;
recording device information in electronic patient records. 1791350236387
Stronger Enforcement
The Government accepts recommendations for stronger enforcement mechanisms.
This includes exploring the use of civil sanctions and financial penalties where manufacturers fail to meet regulatory requirements. 1791350236387
Responsibilities Across Manufacturers and Healthcare Providers
The response emphasises that AI safety cannot be managed by manufacturers alone.
Responsibilities are expected to be shared across:
manufacturers;
healthcare providers;
healthcare professionals;
regulators;
NHS organisations;
system partners. 1791350236387
Operational Conditions for Safe Deployment
The MHRA plans to develop guidance requiring manufacturers to clearly describe the operational conditions necessary for safe use of AI-enabled devices.
These conditions may include:
cybersecurity controls;
user training;
organisational readiness;
deployment requirements;
risk control responsibilities. 1791350236387
AI Readiness for Healthcare Organisations
The Government also plans an AI Readiness Toolbox to help healthcare organisations evaluate whether they are prepared to safely implement AI technologies.
The toolbox will build on existing initiatives such as the AI Readiness Checklist and the Digital Technology Assessment Criteria. 1791350236387
Training and AI Literacy
The response calls for a coordinated approach to improving AI literacy among:
healthcare professionals;
procurement teams;
regulators;
educators;
the wider healthcare workforce. 1791350236387
Healthcare providers will also be expected to support staff with appropriate technology-specific training. 1791350236387
Transparency for Patients
The Government plans to clarify transparency expectations where AI is used in patient care.
This includes considering:
how patients are informed;
what choices they have;
when opt-out arrangements may be appropriate. 1791350236387
Public List of Authorised AI-Enabled Medical Devices
The MHRA also plans to publish a regularly updated list of authorised AI-enabled medical devices in the UK.
This is intended to improve transparency and public access to regulatory information. 1791350236387
Regulatory Journey Map and Early Advice
The Government wants manufacturers to have clearer and earlier access to regulatory information.
Planned measures include:
lifecycle journey maps;
clearer public-facing resources;
earlier regulatory engagement;
written feedback on qualification and classification;
more predictable regulatory pathways. 1791350236387
Formal Classification Confirmation Service
The MHRA will also consider establishing a formal service allowing manufacturers to request written confirmation of a product’s regulatory classification or pathway.
This could reduce uncertainty and avoid unnecessary rework during development. 1791350236387
Next Steps
The Government will establish a cross-system Programme Board to oversee implementation.
A detailed implementation plan and roadmap is expected by Spring 2027, followed by annual progress updates. 1791350236387
Impact on AI and Medical Device Manufacturers
For manufacturers of software and AI-enabled medical devices, the response signals substantial future changes in the UK regulatory environment.
Key areas to monitor include:
AI device qualification and classification;
PCCPs;
lifecycle evidence;
post-market surveillance;
cybersecurity;
Master Files for general-purpose models;
UDI and version control;
human factors;
health equity;
staged authorisations;
recognition pathways;
AI readiness requirements;
adverse incident reporting;
regulatory enforcement.
The overall direction is clear: the UK intends to move toward a more flexible but more continuous regulatory model, with reduced reliance on a single pre-market assessment and greater emphasis on lifecycle evidence, post-market performance and shared responsibility.
