.png){kind=logo}
On October 6, 2026 the UK Government published its response to the National Commission into the Regulation of AI in Healthcare. The response was produced by the MHRA as a joint response from the organisations that set and apply the rules for AI in UK health care, and it accepts all 44 of the Commission's recommendations. It also says plainly that, given how far AI has moved since the UK Medical Devices Regulations 2002 were drafted, the current medical device regulations are not fit for purpose.
We covered the Commission's own report when it came out in September, in The UK National Commission on AI in Healthcare. That report set the direction. The government response is where the UK commits to who does what, and by when. Below is what the response says, the dates that matter, and what it means if you are building software or AI-enabled medical devices for the UK market.
What the response is
The response is a 42-page policy paper with a ministerial foreword from James Frith MP, Parliamentary Under-Secretary of State for Health Innovation. It follows the Commission's three themes (proportionate lifecycle regulation, system-wide responsibility and safe management, and trust, transparency and predictability). For each of the 44 recommendations it records a decision, an initial action and a timeline. Every decision reads "Accept".
Most of the actions sit with the MHRA. The Department of Health and Social Care (DHSC), NHS England, NICE, the Health Research Authority (HRA), the Care Quality Commission (CQC), NHS Resolution and the devolved health departments and regulators carry the rest. The response groups the first year of work into ten priority areas.
- Modernise the regulatory framework for AI-enabled medical devices.
- Deliver equitable access and outcomes, with a focus on underserved populations.
- Shift toward stronger post-market assurance.
- Enable safe iteration and earlier patient access (PCCPs, staged authorisation, sandboxes).
- Create the conditions for safe real-world deployment, including risk controls.
- Build system capability and workforce readiness for AI.
- Strengthen accountability and a culture of safety and reporting.
- Strengthen transparency and public confidence.
- Improve regulatory clarity and navigability.
- Strengthen regulatory capability and the evidence base.
The dates that matter
Only two recommendations carry a dated deliverable of their own. Everything else is tied to the implementation plan.
- December 2026. The MHRA intends to issue draft guidance on predetermined change control plans (PCCPs) for public comment (Recommendation 6).
- Spring 2027. The MHRA intends to launch a consultation on a new approach to classification and qualification for software and AI-enabled devices, followed by secondary legislation (Recommendation 1).
- Spring 2027. An implementation plan and roadmap will set out roles, timelines and deliverables. Nearly every other recommendation reads "further details to be shared by Spring 2027".
- Annually after that. Progress updates, overseen by a new cross-system Programme Board that meets quarterly and reports quarterly to the Life Sciences Delivery Board.
What the government committed to
Qualification, classification and intended purpose
The Spring 2027 consultation is meant to lead to secondary legislation that introduces an updated definition of a medical device, with clearer lines (and possible carve-outs) for administrative, general wellbeing and certain decision support software. It would also bring in a classification approach that better reflects the benefits and risks of software and AI, and an updated definition of intended purpose so that device design, functionality and context of use are considered alongside the manufacturer's claims. While that work runs, the MHRA plans to update its guidance on medical device stand-alone software including apps. It will also consider draft guidance on enforcement discretion for sufficiently low-risk software and a function-based approach for multifunction products, so oversight focuses on the medical function.
PCCPs and change management
The draft PCCP guidance is the most concrete commitment in the document. The MHRA says it will describe an approach that lets manufacturers set boundaries that define the scope of allowable change, rather than only prespecifying individual modifications, including clear approaches for adaptive AI-enabled devices, while the device keeps its intended use. Recommendation 18 adds that monitoring and reporting processes should be built into PCCPs so safety and performance are tracked while a device iterates. The Commission's wider asks (site or subpopulation tuning, broad or goal-defined intended purposes, evidence-driven use expansion) are not individually addressed in the response, so the December draft is where to look for how far the MHRA will go.
General-purpose and foundation models
The MHRA will engage experts on what proportionate information about general-purpose AI models would support device safety and performance, may run a Master File pilot for general-purpose models or platforms, and will publish guidance on what a submission must say about a device's dependency on an underlying model (provenance, nature, dependencies, related risks and their controls). The MHRA will work with DHSC and the devolved health departments to build the same expectations into NHS procurement and contract terms.
Staged authorisation, sandboxes and reliance
The MHRA will explore staged authorisation pathways through proposed licensing powers and regulatory sandboxes, and will work with NICE so evidence generated during a staged authorisation can support economic assessment. The AI Airlock sandbox moves to phase 3, and the MHRA will support sandbox provisions in the upcoming Regulating for Growth Bill. On international reliance, the MHRA will work with recognised international regulators to set up recognition and reliance arrangements specific to AI-enabled medical devices, building on its relationships with FDA, Health Canada and the TGA.
