Listen on Spotify and Apple Podcasts.
Hello and welcome to Talking digital health, a podcast by law firm Mills & Reeve, hosted by health and technology lawyers Sophie Burton-Jones and Charlotte Lewis. Our aim is to discuss key topics of interest to those procuring technology in the NHS and those selling technology to the NHS. If you like this podcast, please follow us and leave a review. It really helps with reach.
Charlotte Lewis: I'm Charlotte Lewis.
Sophie Burton-Jones: And I'm Sophie Burton-Jones, and we're your hosts for this episode. Today, we're delighted to be joined again by Stephanie Caird, a partner in the Mills & Reeve life sciences team. She's here to discuss what's been happening in the medical devices regulatory space. Thanks for joining us again, Steph.
Stephanie Caird: Thanks both. I'm delighted to be here again.
Charlotte Lewis: Last time, we spoke about how software and apps might be regulated as medical devices, and you gave us a high-level overview of the development and marketing process. Since then, quite a lot has happened. We've had the NHS 10-year plan and the life sciences sector strategy announcements, and they might impact medtech companies quite a lot, so we thought it would be helpful to have you back to give us an update. Given the drive towards innovation, bringing innovation into the NHS, and the increased use of AI, is there anything developers need to be particularly mindful of?
Stephanie Caird: Great question. Both the NHS England plan and the life sciences sector plan highlighted the potential for technology, and AI in particular, to support the delivery of healthcare, because we know there are some challenges at the moment. However, there has recently been some nervousness in the sector because it isn't entirely clear whether all AI-enabled products will need to be classified as medical devices, with manufacturers registered with the Medicines and Healthcare products Regulatory Agency (MHRA), before those products can be used in the NHS at all. There were some communications from NHS England about AI scribing tools which kicked off some of this nervousness.
From a medical device regulatory standpoint, if the AI tool is part of an investigation, so you're trying it out with patients to see how it works (ie the product is still in development), it could lawfully be made available without a CE or UKCA mark, provided the manufacturer has met the other conditions within the regulations. If the product is already being marketed and sold as a medical device by the manufacturer, in that case, we would expect it to require a UKCA or CE mark and the manufacturer to be registered with the MHRA before that product can be used by the NHS.
Charlotte Lewis: Steph, is that the same in the EU, or is it different?
Stephanie Caird: It's slightly different in the EU. The EU legislation on medical device regulation is fairly similar to ours, as our regulations are based on an EU directive. They have now updated that framework to the EU Medical Device Regulations. They also have the EU AI Act, which came into force on 1 August 2024 and is the first piece of legislation worldwide that solely and comprehensively deals with the regulation of AI. Depending on the risk classification of your medical device, you may require a separate assessment under the AI Act, as well as your assessment under the medical device regulations, before you can lawfully market it. That can be time-consuming and expensive. You might need two different notified bodies to carry out those assessments, and it’s quite a high regulatory hurdle for manufacturers to meet.
I've been in discussions with European colleagues from our M&R Global firms. We understand that various industry associations are calling on legislative bodies to revise the landscape, particularly with regard to the field of AI, because the current system is preventing manufacturers from investing in the European market.
Sophie Burton-Jones: It sounds like, in this case, the UK might be a better place for innovative providers to launch software as a medical device product, particularly where AI is involved.
Stephanie Caird: At the moment, under the current regulatory framework, I would say yes. It's probably more straightforward to get your device approved, but we're expecting changes to our regulatory framework and we expect it to become a little bit more stringent.
For example, this year we've already seen the introduction of more structured post-market surveillance requirements for medical devices. Those have been in place since June, and we expect further reforms in 2026.
Charlotte Lewis: What are we expecting those further reforms to look like?
Stephanie Caird: Based on discussions within the sector with regulatory consultants and people at the MHRA, we're expecting some risk categories to be reclassified. Software and AI as medical devices could potentially become higher-risk devices, which means you would have higher regulatory thresholds to meet in order to get your device CE or UKCA marked.
We're also expecting more detailed requirements on how a clinical evaluation must be conducted and documented, and when a clinical investigation is necessary, so your pre-market requirements are therefore likely to become more involved in the coming years.
Sophie Burton-Jones: So, we might have been thinking there was less regulation in the UK, but it looks like the message could be that more regulatory hurdles are coming, instead of fewer.
Stephanie Caird: Unfortunately, that does seem to be the case, but there’s a glimmer of hope for manufacturers in this highly regulated area. We expect that there will be some form of international reliance system in development by the MHRA. The idea there is that the MHRA will look at different jurisdictions, their regulatory requirements and the authorities that approve medical devices there, to make sure their processes provide equivalent safeguards for patients as ours does. Provided a manufacturer has registered its device in that jurisdiction, it may then be able to place it on the UK market without repeating the whole assessment process.
If that is all put in place, potentially you might not have to meet multiple regulators’ requirements, provided you have met one of them.
Charlotte Lewis: So there’s some hope. What would you advise people to do in the meantime?
Stephanie Caird: At the moment, given it's impossible to foresee exactly what all these changes will look like and what might be coming, the first thing I would generally advise is to review the MHRA guidance around software and AI as medical devices. They’re regularly updating the guidance and can do so much more quickly than the legislation changes given our legislative process.
I’d also think about your key target markets. If you're looking to develop and launch a product in the UK, do come and talk to us. Medical device regulatory compliance is one part of the wider puzzle when launching software or AI as a medical device in the UK market, and we can help you navigate that.
Sophie Burton-Jones: One quick question as well. If somebody’s already got registrations under the current regulations and the rules change, do we foresee there being a process they need to go through to update those registrations? Or is it something they won't need to worry about until they get to renewal? How would that work?
Stephanie Caird: Generally, we would expect some form of transitional provisions if the legislation changes, and we've already seen that with the medical device regulations. Under the EU regulations, there was a period whereby you had to update your registration before a certain date. That has been pushed back a couple of times because of the time it’s taken to do that compliance process. Provided you're doing everything required as part of that transition, you can still market products until certain dates, depending on the classification you have. I would anticipate that, if we face that type of change under UK legislation, we would have an equivalent type of transition planning to allow people to safely change over the process. I would expect higher-risk devices to need to change quicker than lower-risk devices.
Charlotte Lewis: Thank you, Steph. I think you've got some links that we can share as part of the podcast. They'll be in the episode details and, hopefully, will be useful to listeners. Thank you very much for your time today. It's been really informative and a valuable update on where we are since our last episode on this in January. I can't quite believe it has been that long.
If you'd like to hear more from Steph, you can find her on LinkedIn and feel free to reach out to her directly.
At Mills & Reeve, we’re very happy to discuss any legal queries you might have about selling tech into the NHS. Our contact details are available on our website at mills-reeve.com.
Thank you very much for joining this episode of Talking digital health by law firm Mills & Reeve.