Recent weeks have proved of great interest to the UK medical device industry, with various key developments emerging. Foremost among these, on 10 September 2026, the National Commission into the Regulation of AI in Healthcare (“National Commission”) published its report on recommendations for a future regulatory framework (“Report”). The Report contains 44 recommendations, including several of particular relevance to developers of AI health technologies. The Government subsequently responded on 6 October 2026, confirming that it intends to implement all the National Commission’s recommendations.
In addition, several amendments to the UK Government’s proposed Health Bill were announced in September. These included an amendment tabled by the Secretary of State for Health and Social Care that would create a new legal basis for regulating medical devices in Great Britain through a licensing framework.
Most recently, on 21 October 2026, the UK Government confirmed it will continue to recognize CE marked medical devices and in vitro diagnostic devices placed on the Great Britain market indefinitely.
We discuss these developments and their potential impact on the UK regulatory landscape below.
I. National AI Commission Recommendations
A. Background
The UK Medicines and Healthcare products Regulatory Agency (“MHRA”) established the National Commission in September 2025 to advise on adapting the regulatory framework for the use of AI in healthcare. The National Commission published the Report in September 2026 with an extensive list of recommendations.
On 6 October 2026, the UK Government announced its commitment to publishing a full implementation roadmap for the National Commission’s 44 recommendations by Spring 2027, setting out specific timelines and responsibilities for implementation. The MHRA will also issue draft guidance by December 2026 on “a new approach to managing changes to AI-enabled medical devices as they adapt and improve over time, moving towards a regulatory system that is designed to maintain safety while supporting timely access to innovative devices.” Early next year, the MHRA will also consult on how to qualify and classify AI-enabled medical devices.
We discuss below a number of the key recommendations that may directly impact developers of AI-enabled medical devices, including proposed changes to the regulatory framework for AI medical devices, potential considerations for the use of general-purpose models, and some potential watch-outs.
B. Key Recommendations
1. Regulatory Framework
Key recommendations that could directly impact the regulatory framework relating to AI-enabled medical devices include:
- Proportionality, potentially though “enforcement discretion”-like concepts.
The Report focuses on proportionate regulatory oversight for AI-enabled medical devices. The National Commission suggests that one means of achieving this is to reduce requirements and/or oversight for devices where the available evidence indicates that the risk associated with them is “sufficiently low” (Recommendation 3). The National Commission suggests that this could include the application of concepts such as enforcement discretion, i.e., a policy adopted by regulators whereby they decide not to enforce specific rules, regulations, or penalties, usually for low-risk activities or resource prioritization purposes. This would be consistent with the approach of other international regulators, such as the US FDA. However, the National Commission makes clear that any such policies would need to be “signalled clearly” and “applied consistently.”
Separately, the National Commission recommends consideration of how to appropriately balance oversight and evidence expectations across the product lifecycle. For instance, the Commission suggests that the MHRA consider weighing the requirements for pre-market evidence against the real-world data monitoring that will be needed to reduce overall uncertainty for AI-enabled device safety and effectiveness (Recommendation 5).
- Flexibility.
The Report acknowledges that regulation must adapt to become more flexible and responsive to emerging technologies. The Report suggests that this should involve granting the MHRA enhanced flexibility as to the application of the medical device regulatory framework, such as the ability to impose additional safety requirements for devices where new evidence shows a need for this beyond what is covered by existing requirements (Recommendation 3).
Enhanced flexibility could also take the form of staged authorizations, whereby an AI-enabled medical device could be deployed within a tightly controlled scope, based on MHRA review of initial evidence to support device safety and agreed upon risk controls and reporting (Recommendation 14). The authorization could be expanded once the device meets certain prespecified evidence thresholds for performance and safety. This may accelerate the path to market for certain innovative AI-enabled medical devices.
- Greater focus on guidance and practical examples.
A further key theme within the Report is its emphasis on the provision of clear guidance and best practice examples to support developers of AI-enabled health products. For instance, the National Commission recommends that the MHRA should “systematically review and update” guidance with a view to clarifying (a) “which types of software and AI-enabled products are, and are not, medical devices,” (b) “the application of the risk-based classification system to relevant software and AI-enabled devices,” and (c) “how intended purpose is interpreted for software and AI-enabled devices,” alongside clear practical examples to support device qualification and post-market compliance (Recommendation 2).
This aim is also reflected in the Report’s suggestion that the MHRA update the existing UK Medical Devices Regulations 2002 (“UK MDRs”) to expressly clarify when certain software and AI-enabled products are regulated as medical devices, and when software intended for administrative purposes in a healthcare setting, general wellbeing purposes, and certain decision support purposes are not medical devices (Recommendation 1).
Further, the National Commission recommended that the MHRA should publish guidance on post-market risk controls featuring “redacted illustrative examples of risk controls that demonstrate good practice” (Recommendation 27).
In line with the focus on regulatory guidance, the National Commission recommends that the MHRA should introduce clearer, earlier and more predictable engagement mechanisms for developers and manufacturers, including early, written regulatory feedback or meetings on topics relating to device qualification, classification, the appropriate path to market, evidence requirements and post-market expectations (Recommendation 42). Building on this suggestion, the Report also recommends a formal “classification confirmation” service, enabling manufacturers to submit a short package and receive a written determination on a product’s regulatory status (Recommendation 43). This would provide regulatory clarity at the outset of a product’s pathway to market.
- Function-based approach.
