United Kingdom - AI as Medical Device Guidance

Overview

The MHRA’s central guidance page, MHRA: Software and artificial intelligence (AI) as a medical device, explains how software products that meet the legal definition of a medical device are regulated in the UK. Originally published on 6 April 2023 and updated in October 2023, the document positions the Agency’s approach as risk-based, lifecycle-oriented, and aligned with international good practice. The guidance highlights that many AI/ML functions will be regulated as Software as a Medical Device (SaMD) or AI as a Medical Device (AIaMD) and sets expectations for intended purpose statements, clinical and performance evidence, risk management, and post-market surveillance. The Agency also introduced practical support measures — notably the AI-Airlock regulatory sandbox — and has published or linked to sector-specific and cross-cutting documents such as transparency principles and Predetermined Change Control Plan (PCCP) guidance with international partners. These materials aim to clarify regulatory expectations for manufacturers, authorised representatives, conformity assessment bodies and health system deployers while promoting proportionate oversight.

Definitions

Key terms used in the guidance include: 'Software as a Medical Device' (SaMD) — software intended to be used for medical purposes regardless of the hardware it runs on; 'AI as a Medical Device' (AIaMD) — SaMD that includes artificial intelligence or machine learning methods as part of its function; 'intended purpose' — the use(s), target population and clinical claims that determine classification and regulatory obligations; 'Total Product Lifecycle (TPLC)' — the full lifecycle from conception through post-market use, emphasising continuous monitoring; and 'Predetermined Change Control Plan (PCCP)' — a documented, bounded plan for anticipated model changes in learning systems. The MHRA guidance adopts or references internationally-aligned terminology (IMDRF, GMLP) and emphasises that functionality and intended purpose — not only technology labels — determine regulatory status.

Governance and Institutional Framework

The MHRA sits at the centre of UK device oversight and publishes guidance under government digital channels. MHRA’s Software Group coordinates work across pre-market, post-market, standards and specialist work packages within the broader Software and AI as a Medical Device Change Programme. The Agency has signalled closer operational alignment with other UK bodies (Department of Health and Social Care, NHS organisations) and international regulators. Resources include: the primary guidance page (software and AI guidance), MHRA communications on the regulatory sandbox AI-Airlock (AI-Airlock press release) and MHRA reports on AI’s regulatory impact. MHRA enforces obligations under the UK medical device legal framework (including retained and amended provisions of the Medical Devices Regulations and related instruments) and uses tools such as safety alerts, recalls and enforcement notices to protect patients.

Key Focus Areas

MHRA emphasises the following primary areas of focus: classification and conformity — ensuring appropriate risk-based classification (aligned with IMDRF SaMD approaches) based on intended purpose; evidence and clinical evaluation — robust clinical/performance evidence proportionate to risk; bias, generalisability and fairness — demonstrable evaluation and mitigation strategies for dataset bias and population applicability; lifecycle performance monitoring — continuous monitoring and reporting of real-world performance (with links to Yellow Card reporting and field safety communications); change management for adaptive systems — use of PCCPs (jointly guided with FDA and Health Canada) for planned model updates; transparency and explainability — publishing appropriate information on intended use, performance, logic and limitations (see transparency guiding principles); cybersecurity — building secure-by-design approaches and applying forthcoming cyber guidance; human factors — designing for the human-AI team; and standards & quality systems — applying QMS, documentation and recognized standards where available. The guidance stresses proportionate measures depending on risk and anticipated patient impact.

Implementation Framework

Manufacturers should first determine whether their software meets the medical device definition and then establish an intended purpose statement that determines classification. For pre-market conformity, high-risk products will require UK approved body involvement and technical documentation demonstrating compliance; lower risk software may follow other conformity pathways. For ML-enabled devices, a PCCP may be proposed to describe planned modifications, monitoring strategies, verification/validation protocols and impact assessments. MHRA advises implementation of quality management systems, human factors engineering, data governance and documentation to demonstrate compliance. The Agency encourages early engagement (including via the AI-Airlock sandbox) and use of international standards and guidance. Developers must maintain complete traceability, versioning and audit-ready documentation for regulatory review and post-market follow-up.

Monitoring and Evaluation

MHRA expects active post-market surveillance including reporting of adverse incidents (Yellow Card scheme), periodic performance reviews, monitoring for distributional shift or performance drift, and timely Field Safety Notices or corrective actions as needed. For adaptive AI, monitoring must include pre-specified performance metrics, triggers for rollback, and continuing evaluation to ensure benefits outweigh risks. The agency will use routine market surveillance, safety bulletins and targeted reviews; it also plans to strengthen legislative post-market obligations. The AI-Airlock practical pilots inform evaluation approaches and expected evidence-generation in real-world settings.

Penalties, Liability, and Appeals

Enforcement tools available to the MHRA include safety communications, field safety corrective actions, recalls and market withdrawal requests, suspension or refusal of conformity assessment outcomes, compliance and suspension notices, enforcement undertakings, civil monetary penalties and criminal prosecution where statutory provisions are breached. Liability for patient harm may arise under product liability regimes, civil negligence and statutory offences; manufacturers and other economic operators (authorised representatives, importers, distributors) have defined obligations. The MHRA publishes guidance on enforcement practices and uses established legal frameworks (Medical Devices Regulations and related amendments) to pursue remedies and, where appropriate, prosecutions.

Relationship to Other Instruments

The MHRA guidance does not replace the statutory Medical Devices Regulations; rather it interprets and supplements regulatory obligations with technical and operational advice. It references and aligns with IMDRF SaMD documents, Good Machine Learning Practice (GMLP) principles, and joint international outputs (for example, the PCCP guiding principles published with FDA and Health Canada). The guidance also cross-references UK cyber guidance, clinical standards, and NHS regulatory frameworks to reduce duplication and provide predictable routes to market and safe deployment across the health system.

International Alignment

MHRA emphasises harmonisation with international partners. The Agency jointly published and endorsed guiding principles for PCCPs with the US FDA and Health Canada and incorporated GMLP and IMDRF risk concepts into its approach. This alignment supports cross-border evidence acceptance, mutual recognition of standards, and shared expectations on transparency, bias mitigation and lifecycle monitoring. MHRA’s collaborations are intended to reduce duplicative burdens while raising global safety and trust for AIaMD solutions.

Implementation Timeline

Sources and References