UK accepts 44 healthcare AI recommendations: policy direction, not new law

What the Government has committed to do

The response moves the Commission's recommendations into a cross-government delivery programme. A new Programme Board will coordinate work involving the Department of Health and Social Care, the MHRA, NHS bodies, professional and system regulators, patient representatives and the devolved authorities.

The MHRA intends to consult by Spring 2027 on a new approach to the qualification and classification of software and AI-enabled medical devices. The response says secondary legislation would then be used to update the medical-device definition, introduce a more proportionate classification approach and clarify how design, functionality and context affect intended purpose.

The MHRA also intends to publish draft guidance on predetermined change control plans by December 2026. The proposed approach would allow manufacturers to define controlled boundaries for permitted changes, including for adaptive AI, while maintaining the device's intended use.

A fuller implementation plan and roadmap is promised by Spring 2027, with annual progress updates. Until consultations, guidance and legislation are published and legally effective, businesses should not treat the recommendations as new compliance rules or assume the final reforms will match every current proposal.

The direction of future healthcare AI regulation

The central shift is from reliance on a single pre-market assessment towards evidence and oversight across the full product lifecycle. The response proposes stronger monitoring of safety and performance in real-world settings, clearer evidence expectations and more active responses to quality and safety signals.

The programme also addresses technical and commercial dependencies. The MHRA plans guidance on information about underlying general-purpose models, including their provenance, nature, dependencies, risks and controls. It also plans work on possible master files for general-purpose models or platforms, cybersecurity expectations, direct-to-consumer devices, human factors and performance across relevant population groups.

For deployment, the MHRA intends to explain the operational conditions and risk controls manufacturers should communicate to healthcare providers. A wider working group will examine how responsibilities are allocated among manufacturers, providers, professionals and regulators, while respecting their existing statutory roles.

Patient-facing transparency is another priority. The response proposes clearer information about how AI affects care, possible model cards and dynamic labelling, a public list of authorised AI-enabled medical devices, and consideration of when patient choices or opt-out arrangements may be feasible. These are planned measures, not current universal disclosure or opt-out rights.

AI Airlock Phase 3 is open, but it is not regulatory approval

The MHRA's AI Airlock is a regulatory sandbox. Phase 3 prioritises post-market surveillance, including how deployment context, local infrastructure, workflow integration, data quality, user interaction and differing levels of clinical oversight affect safety and performance.

The current review wave closes on 31 October 2026, although the application window is intended to remain open year-round. Organisations of all sizes may apply, projects generally run for six to twelve months, and participation is free. Applicants are expected to fund their own studies, delivery and access to relevant datasets.

Selection does not constitute regulatory approval. An Airlock project may help a manufacturer test a regulatory challenge and generate evidence, but it does not replace qualification, classification, conformity assessment, registration, clinical investigation, data-protection or NHS adoption requirements.

What remains binding now

In Great Britain, whether software is a medical device still depends on its intended purpose and the current UK Medical Devices Regulations 2002. Existing MHRA guidance remains relevant while the proposed qualification and classification reforms are developed.

The Medical Devices (Post-market Surveillance Requirements) (Amendment) (Great Britain) Regulations 2024 are already in force. They inserted Part 4A into the UK Medical Devices Regulations and apply to medical devices placed on the market or put into service in Great Britain from 16 June 2025, whether CE marked or UKCA marked. They include duties concerning post-market surveillance, incidents and corrective and preventive action.

Data protection remains a separate legal analysis. Health data is special category data. Organisations need an Article 6 lawful basis, an Article 9 condition where applicable, purpose limitation, transparency, data minimisation, security and suitable processor arrangements. The ICO identifies AI, sensitive data, vulnerable people and risks to physical health or safety as factors that can point towards a required data protection impact assessment.

Northern Ireland follows a different medical-device route, including the EU MDR and IVDR. For products marketed in the EU, the UK response does not change MDR, IVDR or AI Act obligations. Under Article 6 of the AI Act, an AI system is high-risk under the regulated-product route only where the stated cumulative conditions are met, including the relevant third-party conformity-assessment requirement.

Practical actions for medical AI businesses

1. Keep current and future rules separate. Maintain a legal register showing what is binding today, what is guidance, what is under consultation and what still requires legislation.
2. Lock down the intended purpose. Document users, patient groups, inputs, outputs, clinical claims, exclusions, foreseeable use and the consequences of error before deciding whether the product is a medical device or IVD.
3. Design post-market surveillance around deployment context. Monitor local workflows, data quality, population mix, human oversight, model drift, updates, incidents and near misses, with defined thresholds for investigation, rollback and notification.
4. Contract for lifecycle evidence. Secure timely access to deployment data, complaints, safety signals, version information and investigation support from healthcare providers, cloud suppliers and model providers.
5. Create a controlled change process. Record the approved model, data, performance envelope and intended use, then define which changes require validation, regulatory review, customer notice or rollback.
6. Map general-purpose model dependencies. Document provenance, model and API versions, material limitations, provider changes, security controls, continuity arrangements and evidence needed for a regulatory submission.
7. Test performance by relevant group and setting. Do not rely only on aggregate accuracy. Evaluate representative data, foreseeable disparities, accessibility and performance after deployment.
8. Prepare patient and professional information. Explain the AI function, role in decision-making, limitations, human oversight, update status, reporting route and any meaningful choices in clear language.
9. Run the privacy assessment in parallel. Identify controllers and processors, Article 6 and Article 9 bases, DPIA requirements, research permissions, international transfers, retention and security before using real patient data.
10. Consider AI Airlock strategically. Apply only with a defined regulatory challenge, testable hypothesis, evidence plan, resourcing and a clear understanding that sandbox participation is not market approval.

The compliance conclusion

The Government's acceptance of all 44 recommendations is a material policy development because it establishes the intended direction of UK healthcare AI regulation and gives businesses several concrete milestones to track.

It does not create a new legal regime on 6 October 2026. Medical AI companies should continue to comply with current medical-device, post-market surveillance and data-protection requirements, while building lifecycle evidence, change control, dependency records and deployment monitoring that are likely to matter under the future framework.