Ten Takeaways From the UK Government’s Strategy For AI Regulation in Healthcare

Artificial intelligence is moving from the margins of healthcare into its everyday operation — from tools that summarise clinical records and support diagnostic decisions, to systems capable of undertaking multi-step tasks with limited human involvement. As these technologies become more closely integrated with patient records, hospital networks and clinical workflows, the questions they raise extend to how patient data is used to develop and monitor AI systems, who is responsible when those systems change or fail, and how patients are informed about their use. 

The UK Government’s response to the National Commission into the Regulation of AI in Healthcare (Commission) offers an important indication of how these questions are likely to be addressed in the UK. On 6 October 2026, the Government accepted all 44 recommendations made in the Commission’s September 2026 report. The recommendations envisage a significant evolution in the UK’s approach to regulating AI in healthcare, moving towards a more proportionate, risk-based and lifecycle-focused framework.

Although much of the report addresses the regulation of AI-enabled medical devices, the recommendations also raise important questions about the processing of health data, transparency to patients, allocation of responsibility between AI developers and healthcare providers, cybersecurity and the governance of AI systems throughout their lifecycle. These issues are relevant to pharmaceutical and life sciences companies, healthcare providers, medical technology developers and other organisations developing, supplying or deploying AI-enabled healthcare solutions.

The Government’s acceptance of the recommendations does not introduce new binding legal requirements or amend existing laws, and the proposed measures will require further regulatory guidance, consultation or legislative change. Nevertheless, the response shows the direction of UK healthcare AI regulation and its increasingly close relationship with existing data protection obligations. Against that background, this article considers the ten recommendations made by the Commission that are most relevant from a privacy, data protection, cybersecurity and AI governance perspective.

1. Greater transparency about the use of AI in patient care (Recommendation 35)

The Commission recommends that healthcare organisations adopt a proportionate approach to explaining when AI-enabled products are being used, taking account of patients’ reasonable expectations of being informed and their ability to opt out where possible or appropriate. 

The Government has accepted the recommendation and will consider how existing information governance requirements could be supplemented to clarify transparency expectations, the choices available to patients and how these considerations apply to different AI functionalities. It will also consider when opt-out arrangements may be feasible and appropriate, particularly where AI functionality forms an integral part of a clinically approved medical device or care pathway, and how any such arrangements should be balanced against clinical effectiveness, equitable access and patient safety considerations.

This recommendation has clear implications under the UK General Data Protection Regulation (UK GDPR), including the transparency and fairness principles under Article 5 and the information requirements under Articles 12 to 14. (The applicable information requirements depend, among other things, on whether personal data is collected directly from the individual or obtained from another source.) There is also an important distinction between a patient’s ability to opt out of AI-assisted care and the legal basis relied upon to process their personal data.

Healthcare organisations may rely on lawful bases other than consent, and an opt-out from AI-assisted care does not automatically equate to withdrawal of consent under the UK GDPR. Organisations should therefore consider whether their existing transparency arrangements adequately distinguish between the use of AI in clinical decision-making, the processing of personal data and the choices available to patients. They should also avoid implying that patients have an unconditional right to opt out of every use of AI, where that is not supported by the applicable legal or clinical framework, and any available choices should be explained accurately and accessibly.

2. Clarifying the use of patient data for AI evaluation and monitoring (Recommendation 44)

Recommendation 44 is significant for organisations seeking to develop, deploy, evaluate and improve AI systems using healthcare data, given that the Commission identifies uncertainty about when the development, deployment, evaluation and monitoring of AI technologies constitute research requiring research governance, as opposed to activities governed through other mechanisms.

The Government has accepted the recommendation and confirmed that the Health Research Authority (HRA) will build on its existing guidance to address emerging evaluation approaches and clarify when real-world evaluation or use of an AI tool constitutes research requiring research governance. The guidance will also signpost relevant data protection, confidentiality and information governance requirements and align with both Medicines and Healthcare products Regulatory Agency (MHRA) and wider system guidance.

From a data protection perspective, the distinction raises important questions about the secondary use of patient data. For example, an AI system initially deployed to assist clinical decision-making may subsequently be evaluated using patient records to assess its accuracy, identify performance deterioration or support further development. Although these activities may be closely related operationally, they may involve different processing purposes, legal bases and safeguards. They will not necessarily constitute different purposes in every case; that assessment depends on the original purpose, the nature of the subsequent processing and the applicable legal requirements.

