UK Healthcare AI Regulatory Reform Plan

Overview

The Government Response to the National Commission's Recommendations on the Regulation of AI in Healthcare is a policy paper published by the Medicines and Healthcare products Regulatory Agency (MHRA) on 6 October 2026. The government accepts all 44 recommendations and establishes a programme for changing how healthcare AI is developed, regulated, deployed and monitored. Its central approach combines proportionate lifecycle regulation, system-wide responsibility, and trust, transparency and predictability. The official publication connects patient safety and equitable access with earlier adoption of beneficial technologies, clearer routes to market and growth across the four UK nations.

Adoption denotes acceptance of the policy programme, not enactment of legislation or parliamentary approval. The response is non-binding and does not itself bring regulatory reforms into force or create independently enforceable obligations. Implementation may require consultation, secondary legislation, guidance, contracts, new powers or operational changes. Existing medical-device, data-protection, professional, organisational, research-governance and clinical-risk requirements continue to apply according to the activity and product. The government identifies ten delivery priorities and commits to an implementation plan and roadmap by Spring 2027, followed by annual progress updates. Its reference to up to £10 billion concerns broader technology, digital and data initiatives over three years.

Definitions and Scope

The programme covers software and AI-enabled medical devices, adaptive devices, devices dependent on general-purpose AI models or platforms, direct-to-consumer applications and wearables with medical-device functionality, and relevant non-device healthcare AI. It involves manufacturers, developers, providers, professionals, wider healthcare staff, patients, regulators, research-governance organisations, and procurement and education bodies. Delivery spans England, Scotland, Wales and Northern Ireland while respecting participating organisations' statutory remits. Medical-device status depends on intended purpose, functionality and use. Proposed clarification of administrative, general-wellbeing and certain decision-support software is not a blanket exemption.

Recommendation 1 commits the MHRA to consulting on qualification and classification and then updating the framework through secondary legislation. Planned changes include clarifying non-device software, introducing more proportionate classification, and updating intended purpose to account for design, functionality and context of use. Recommendation 4 explores function-based regulation focused on medical functionality within multipurpose products. Predetermined Change Control Plans (PCCPs) would define allowable changes, including adaptive AI changes, while maintaining intended use. A potential Master File approach would share information about underlying general-purpose models or platforms to support device assessment, with expert engagement and a possible pilot. Lifecycle assurance extends evidence and oversight beyond market entry; identifiers and software version control support traceability. Research classification depends on an activity's purpose, design and context rather than its label.

Governance and Institutional Framework

Section 4 commits the government to establishing a cross-system Programme Board representing health, regulatory and research organisations and devolved authorities. It will meet quarterly to oversee delivery, monitor agreed objectives, address emerging risks and coordinate action. It will also identify ways to foster collaboration between the four nations on shared recommendations and goals. Quarterly updates will go to the Life Sciences Delivery Board for senior oversight and alignment with wider priorities. The implementation roadmap will specify further roles, responsibilities, timelines and deliverables.

The MHRA leads device-regulatory reform. The Department of Health and Social Care (DHSC), working with devolved health departments and health-system partners, leads important adoption, readiness and governance work. NICE and equivalent organisations support evidence alignment and appraisal; the Health Research Authority (HRA) clarifies research-governance boundaries; and the Care Quality Commission (CQC) and equivalent organisations contribute to provider oversight and reporting. Other participants include NHS England, NHS Resolution, the Professional Standards Authority, professional regulators, the Information Commissioner's Office (ICO) and the Patient Safety Commissioner. Recommendation 24 establishes a working group to clarify responsibility without determining or redistributing responsibilities. Coordination must recognise each body's statutory remit.

Key Focus Areas

The first theme, proportionate lifecycle regulation, combines modernised qualification and classification, equitable outcomes, stronger post-market assurance and safe iteration with earlier patient access. Recommendations 1 to 23 cover guidance, risk-proportionate oversight, medical functions, lifecycle evidence, PCCPs, general-purpose model dependencies, cybersecurity, direct-to-consumer products, usability, representative populations, staged authorisations, sandboxes and enforcement. The programme seeks to reduce excessive reliance on point-in-time pre-market assessment and passive adverse-event reporting. Stronger ongoing evidence, monitoring and risk controls support this shift rather than replacing safety assurance.

The second theme, recommendations 24 to 34, addresses responsibility, redress, deployment conditions, contractual allocation, organisational readiness, national learning, workforce capability and reporting culture. The third theme, recommendations 35 to 44, covers patient transparency, public collaboration, safety communication, public sentiment, user-centred design, comparative evidence and navigable regulatory pathways. Equity spans development, evaluation, deployment and monitoring, including attention to children, women, ethnic minorities and underserved or underrepresented groups. Patient choice is subject to further policy work: potential opt-out arrangements must be assessed against clinical effectiveness, equitable access and patient safety.

Implementation Framework

The MHRA intends to consult on qualification and classification by Spring 2027 and provide interim clarification under the existing framework. Draft PCCP guidance is intended by December 2026 for public comment. Additional work includes exploring licensing powers, staged authorisations, a Master File pilot, formal classification confirmation and earlier written regulatory advice. Recommendation 15 commits to phase 3 of AI Airlock and support for sandbox provisions in the upcoming Regulating for Growth Bill. These proposed pathways and powers require subsequent implementation; inclusion in the action plan does not establish them as operative regulatory arrangements.

