Medical AI · Regulation, ethics & governance · Lesson 4 of 7
UK MHRA: AI as a medical device
Reviewed by Dr. Ram Kumar G, MBBS, MD (Internal Medicine), MPH (USA), on · Last updated
- Intermediate
- Clinical focus
- About 25 minutes
- Includes exercise
Before this lesson: Software as a Medical Device (SaMD)
In short
In Great Britain, AI medical devices are regulated by the MHRA under the UK Medical Devices Regulations 2002, which were not written with AI in mind. The MHRA has been reforming software regulation, testing approaches in its AI Airlock sandbox, and in 2026 the government accepted all 44 recommendations of the National Commission into the Regulation of AI in Healthcare. Draft guidance on change control is due by December 2026 and a consultation on how to qualify and classify AI devices in 2027. NHS organisations also apply their own clinical safety and evidence standards before adopting tools.
You will learn to
- Describe the current UK legal framework for AI as a medical device
- Summarise the MHRA's AI Airlock and the 2026 National Commission recommendations
- Identify the NHS standards that apply when adopting AI tools
- Track the UK reforms expected in 2026 and 2027
The current framework
Medical devices in Great Britain are regulated under the UK Medical Devices Regulations 2002 (UK MDR), based on earlier EU directives. Under these rules much software has historically fallen into the lowest risk class, a mismatch with the risks of modern AI that reforms aim to correct. Strengthened post-market surveillance requirements came into force on 16 June 2025. Northern Ireland follows EU rules under separate arrangements.
The MHRA's Software and AI as a Medical Device Change Programme, launched in 2021, set out work on qualification, classification, evidence, cybersecurity and adaptive AI.
AI Airlock: a regulatory sandbox
The AI Airlock is the MHRA's regulatory sandbox for AI as a medical device, where regulators and developers test how regulation should handle real products. After a pilot, its second phase worked with seven innovators, on tools including AI note-taking, cancer diagnostics, eye-disease detection and obesity-treatment support, around three challenges: AI that keeps changing after deployment, AI diagnostics, and post-market surveillance. Phase 2 completed in May 2026.
The 2026 National Commission
The MHRA established the National Commission into the Regulation of AI in Healthcare in September 2025 as an independent advisory body. After evidence gathering that involved more than 12,000 people, it published 44 recommendations on 10 September 2026. On 6 October 2026 the government accepted all of them and set ten priority areas.
| Next step (government response, October 2026) | Timing |
|---|---|
| Draft MHRA guidance on predetermined change control plans for AI devices | By December 2026 |
| Consultation on a new qualification and classification approach for software and AI devices | Spring 2027 |
| Further detail on proportionate oversight, lifecycle evidence, general-purpose model 'master files', cybersecurity, human factors and post-market surveillance | From spring 2027 |
| Full implementation plan and roadmap, with annual progress updates | After spring 2027 |
Adopting AI in the NHS
Regulatory status is necessary but not sufficient for NHS use. Organisations also expect:
- Clinical safety standards DCB0129 (for manufacturers) and DCB0160 (for deploying organisations), with a named clinical safety officer and hazard log.
- The Digital Technology Assessment Criteria (DTAC), covering clinical safety, data protection, technical security, interoperability and usability.
- NICE's Evidence Standards Framework for digital health technologies, setting the evidence expected for different types and risks of tool.
- Compliance with UK GDPR and the Data Protection Act 2018, including a data protection impact assessment.
Not legal or regulatory advice
- This lesson explains regulation for learning purposes, as of October 2026. Rules and guidance change; whether a real product is a medical device, and how it is classified, depends on its intended purpose and needs qualified regulatory advice and the current official texts.
Exercise
Map what a fictional AI product needs before it can be used in an NHS trust.
Data: A fictional AI product description written for the notebook (Created for this course)
- Decide whether the fictional product is a medical device in Great Britain and note what its current class might be.
- List the DCB0129, DCB0160, DTAC and NICE evidence requirements it would need to meet.
- Read the summary of the National Commission recommendations and pick three that would most change this product's path to market.
- Draft the questions an NHS digital clinical safety officer should ask the vendor.
The runnable notebook and worked solution will be published soon. You can work through the steps with the code on this page in the meantime.
Key takeaways
- UK AI devices are regulated under UK MDR 2002, which reform aims to modernise.
- The MHRA's AI Airlock tests regulatory approaches with real products.
- In 2026 the government accepted all 44 National Commission recommendations.
- NHS adoption also needs DCB0129/DCB0160, DTAC, NICE evidence and data protection.
Terms used: Intended purpose (intended use), Predetermined change control plan (PCCP), SaMD (Software as a Medical Device)
Related: Software as a Medical Device, Monitoring and MLOps, The EU AI Act and medical devices
FAQ
Who regulates AI medical devices in the UK?
The Medicines and Healthcare products Regulatory Agency (MHRA), under the UK Medical Devices Regulations 2002 in Great Britain.
What is the AI Airlock?
The MHRA's regulatory sandbox for AI as a medical device, where regulators and developers explore how regulation should handle real AI products.
What did the National Commission recommend?
Forty-four recommendations, published on 10 September 2026, covering modernised classification, post-market assurance, safe iteration, deployment assurance, accountability and transparency. The government accepted all of them on 6 October 2026.
Is MHRA registration enough to use an AI tool in the NHS?
No. NHS organisations also apply clinical safety standards (DCB0129 and DCB0160), the Digital Technology Assessment Criteria, NICE evidence standards and data protection requirements.
When will UK AI device rules change?
The MHRA is due to issue draft change-control guidance by December 2026 and consult on qualification and classification in spring 2027, with legislative reform to follow.
Sources
- GOV.UK. Government response to the National Commission's recommendations on the regulation of AI in healthcare (6 October 2026)
- GOV.UK. National Commission into the Regulation of AI in Healthcare: recommendations for a future regulatory framework (September 2026)
- GOV.UK. AI Airlock: the regulatory sandbox for AIaMD
- NHS England. DCB0129 and DCB0160 clinical risk management standards
- NICE. Evidence standards framework for digital health technologies
Educational content only. This material teaches methods; it is not clinical advice. Code, models and examples here are not validated medical devices and must not be used to make decisions about real patients without proper clinical validation, governance and any required regulatory approval. Examples use synthetic or openly licensed de-identified data only. Never paste identifiable patient information into public AI tools. Mentions of models, tools or vendors are for identification, not endorsement.