Organisations will need to consider the purpose limitation principle under Article 5(1)(b) of the UK GDPR, the availability of an appropriate Article 6 lawful basis and Article 9 condition (together with any associated condition under Schedule 1 to the Data Protection Act 2018 if required by section 10 of the Act) for processing special category health data, and whether any research-related provisions or exemptions apply. The common law duty of confidentiality must also be considered separately. A lawful basis under the UK GDPR does not, of itself, establish that the use or disclosure of confidential patient information is permissible.

Where an organisation relies on a research-related condition or safeguard, it must establish that the applicable statutory requirements are met — and describing an activity as research is not sufficient. The same applies to any reliance on provisions permitting further processing for scientific research purposes. The relevant conditions and safeguards must be assessed in the context of the particular processing activity.

Importantly, classification as research does not automatically authorise the processing of personal data, while classification as non-research does not remove the need to comply with data protection and confidentiality requirements. The forthcoming HRA guidance may therefore be particularly relevant to life sciences companies and AI developers seeking to use real-world healthcare data to evaluate and improve their products.

3. Clearer allocation of responsibility across the AI supply chain (Recommendation 24)

The Commission recommends that the Department of Health and Social Care (DHSC) and relevant healthcare organisations across England and the devolved authorities work together to ensure that responsibility at each stage of the AI product lifecycle is clear and appropriate to the parties’ respective roles.

The Government has accepted this recommendation and confirmed that a working group will include the DHSC, the MHRA, the Care Quality Commission and equivalent organisations in the devolved authorities, NHS Resolution, the Professional Standards Authority and professional regulators. The group’s purpose is to clarify responsibilities while recognising each organisation’s statutory remit. Importantly, the group will not determine or redistribute responsibilities.

This is a notable development given the increasingly complex relationships involved in healthcare AI deployments. For example, an AI-enabled clinical tool may involve a foundation model provider, a specialist software developer, a healthcare technology supplier and a hospital or other healthcare provider. Each may exercise different levels of control over the system and the personal data it processes.

From a UK GDPR perspective, the allocation of responsibility will depend on the factual circumstances, including which organisations determine the purposes and means of processing personal data. A supplier described contractually as a processor may, for example, act as an independent controller in relation to certain processing activities where it determines its own purposes, such as some forms of model development. However, the use of data for product improvement does not, by itself, establish that a supplier is an independent controller, and the actual purposes, decision-making arrangements and applicable legal restrictions must also be examined.

Equally, responsibility for the clinical safety or regulatory compliance of an AI-enabled product should not be confused with controller or processor status under data protection law. Organisations should review whether their contractual arrangements accurately reflect the respective responsibilities of the parties, including in relation to data access, security, incident reporting, model improvement and the exercise of data subject rights.

4. National expectations for AI governance and organisational readiness (Recommendation 30)

The Commission recommends national leadership from the DHSC (working with the devolved health departments) to address regional inconsistencies in healthcare organisations’ readiness to adopt and govern AI.

The Government has accepted the recommendation and intends to provide national direction on AI readiness, adoption and governance, including through sharing best practices and lessons learned. This reflects a broader regulatory emphasis on ensuring that organisations have appropriate governance arrangements before deploying AI systems.

For organisations processing personal data, the UK GDPR already establishes an accountability framework requiring compliance to be demonstrated. Depending on the nature of the processing, this may include data protection impact assessments (DPIAs), appropriate policies, technical and organisational safeguards and clear internal responsibilities. In practice, organisations may benefit from coordinating their AI governance arrangements with existing privacy compliance frameworks, rather than developing entirely separate processes. For healthcare organisations, this could include maintaining an inventory of AI systems, identifying the individuals responsible for approving deployments, establishing risk assessment procedures and periodically reviewing whether systems continue to operate within their intended parameters.

Although Recommendation 30 does not establish a new statutory AI governance regime, it signals that organisational preparedness will be an increasingly important component of the UK’s approach to healthcare AI.

5. Managing AI systems throughout their lifecycle (Recommendation 31)

Recommendation 31 calls for the DHSC and the devolved health departments to provide national best practices addressing the lifecycle management of emerging AI technologies, including agentic systems, to support providers across the ecosystem.

The Government has accepted the recommendation and will explore opportunities to provide national best practices covering the procurement, implementation, monitoring, reporting and end-of-life management of AI-enabled technologies. This will include strengthening existing clinical risk management guidance under DCB0129/0160, as well as technology-specific guidance where further clarity is needed. The Government states that this work could align with the statutory code of practice on AI and automated decision-making being developed by the Information Commission (ICO).

