Medical AI regulation in the United Kingdom has changed direction: on 6 October 2026, the UK government confirmed it will accept all 44 recommendations of the National Commission into the Regulation of AI in Healthcare and set out how they will be delivered across the UK. The Commission, established by the Medicines and Healthcare products Regulatory Agency (MHRA) in September 2025 and led mainly by clinicians and regulatory experts, published its report on 10 September 2026. The core of the government's response is simple: AI-enabled medical devices should not be assessed only once before they reach the market, but evaluated and monitored throughout their working life to understand their true performance.
No longer judged on a single pre-market assessment
The gap the Commission identified is concrete. The current medical device rules were drafted when AI products did not keep learning and updating after deployment, so performance at the point of approval says little about whether a tool is still safe and effective a year later, in a different patient population, or after several updates. The reform the government has accepted is therefore proportionate, lifecycle-based regulation: rebalancing pre-market evidence requirements against post-market assurance, and shifting post-market surveillance away from passive adverse-event reporting towards continuous monitoring of quality signals, performance changes and safety issues. The government also committed to stronger patient engagement, keeping patients informed about when AI is used in their care, clearer routes to redress when standards fall short, and fair access to the benefits, including for underserved communities.
There is a parallel with continental Europe, where the EU AI Act has moved into risk-based enforcement and medical systems also sit on the high-risk side. But the UK is modernising its own medical device framework, with the detail to be set by MHRA guidance and consultations, so EU timetables cannot simply be copied across.
Three dates are already fixed, and the sandbox moves first
On the same day as the response, the MHRA opened applications for Phase 3 of AI Airlock, its regulatory sandbox for AI-enabled medical devices. This phase focuses on post-market surveillance and lifecycle regulation: selected developers will work with regulators and healthcare partners on real products to test how devices can be monitored and managed safely after deployment. A webinar for applicants takes place on 22 October 2026, the first cohort will be selected in November 2026, and the programme has secured three more years of government funding.
Two further dates tell companies when to have their material ready. The MHRA committed to issuing draft guidance by December 2026 on managing changes to AI-enabled devices as they adapt and improve, in other words how far an update can go before it needs fresh explanation or assessment. In 2027 the MHRA will consult on how AI-enabled devices are qualified and classified, the Commission's first recommendation. A full implementation roadmap covering all 44 recommendations, with timelines and responsibilities, will follow by spring 2027, driven by a newly established Programme Board.
Who is in scope, and who is not
The scope needs stating plainly: the arrangements target developers and manufacturers supplying AI-enabled medical devices in the UK, and the organisations and clinicians deploying them across the NHS and the UK's health systems. Some healthcare AI products fall under the UK Medical Devices Regulations 2002, while others are governed by data protection, professional and organisational rules, and the two should not be conflated. Equally, general wellness apps, administrative AI and general-purpose models with no medical purpose do not become MHRA-regulated medical devices because of this response. And this is a UK arrangement, not a global rule: selling into other markets still means following those markets' own regulations.
Accepting recommendations is not the same as new law taking effect
The easiest misreading is to treat 6 October as the day new rules took effect. Accepting the recommendations fixes the direction and the timetable only: the qualification criteria, the classification approach and how staged authorisation would work all wait for the December 2026 draft guidance, the 2027 consultation and later legislative reform. Staged authorisation is itself only a pathway under exploration, meaning promising tools could be used earlier in the NHS under close supervision while real-world evidence is gathered, not a lowering of the bar for approval.
For manufacturers planning to enter the UK market, the useful work is already clear: build lifecycle evidence now, including version-change records, post-market performance monitoring, processes for acting on safety signals, and patient notification procedures, rather than preparing a single pre-market dossier. Teams that prepare only for a one-off approval will see the risk surface at the first major update, when questions about reportable changes, performance drift and patient redress all arrive at once. Waiting for the spring 2027 roadmap before starting would already leave them a step behind.