Deployment preparation includes MHRA guidance on operational conditions and illustrative risk controls, alongside DHSC and devolved-health-department work on clearer contractual allocation between manufacturers and providers. AI readiness work builds on the CERSI-AI checklist overseen by NHS England and complements the Digital Technology Assessment Criteria. The planned AI Readiness Toolbox will help organisations prepare for safe adoption through existing readiness work and shared practices. Training should establish a shared baseline of AI capabilities while being tailored to roles and settings, including professional education and existing provider obligations. Procurement work will address underlying model dependencies. Adoption programmes and evidence alignment seek to reduce duplication while retaining applicable assurance requirements.

Monitoring and Evaluation

Recommendations 17 to 23 develop a tailored post-market approach building on existing surveillance requirements. The MHRA will consider an enhanced toolkit of mechanisms that could be required individually or together. These include surveillance plans, real-world studies, ongoing performance reporting and escalation when performance deteriorates, including before a reportable incident occurs. AI Airlock phase 3 will investigate surveillance challenges and practices. Further commitments cover strengthened lifecycle reporting, improved user feedback, partnerships, data sharing and improvements to the Yellow Card scheme. Delivery combines implementation work with potential legislative reform.

Recommendation 20 commits to guidance on mandatory unique device identifiers as required in the pre-market statutory instrument, including software version control, and work to capture traceability in electronic patient records. Recommendation 21 explores automated, low-burden reporting through provider systems and products. Recommendation 19 proposes a public searchable adverse-incident database or tool; recommendation 37 includes work toward a regularly updated list of authorised AI-enabled medical devices. Programme evaluation combines quarterly Programme Board oversight, quarterly reporting to the Life Sciences Delivery Board and annual public progress updates following the implementation roadmap.

Enforcement, Responsibility and Patient Redress

The response creates no new operative fine, criminal offence or penalty schedule. Recommendation 22 commits the MHRA to exploring stronger enforcement, including implementation of the civil sanctions regime provided by the Medicines and Medical Devices Act, enabling financial penalties where appropriate. Recommendation 23 proposes testing responsive engagement and compliance approaches with stakeholders. These commitments concern future implementation rather than immediate sanctions for failing to follow the policy response. Enforceable requirements continue to arise from applicable legislation and other binding arrangements.

Responsibility and redress are system-wide issues rather than a new liability regime. Recommendation 24 clarifies existing roles without redistributing them, while NHS England and NHS Resolution will continue indemnity guidance. Under recommendation 25, DHSC will convene a working group involving relevant organisations and the Patient Safety Commissioner to support access to redress where care falls below what is reasonably expected. Potential work includes a shared complaints model and clearer communication about concerns and remedies. The response does not establish strict AI liability, a compensation tariff, a new tribunal, an appeal deadline or a universal patient opt-out right.

Relationship to Other Instruments

The UK Medical Devices Regulations 2002, as amended, remain the central existing medical-device framework addressed by the programme. The government considers that framework unsuitable for the characteristics and pace of AI development and plans reform, including secondary legislation on definitions and classification. The response does not itself amend or repeal those Regulations. Products outside device regulation may still fall under data protection, professional, organisational or other sector-specific frameworks. The Medicines and Medical Devices Act supports planned civil-sanctions work. Licensing and sandbox proposals require further policy and legislative implementation.

The programme aligns with the 10 Year Health Plan for England, the Life Sciences Sector Plan and the AI Opportunities Action Plan. Readiness and lifecycle-management work builds on the Digital Technology Assessment Criteria and DCB0129/0160 clinical risk management standards, which are under review. Recommendation 31 identifies possible alignment with the statutory code on AI and automated decision-making being developed by the ICO. Recommendation 40 connects adoption work with the National HealthTech Access Programme, Innovator Passport, ANIA pathway and value-based procurement. HRA guidance must signpost applicable data-protection, confidentiality and information-governance requirements; non-research classification does not remove these obligations.

International Alignment

Recommendation 16 commits the MHRA to maintaining and enhancing international harmonisation where appropriate. Partners include the International Medical Device Regulators Forum (IMDRF), the US Food and Drug Administration, Health Canada and Australia's Therapeutic Goods Administration. The MHRA will work with recognised international regulators to establish specific recognition and reliance arrangements for AI-enabled devices, building on proposals in its 2026 economic growth goals. These pathways are intended to support patient access and the UK medical-technology market. The response does not itself conclude a recognition agreement or make overseas approval automatically sufficient for UK access.

Under recommendation 10, the MHRA will use its co-chair role in the IMDRF cybersecurity working group to promote alignment and share learning with international regulatory partners. Recommendation 43 calls for lessons from international models when exploring a formal classification or pathway-confirmation service. Harmonisation is an implementation objective rather than incorporation of a foreign legal regime. The response does not impose EU AI Act duties or overseas classification rules. Four-nation domestic coordination remains a separate governance commitment, with devolved organisations involved throughout delivery.

Implementation Timeline

Compliance Checklist

Sources and References