A central challenge is that AI systems may evolve considerably after their initial deployment. Changes to underlying models, datasets, functionality or integration with other systems can alter the nature and risks of personal data processing. For example, a system initially used to summarise clinical records may subsequently acquire functionality enabling it to retrieve additional patient information, communicate with external services or initiate actions with limited human involvement. Such changes may require organisations to revisit their DPIAs, assess whether processing remains compatible with its original purposes, review access controls and consider whether additional transparency measures are necessary.

The reference to agentic AI is noteworthy. Systems capable of undertaking multi-step tasks autonomously may create additional challenges concerning accountability, data minimisation and the effective implementation of human oversight. Organisations should therefore regard privacy and AI governance as continuing obligations throughout the lifecycle of a system, rather than exercises completed only at procurement or initial deployment.

6. Training and human oversight (Recommendation 33)

The Commission recommends that healthcare providers ensure professionals and other staff are well equipped to use AI technologies by undertaking appropriate training, including with systems incorporating automated decision-making functionality.

The Government has accepted the recommendation and intends to support providers in meeting existing training obligations set out by professional regulators and/or required by risk management standards, drawing on established NHS and wider government resources.

The Data (Use and Access) Act 2025 amended the UK GDPR’s automated decision-making framework, replacing the former Article 22 provisions with Articles 22A to 22D. Article 22A addresses significant decisions based solely on automated processing and defines the relevant concepts, including the significance of a decision and the circumstances in which meaningful human involvement exists. Articles 22B and 22C provide for restrictions and safeguards in relation to significant decisions based solely on automated processing, including specific restrictions where special category personal data is involved. Article 22D gives the Secretary of State powers to make regulations concerning the preceding provisions.

These provisions are not engaged merely because AI is used at any point in a clinical workflow. Rather, their application depends on the nature of the decision, its effect on the individual and whether the decision is based solely on automated processing within the meaning of the legislation. In healthcare, particular care is needed where an AI output determines, or contributes to, a decision affecting diagnosis, treatment, access to services or another matter with a legal or similarly significant effect.

However, the mere presence of a human in a decision-making process does not necessarily establish meaningful human involvement. The assessment should focus on the substance of the human role, including whether the individual can genuinely assess the output, exercise independent judgment and change the outcome, rather than simply approving an automated recommendation. Training should also address practical data protection risks, including the inappropriate disclosure of patient information to AI systems and the use of AI tools outside approved organisational arrangements.

7. Managing changes to adaptive AI systems (Recommendation 6)

The Commission recommends clearer regulatory approaches to changes in adaptive and continuously learning AI-enabled medical devices.

The Government has accepted the recommendation, and the MHRA intends to issue draft guidance on predetermined change control plans for public comment by December 2026. The proposed approach would allow manufacturers to establish boundaries for permissible changes while maintaining a device’s intended use.

Although primarily directed at medical device regulation, the proposal has important implications for data protection governance. Changes to an AI system may affect the categories of personal data processed, the purposes for which data is used, the accuracy of outputs or the risks posed to individuals. For example, retraining an AI system using additional patient datasets may raise questions about the compatibility of the processing with the original purposes for collection, the availability of an appropriate lawful basis and the need for updated safeguards. Similarly, adapting a system to operate across different patient populations may require renewed consideration of data quality, representativeness and the risk of discriminatory outcomes.

Regulatory approval of changes to an AI-enabled medical device should not be treated as automatically establishing compliance with data protection law. Organisations should therefore ensure that their change management procedures address both product regulatory requirements and the potential implications for privacy, fairness and accountability.

8. Cybersecurity throughout the AI product lifecycle (Recommendation 10)

The Commission recommends that the MHRA should provide clear guidance and educational resources on cybersecurity expectations across the product lifecycle for software and AI-enabled devices, and identifies cybersecurity as a critical component of the safety and effectiveness of software and AI-enabled medical devices. 

The Government has accepted this recommendation and confirmed that the MHRA will issue draft cybersecurity guidance and educational resources addressing security throughout the product lifecycle. This is especially relevant given the increasing connectivity of healthcare AI systems and their potential integration with clinical records, hospital networks and other medical technologies. Cybersecurity failures involving such systems may have consequences extending beyond the confidentiality of personal data. They may also affect the integrity of clinical information, the reliability of AI outputs and, ultimately, patient safety.