To accommodate the often modular nature of technology incorporating AI, the National Commission stresses the importance of tailoring regulatory oversight to specific medical device functionalities within a product, rather than any non-medical device functionalities that may also be present (Recommendation 4). This may reduce the administrative burden of achieving medical device regulatory compliance for manufacturers of multi-function technology products.
- Refining Predetermined Change Control Plans.
To combat the challenge of implementing updates and changes to marketed software medical devices in a regulatory compliant manner, one approach is the use of Predetermined Change Control Plans (“PCCPs”). Such plans enable manufacturers and regulators to agree on prespecified changes to a medical device following its initial authorization and placing on the market. However, the National Commission notes in the Report that “[a]s more adaptive and context-dependent AI-enabled devices are developed, it will become more difficult and impractical to identify and assure changes during the pre-market stage within the current framework.”
As a result, the National Commission suggests providing clarity on the scope and implementation of PCCPs for software and AI-enabled medical devices. This could include replacing the requirement for manufacturers to prospectively define specific changes with an invitation to manufacturers to define clear boundaries and guardrails to establish the allowable scope of change (Recommendation 6). Such a policy would allow manufacturers considerably greater flexibility to rapidly update their devices as the underlying AI technology develops in innovative ways that may not have been specifically foreseen.
- Increased use of regulatory sandboxes.
The Report encourages the further use of regulatory sandboxes, such as the MHRA’s AI Airlock programme, to test regulatory approaches and best practices for novel technologies (Recommendation 15). In this respect, the UK Government’s response to the Report also announced that the MHRA is now accepting applications for Phase 3 of its AI Airlock. Applications must be submitted before 31 October.
- Reliance pathways and increased international harmonization.
The Report also recommends the introduction of recognition or reliance pathways for relevant devices with trusted international regulators (Recommendation 16). This reflects concepts outlined in a previous policy statement on this topic issued by the MHRA in May 2024 (see our blog post here) and last updated in March 2026. We note also that the MHRA announced the indefinite recognition of CE marked medical devices in Great Britain on 21 October 2026, following a consultation earlier this year (please see our blog post here).
2. Considerations for use of general-purpose models
Certain recommendations in the Report may, if implemented, impact medical device manufacturers whose products leverage third-party AI technology, such as general-purpose AI models:
- Master files for general-purpose AI models.
The Report suggests that the MHRA consider establishing an “opt-in ‘Master File’ approach” with respect to general-purpose AI platforms, foundation models or underlying technologies used by medical device developers (Recommendation 7). The intention is that these “Master Files” would be used to support the assessment of medical devices that incorporate or rely on such AI platforms or models. Whilst such a “Master File” may be useful in principle, it is unclear whether third-party developers of general-purpose models and platforms would be willing to share the requisite information with the MHRA in practice.
- Reporting of product dependencies on underlying general-purpose models.
In addition, the National Commission states that medical device manufacturers should be expected to report any underlying dependency of their devices on general-purpose AI models at the point of regulatory submissions or when entering procurement arrangements (Recommendation 8). Such reporting should be accompanied by information pertaining to any related risks, mitigations and continuity plans.
3. Potential Watch-Outs
It is also worth noting that the National Commission’s recommendations include suggestions that may impose a greater regulatory burden on AI-enabled medical device manufacturers:
- Calls for enhanced enforcement.
Recommendation 22 of the Report calls for “enhanced enforcement mechanisms,” including requiring AI-enabled medical device manufacturers to provide “more timely” notice of early quality and safety signals associated with their devices to healthcare providers and the public, increasing disclosure and reporting obligations on manufacturers. In addition, the National Commission suggests introducing mechanisms to issue financial penalties and fines to manufacturers that fail to comply with legal requirements relating to patient safety.
- Explicit allocations of responsibilities between manufacturers and HCOs.
The National Commission also recommends that any contract between an AI-enabled medical device manufacturer and healthcare provider should include “explicit allocation of responsibilities for delivering required risk controls, including those specified in the risk management file, and for meeting relevant regulatory commitments” (Recommendation 28). Again, this may lead to an enhanced regulatory burden and further responsibilities being imposed on AI-enabled medical device manufacturers regarding use of their devices by healthcare providers.
- Public database of adverse event data.
Finally, the National Commission suggests that the MHRA should consider developing a publicly accessible database containing records of all adverse incidents related to specific software or AI-enabled medical device technologies (Recommendation 19). The Report specifies that any such database should enable members of the public to search and filter adverse incidents by manufacturer, device and timeframe. Whilst providing consumers with easier access to information regarding the safety of AI-enabled medical devices, the heightened exposure and focus on adverse events may not be welcomed by industry.
II. Health Bill Proposals
Separate from the National Commission’s Report, a new Health Bill is also progressing through parliament in the UK, which seeks to introduce certain changes to the medical device regulatory framework.
The most significant of these changes are the proposals announced in September regarding a new legal basis for regulating medical devices in Great Britain through a licensing framework. The relevant proposed amendments within the Bill provide for the MHRA to be the direct regulator of medical devices, with the ability to approve products for the Great Britain market. The Health Bill provides little further detail on the nature of the new licensing framework at this stage, but rather would grant the power for the Government to issue new medical devices regulations setting out the specific details. We understand that the MHRA would publish further information and consultations in due course.
Covington will continue to follow developments and provide further updates.
If you would like to discuss the National Commission’s recommendations or the medical device-related proposals in the Health Bill and what these developments may mean for your company’s operations, please contact our specialist UK and EU medical device regulatory team.