Post-market surveillance and enforcement
This is where the response asks the most of manufacturers over time. It commits to an enhanced post-market surveillance toolkit that could be required individually or in combination, improvements to the Yellow Card scheme for software and AI, a public database where anyone can search adverse incident reports for medical devices (building on the drug analysis profiles the MHRA already publishes), guidance on mandatory UDI with practical requirements for software version control, and work to record device version in the electronic patient record. The MHRA will also explore automated reporting embedded in devices and patient record systems, and will implement the civil sanctions regime under the Medicines and Medical Devices Act, which allows financial penalties.
A guidance pipeline
Expect MHRA guidance on model cards and dynamic labelling, cybersecurity across the lifecycle, direct-to-consumer apps and wearables, human factors and usability, user-centred design, health equity and representative data (including children, women and ethnic minorities), and the operational conditions needed for safe deployment, with illustrative examples of risk controls.
Earlier advice and a clearer route
The MHRA will explore a structured route for written regulatory advice within indicative timescales (possibly by extending the joint MHRA and NICE Integrated Advice Service to devices), a formal service that gives a written determination of a product's regulatory status, interactive resources that map the regulatory journey, and a regularly updated public list of authorised AI-enabled medical devices in the UK. The HRA will clarify when evaluating or monitoring an AI tool counts as research, including silent local evaluation and in silico methods.
The system around the device
The rest of the response addresses deployment. A working group of DHSC, MHRA, CQC, NHS Resolution, the Professional Standards Authority and professional regulators will clarify roles across the lifecycle. DHSC will review how responsibilities are allocated in contracts between manufacturers and providers, extend AI readiness work alongside the Digital Technology Assessment Criteria (DTAC), strengthen guidance under the DCB0129 and DCB0160 clinical risk management standards, and consider how patients are told about AI in their care, including when opt-out may be feasible.
What this means for developers
Get ready to comment on PCCPs in December. A boundary-based PCCP is the direction in both the UK and the US. If you already have, or are building, a PCCP aligned to FDA's final PCCP guidance for AI-enabled device software functions, review it against the MHRA draft when it lands and use the comment window. A change-control design built on performance envelopes, prespecified test methods and monitoring thresholds is the version most likely to work in both markets.
Pressure-test your intended purpose and UK classification now. If intended purpose is judged on design, functionality and context of use, a product that does more than its labelling says will be assessed on what it does. If your UK plan relies on a low classification today, model what changes under a risk and benefit based rule set, and be ready to respond to the Spring 2027 consultation.
Write down the operational conditions for safe use. The Commission asked the MHRA to require manufacturers to state, in pre-market submissions and risk management files, the controls that must exist where the device is used. The response starts with guidance and says the MHRA will consider how this should be reflected in future requirements. Combined with the commitment to clearer contractual allocation of responsibilities between manufacturers and NHS providers, this belongs in your risk management file and your customer contracts either way.
Inventory your model dependencies. If your device is built on a third-party general-purpose model, document its provenance, versioning, risks, mitigations and continuity plan. The same information will be asked for in submissions and in NHS procurement.
Build traceability and monitoring into the product. UDI with software version control, version recorded in the patient record, automated reporting, a public incident database and financial penalties all point the same way. Logging, drift detection and in-product feedback are easier to design in than to retrofit.
Watch the reliance arrangements. For companies with an FDA authorisation, an AI-specific UK reliance route could change the timing and cost of UK entry. The response commits to building these arrangements but gives no date beyond Spring 2027 for further detail.
Use early engagement when it opens. A structured written advice route and a formal classification service would let you settle qualification and pathway questions before committing to a submission strategy.
Caveats
Accepting a recommendation is a commitment to act on it, not a rule change. Most actions are framed as "explore" or "consider", the detail is promised for Spring 2027, and changes to UK MDR 2002 depend on secondary legislation and proposed new licensing powers that take time. In places the response is narrower than the recommendation. Operational conditions start as guidance rather than a requirement, and the responsibility working group "will not determine or redistribute responsibilities". Delivery also depends on many organisations across four nations moving together, which is why the governance structure gets its own section in the paper.
The bigger picture
With this response, the UK has moved from a set of recommendations to a delivery program with named owners, a governance board and dated first steps. Read alongside our posts on the MHRA's 2026 reforms and the Commission's recommendations, it describes a UK system where pre-market authorisation is the start of the evidence obligation, change is managed within agreed boundaries, and post-market performance is visible to regulators and the public. For how change control works under FDA today, see our PCCP guide.
The full government response is in the Cosm resources library, next to the Commission's report. The HTML version is on GOV.UK.
How Cosm Can Help
Cosm works with developers of AI/ML-enabled medical devices and SaMD on regulatory strategy in the US, EU and UK, including intended purpose and classification, PCCP design, post-market surveillance planning, cybersecurity documentation, and early engagement with regulators. If you want to assess how these UK changes fit your product roadmap, or prepare comments on the MHRA's draft PCCP guidance, contact us or visit cosmhq.com.
Disclaimer - https://www.cosmhq.com/disclaimer
