Summary

• The MHRA's 19 October announcement sets out its developing approach to medical AI ahead of an AdvaMed presentation on 20 October.
• Its plans include adaptive regulation, post-market monitoring, regulatory sandboxes, improved device traceability, and a proposed Centre for AI and Digital Health.
• The government has accepted 44 recommendations on healthcare AI, but acceptance does not mean every proposed regulatory reform has been implemented.

Britain’s medical technology regulator is developing a framework for overseeing artificial intelligence devices throughout their operating lives, responding to the difficulty of assessing software whose performance may change after it enters clinical use.

The Medicines and Healthcare products Regulatory Agency has outlined its approach ahead of an international medical technology conference on 20 October. Its plans combine regulatory sandboxes, more flexible lifecycle oversight, stronger monitoring after deployment, and cooperation with overseas authorities.

The work follows the publication of the Medicines and Healthcare products Regulatory Agency’s 2030 Strategy on 14 October and the government’s decision earlier in the month to accept all 44 recommendations from the independent National Commission into the Regulation of AI in Healthcare.

Those announcements establish the direction of future regulation, but accepting recommendations and publishing a strategy are not equivalent to introducing every proposed requirement into law. Manufacturers and healthcare providers must continue to comply with the rules applicable to their products while the framework develops.

Software updates complicate traditional oversight

Medical devices are assessed against requirements related to their intended purpose, safety, performance, and the evidence supporting their use. Manufacturers must demonstrate that their products satisfy the applicable regulatory conditions, while responsibilities continue after a device is placed on the market.

AI-enabled software can make that process more complicated because performance may depend on the data used to develop a model, the clinical environment in which it operates, and changes made after its initial assessment.

An application intended to examine diagnostic images, for example, could perform differently when used with equipment or patient populations that were poorly represented during development. Even without a software update, changes in the information supplied to the model may influence the reliability of its output.

Updates introduce another source of uncertainty. A modification intended to improve performance for one clinical use could affect results elsewhere, requiring developers to establish which changes are acceptable and when further evidence is needed.

The MHRA wants regulation to address those circumstances throughout the product lifecycle rather than concentrating exclusively on the evidence available before initial deployment.

That does not mean allowing medical AI to change without supervision. Developers will still need to maintain appropriate technical and clinical evidence, while healthcare organisations must understand how systems are monitored and what happens when performance deteriorates.

The proposed approach could give manufacturers clearer expectations about managing updates, but its practical requirements will depend on the detailed rules and guidance subsequently introduced.

AI Airlock tests regulatory problems in practice

The MHRA is already using its AI Airlock sandbox to investigate how existing regulation applies to particular medical AI technologies.

The programme brings developers, regulators, and relevant specialists together to examine technical and regulatory questions under controlled arrangements. Earlier phases explored problems involving software development, clinical applications, evidence generation, and the oversight of AI-enabled devices.

Its second-phase report described seven innovator case studies and provided findings intended to inform future regulatory policy. The report does not itself constitute formal MHRA guidance.

The third phase, opened for applications in October, places greater emphasis on post-market surveillance: how devices can be monitored once they are being used by healthcare organisations and how changes in safety or performance should be identified.

Such monitoring requires information from actual deployment environments. Laboratory performance may differ from clinical experience because operating procedures, patient characteristics, technical infrastructure, and the way healthcare professionals use an application can all affect its results.

The MHRA is also developing regional partnerships, including work involving NHS London and Manchester University NHS Foundation Trust, to bring regulatory testing closer to real healthcare settings.

Those collaborations may provide evidence about integration and operational behaviour, but participation does not amount to automatic market authorisation or a commitment that the NHS will purchase a particular technology.

For developers, the value lies in understanding regulatory expectations before committing substantial resources to commercial deployment. Healthcare organisations, meanwhile, need evidence that a product remains suitable when used under the practical conditions of clinical care.

Device traceability supports ongoing safety

The MHRA’s strategy includes plans to improve the identification and traceability of medical devices, particularly where software versions and updates may influence their behaviour.

Being able to establish which version of an AI system was operating at a particular time can help investigators determine whether a reported incident relates to the device, its configuration, or another part of the clinical process.

Without reliable version records, two hospitals might appear to be using the same product while operating systems with materially different capabilities or performance characteristics.

The National Commission recommended stronger mechanisms to identify AI-enabled devices after deployment, alongside clearer responsibilities for reporting and investigating safety concerns.

The government has accepted those recommendations, but individual measures remain subject to implementation. Proposed tools for monitoring performance and improving public access to safety information should not be described as services already available in their final form.

Greater traceability could also support purchasing and deployment decisions. Hospitals considering AI applications need to understand the version being evaluated, the clinical conditions under which it was tested, and the evidence available for its intended use.

These requirements become more important where software is supplied through complex commercial arrangements involving device manufacturers, developers, cloud providers, and healthcare organisations.

Clear accountability will be necessary to establish who is responsible for maintaining the product, documenting changes, and responding when an incident is reported.

International cooperation does not transfer approvals

The MHRA is strengthening cooperation with the US Food and Drug Administration through its Pioneer Programme, announced in June.

The arrangement creates reciprocal liaison roles to support communication, scientific exchange, and coordination on emerging regulatory issues. The MHRA is recruiting a senior representative based in Washington to work directly with the FDA.

Closer cooperation could make it easier for manufacturers to understand regulatory expectations across different markets and avoid duplicating some scientific work unnecessarily.

However, the partnership does not provide automatic recognition of all medical device approvals. The MHRA and FDA retain responsibility for making their own regulatory decisions.

That distinction is important because comparable evidence requirements do not necessarily produce identical legal outcomes. Products intended for different healthcare systems may also face distinct conditions concerning their permitted use, monitoring, and information governance.

The MHRA’s longer-term strategy envisages expanding reliance and recognition arrangements with trusted international regulators, including the FDA. The specific mechanisms and their scope still require further development.

Implementation will determine the commercial effect

Medical AI developers face substantial costs when gathering clinical evidence, establishing technical controls, and preparing products for regulated use. Uncertainty over how software updates will be treated can add to those costs, particularly where a product must be assessed in several international markets.

More predictable rules could assist investment decisions, although faster processes must still provide sufficient evidence of safety and effectiveness.

The MHRA also intends to establish a Centre for AI and Digital Health, bringing expertise and clearer regulatory expectations into an area where technical capabilities are developing quickly.

The agency’s strategy combines these proposals with a wider effort to modernise regulatory services and use better data to identify safety risks. The resulting changes will require funding, technical expertise, and workable processes within the regulator itself.

For healthcare providers, the relevant test is whether the framework supports informed decisions about introducing medical AI while maintaining effective oversight after deployment.

That requires clarity about who can authorise changes, how performance is assessed, and how concerns are investigated when a system is operating within an established clinical service.

Jessica Paulsen, the MHRA’s Deputy Director for AI and Software, is scheduled to outline the developing approach at AdvaMed on 20 October. The detailed regulatory requirements and their implementation timetable will determine how far the programme changes the route from medical AI development to routine clinical use.