Under Article 32 of the UK GDPR, controllers and processors must implement security measures appropriate to the risks associated with personal data processing. For AI-enabled healthcare technologies, relevant considerations may include secure development practices, access management, vulnerability testing, supplier assurance, protection against unauthorised modification of models and appropriate monitoring of system behaviour. 

Organisations should also consider the extent to which existing contractual arrangements address security responsibilities across the AI supply chain, including vulnerability management and the communication of security incidents. The forthcoming MHRA guidance may help clarify how cybersecurity expectations specific to AI-enabled medical devices interact with existing data protection security obligations.

9. Reporting AI incidents and adverse outcomes (Recommendation 34)

Recommendation 34 seeks to strengthen the reporting of adverse outcomes, product malfunctions and other experiences associated with AI technologies throughout their lifecycle.

The Government has accepted the recommendation and intends to work with regulators and healthcare organisations to improve reporting mechanisms (for medical devices and relevant non-device AI tools), including the MHRA’s Yellow Card scheme.

For privacy and cybersecurity professionals, this raises the question of how AI-related incidents should be assessed under different regulatory frameworks. An AI system that produces an inaccurate clinical recommendation may give rise to patient safety or product reporting considerations without necessarily involving a personal data breach. Conversely, unauthorised access to patient records through an AI application may constitute a personal data breach even where there is no evidence of an adverse clinical outcome.

Some incidents may engage both frameworks. Organisations should therefore ensure that their incident response procedures distinguish between AI performance incidents, cybersecurity events, personal data breaches and reportable medical device incidents, while providing appropriate mechanisms for escalation and coordination. Where a personal data breach occurs, the notification requirements under Articles 33 and 34 of the UK GDPR will need to be assessed separately, including the applicable risk thresholds (notification to the ICO being required unless the breach is unlikely to result in a risk to individuals, and notification to individuals being required only where the breach is likely to result in a high risk) and reporting deadlines (notification to the ICO being required without undue delay and, where feasible, not later than 72 hours after becoming aware of the breach, and notification to individuals being required without undue delay).

10. More coordinated guidance across regulators (Recommendation 41)

Finally, Recommendation 41 calls on regulators to make the regulatory and assurance framework for healthcare AI easier for developers and manufacturers to navigate through the development of clear, accessible, public-facing educational resources and tools within their scope of activities.

The Government has accepted the recommendation and confirmed that the MHRA will work with other organisations, including the ICO, the Care Quality Commission, the National Institute for Health and Care Excellence and the HRA, to explore more accessible regulatory resources.

The involvement of the ICO is significant. Healthcare AI developers may be subject to overlapping requirements concerning medical device regulation, data protection, confidentiality, cybersecurity and clinical governance. Compliance with one framework does not necessarily establish compliance with another. For example, a system may satisfy applicable medical device requirements while still raising questions about the lawfulness of its use of patient data or the transparency of its processing activities.

Greater coordination between regulators could therefore help organisations understand how different requirements apply across the development and deployment lifecycle. However, the government’s response does not propose merging the relevant regulatory regimes or removing their distinct statutory requirements. Organisations will continue to need to identify and address the obligations applicable to their products, processing activities and roles within the healthcare AI ecosystem.

What should organisations do now?

The recommendations are a programme for future regulatory development rather than a set of immediately applicable new obligations. However, the government’s response marks an important step towards a more coordinated and lifecycle-based approach to healthcare AI regulation.

Organisations developing or deploying healthcare AI should therefore consider whether their existing governance arrangements adequately address the issues identified by the Commission. In particular, they may wish to review their approaches to patient transparency, the secondary use of health data, allocation of responsibilities across the AI supply chain, cybersecurity, incident response and ongoing oversight of AI systems. Organisations should also monitor the forthcoming regulatory developments, including further details of the government’s implementation programme, which are expected by spring 2027.

The broader significance of the government’s response is that healthcare AI regulation is increasingly being envisaged as an ongoing exercise in governance and assurance, rather than a single assessment conducted before a product enters the market. For organisations developing and deploying healthcare AI, that approach reinforces the importance of integrating data protection, cybersecurity and AI governance considerations throughout the technology lifecycle.

Please click here for insights on what the Commission Report and the MHRA's response mean for manufacturers of AI-enabled medical devices.

Subscribe to Ropes & Gray Viewpoints by topic here.