AI Medical Devices in Great Britain: What the MHRA's Response to the National Commission Means for Manufacturers

The UK has chosen not to adopt an all-encompassing set of legislation similar to the EU’s AI Act. Instead, the UK Government has consistently stated that it will regulate AI as necessary and by sector.  

The UK’s National Commission into the Regulation of AI in Healthcare (“Commission”) published a report in September 2026 with recommendations for a future regulatory framework for the use of AI in healthcare, to which the Medicines and Healthcare products Regulatory Agency (MHRA) responded in October 2026.  We set out below our thoughts on the changes we might expect to see as a result in the regulation of medical devices in Great Britain.

More changes to definition of software as a medical device (SaMD) requiring regulation

Currently whether software qualifies as a medical device is country dependent.  The UK will be looking to provide its own, different definition that accords with the findings of the Commission.  Perhaps they are kicking the can down the road, but the MHRA intends to launch a consultation in Spring 2027 on “achieving a new and proportionate approach on classification and qualification of software and AI enabled devices”. 

The MHRA state that they will want factors such as “device design, functionality and context of use” to be “adequately considered”, which will perhaps lead to a widening of the types of devices caught in the SaMD net.  This is in line with recommendation 4 of the Commission which proposes a “function based” approach to regulation.  

The consultation will be followed by legislation and guidance. The MHRA will then consider how the changes in legislation and guidance operate through into their enforcement discretion.  They have said that they intend to implement civil sanctions which have previously been legislated for in the Medicines and Medical Devices Act 2021, but not yet applied. We can expect this regime to apply to all medical devices – meaning notices with fixed dates for compliance and fines if companies fail to do so.  This will be a step-change in enforcement that companies will need to get used to, but will only be effective if backed by additional headcount in the MHRA to issue the notices and fines.

Regulatory system changes

As a breath of fresh air (and a positive change over the EU system), the MHRA is exploring options to provide more predictable regulatory advice and clarity on the applicable regulatory pathway.  This includes structured mechanisms for submitting questions with written feedback in response.  Even more helpful will be a system for obtaining confirmation from the MHRA of classification of a device.

Perhaps more controversially the MHRA is planning to itself take on licensing powers and plans to apply these to introduce staged authorization pathways.  This is completely new territory compared with the EU regulatory system for medical devices.  

Regulatory sandboxes will be a key part of the regulatory system and these already operate via the MHRA’s AI Airlock programme.  We can expect for sandboxes to be developed further with the intervention of the Department for Business, Innovation, Science and Trade.  The expectation is that sandboxes will eventually also feed data into the assessment of value through the National Institute for health and Care Excellence (NICE) (technology assessment for deployment in the NHS).

The Commission has proposed that regulation should also be harmonized internationally, in particular with the US (FDA), Canada (Health Canada) and Australia (Therapeutic Goods Administration).  Given this requires a level of political will, we will need to wait and see if this happens.

Lifecycle based and flexible approach to device changes

The mainly certification-based approved body system (notified body in the EU) provides for certification every five years plus audits in the interim period.  Given that AI-enabled devices will be subject to continuous changes, it is perhaps obvious that the regulatory system will need to be less rigid.

It will instead need to provide a flexible system for on-going post-market oversight.  The challenge will be to create a system that is effective without stifling innovation.  It will be interesting to see whether the MHRA creates a novel system for PMS for AI devices. 

Predetermined change control plans are increasingly accepted as a methodology for a less rigid approach to software changes and which the MHRA intends to adopt via guidance to be published by the end of 2026.

Bias

Bias in medical settings has been the subject of previous government reports:  featuring in both the Independent Medicines and Medical Devices Safety Review (Cumberledge Report) and the independent review into equity in medical devices. The Government will issue guidance to manufacturers for how they should address expectations for including representative data and unbiased performance across relevant groups.

General purpose models

The MHRA will develop guidance for manufacturers on general purpose models, some of which are already providing many individuals with healthcare diagnoses and advice.  It is anticipated that general purpose models will be increasingly used by the NHS, so that the MHRA will work with the UK Department of Health to include appropriate provisions in procurement processes and contract terms for the protection of patients and users.

Engaging with users

Transparency of the use of AI in decision-making is a big theme in much AI legislation.  The MHRA will turn to guidance to inform manufacturers how to develop tools such as model cards and dynamic labelling, as well as to deal with human factors, user-centered design and direct-to consumer applications.  Where the NHS uses AI-enabled devices, patient optionality might need to be built in, although if the device is part of a clinical pathway and provides what is considered the most clinically effective treatment, query whether that will really be an effective “option” for patients.  The MHRA will also supply new guidance on user-centered design for AI-enabled medical devices.

The MHRA intends to create a public-facing searchable database for adverse incidents for all medical devices.  They also intend to engage with patient groups and the public on tailoring safety information to their needs.  They will consider legislating on the presentation of information provided to the public for AI-enabled medical devices, which could mean different labelling requirements for Great Britain.

Engaging with the NHS

The MHRA intends to work closely with the Department of Health and the relevant entities in the devolved nations to evolve best practices for the national health service in its engagement with AI systems including strengthening guidance under the standards DCB0129/0160.  They will also support a coordinated approach to AI literacy and training, which should be helpful to manufacturers as they engage with the NHS and respond to procurements for their devices.  The MHRA will help develop the guidance for how developers and manufacturers should consider the needs of those deploying the devices, all of which will be helpful if it is not too prescriptive.

Feedback

The MHRA has said that it will create best practice for monitoring and enforcement, sharing of feedback and data to be transparent and timely, and improving the Yellow Card scheme to take account of AI-enabled medical devices, perhaps integrating such feedback into the devices.  This marries up with the cultural changes proposed in the health systems for greater reporting on AI product experience.

Conclusion

The MHRA has a lot of work if it is to create a new regulatory system focused on AI-enabled medical devices, together with additional guidance, taking into account all 44 recommendations of the Commission.  For all medical device manufacturers though, it is clear that the MHRA intends to construct a system which leads to greater reporting of incidents and complaints and in which the MHRA will acquire more teeth in its enforcement activities.  Proposals for new legislation addressing the Commission report are expected following further consultation in Spring 2027, although guidance might be expected to be published on a rolling basis from the end of 2026. 

Please click here for insights on the privacy, data protection, cyber security and AI implications of the Commission Report.

Subscribe to Ropes & Gray Viewpoints by topic here.