AI in healthcare: Reshaping the regulatory framework

The UK is ramping up a pro-innovation approach to the use of AI in medtech and healthcare.

The MHRA’s Strategy 2030 puts medtech and AI in healthcare centre stage, emphasising benefits to both patients and innovators.

Publication in September of the National Commission into the Regulation of AI in Healthcare: Recommendations for a future regulatory framework marked an important milestone in the UK's approach to regulating artificial intelligence in healthcare. All of the 44 recommendations in the report have since been accepted, promising a major step forward for digital health, medtech and AI-enabled diagnostics.

The National Commission report followed an extensive consultation and evidence-gathering process and is likely to shape UK regulation of AI-enabled medical devices and wider AI technologies used in healthcare. The overarching aim of this project is to develop a regulatory system that is “safe, fast and trusted”, capable of supporting innovation while maintaining patient confidence and safety.

A shift to lifecycle regulation

Perhaps the most significant theme is a change of approach, moving away from a predominantly pre-market assessment model towards a more flexible, lifecycle-based approach. The report recognises that AI-enabled technologies are fundamentally different from traditional medical devices because performance can vary over time, across settings and following software updates.

We can expect to see greater reliance on ongoing evidence generation, real-world performance monitoring and post-market surveillance, with regulatory oversight continuing throughout the product lifecycle rather than ending at market entry. This reflects a growing international consensus that AI regulation must focus not only on how products are developed, but also on how they perform in practice.

For developers, this could ultimately create more flexible routes to market. However, it will also require investment in robust monitoring systems, governance processes and mechanisms for collecting and analysing real-world evidence.

Greater flexibility for AI products

The Commission acknowledges that existing medical device regulation was not designed for adaptive AI systems. It recommends the wider adoption of mechanisms such as Predetermined Change Control Plans (PCCPs), allowing certain changes to AI systems to be authorised in advance rather than requiring repeated regulatory submissions.

The Commission also proposes staged authorisation pathways and expanded regulatory sandbox programmes to enable innovative technologies to be deployed in controlled settings while additional evidence is generated. These initiatives are intended to accelerate patient access to promising technologies while maintaining appropriate safeguards. The MHRA has invited applications for the third phase of AI Airlock, its regulatory sandbox for AI-enabled medical devices, which will include testing themes directly informed by the Commission’s recommendations.

These recommendations will be welcomed as a more pragmatic and innovation-friendly approach for this class of products.

Transparency and cybersecurity take centre stage

The Commission places considerable emphasis on transparency and trust. Manufacturers may increasingly be expected to provide information through tools such as model cards, dynamic labelling and other mechanisms that allow users to understand intended purpose, performance, limitations and ongoing updates.

Similarly, cybersecurity is treated not as a separate technical issue but as a core safety requirement. The Commission highlights the increasing interconnectedness of healthcare systems and the growing risks posed by cyber-attacks, recommending clearer expectations and guidance throughout the product lifecycle.

Organisations that are already embedding explainability, transparency and cybersecurity into product design are likely to be well positioned for the future regulatory environment.

A focus on bias and health equity

Another notable feature is the report's treatment of health equity. The Commission identifies diversity, inclusion and equitable performance as safety issues rather than purely ethical considerations. It recommends that manufacturers demonstrate how products perform across diverse populations and continue to monitor subgroup performance throughout the product lifecycle.

This reflects increasing regulatory attention globally on representative datasets, bias mitigation and algorithmic fairness. Businesses developing AI systems will need to ensure that data governance, validation and monitoring processes can withstand scrutiny in this area.

Beyond products: A whole-system approach

Importantly, the report extends beyond medical device regulation and the obligations placed on manufacturers. Safe deployment of AI will also involve healthcare providers, professionals and system governance. The report recommends AI-readiness assessments, contractual allocation of responsibilities, workforce training, national guidance and stronger organisational governance structures.

Procurement, contracting and deployment processes may increasingly require businesses to demonstrate not only product compliance but also how operational risks are managed in practice. Manufacturers may be expected to specify deployment conditions, training requirements and ongoing monitoring obligations as part of the regulatory process.

Ambient voice technology (AVT), often described as AI scribing, illustrates these whole-system challenges. Recent MHRA guidance confirms that tools limited to administrative functions, such as transcribing consultations or generating summaries for clinician review, will generally fall outside medical device regulation, whereas tools intended to support diagnosis, treatment, monitoring or other clinical decision-making are likely to qualify as medical devices. However, regulatory classification is only part of the picture: the Health Services Safety Investigations Body has launched an investigation into the use of AVT in hospitals amid concerns that adoption is accelerating while patient-safety risks, accountability and incident-reporting arrangements remain insufficiently understood. 

The Commission also highlights the problem of “liability sinks”, where responsibility for errors can fall upon healthcare professionals and providers without sufficiently recognising the role played by AI systems and wider system design. A more structured approach to liability is called for, although the report refers to work being undertaken elsewhere to address this issue rather than making specific recommendations.

Looking ahead

The Commission envisages substantial changes to the UK’s regulatory framework that will address the unique characteristics of AI while seeking to make the UK an attractive location for innovation. Future regulation is likely to focus on continuous assurance, shared responsibility and real-world performance rather than one-off product approval. We can expect to see the MHRA taking a more direct role in licensing AI-enabled medical devices.

The MHRA has promised draft guidance by December 2026 on a new approach to managing changes to AI-enabled medical devices as they adapt and improve over time, moving towards a regulatory system that is designed to maintain safety while supporting timely access to innovative devices. The MHRA will also begin consulting on how to qualify and classify AI-enabled devices, with a full implementation roadmap expected in spring 2027.

While the recommendations are developed into specific legal changes, health technology businesses using AI can prepare by embedding governance, lifecycle monitoring and transparency in their development processes.

Learn more about our life sciences practice.

Our content explained