UK medical AI moves to continuous monitoring

On 6 October the UK accepts 44 recommendations

On 6 October 2026 the British government accepted all 44 recommendations^[1] of the National Commission into the Regulation of AI in Healthcare, the group led by NHS doctors. The Commission had published its report on 10 September 2026.

The response redraws the regulation of AI in healthcare: it sets out ten priority areas and describes how the measures reach every part of the United Kingdom. The act is signed by the MHRA, the medicines and medical devices agency, and by three members of the government: Kanishka Narayan, James Frith and Lord David Willetts. The official page was updated three times in one day: one correction takes the priority areas from nine to ten.

The regulatory professionals' society RAPS records the act as the agency's adoption of the framework proposed by UK doctors^[2].

From the one-off test to monitoring across the device's whole life

The Commission's central conclusion is simple: a medical device with AI has to be assessed and tracked across its whole useful life. The current regime rests instead on an initial test, with the UKCA mark and the judgement of an approved body.

The Medical Devices Regulations 2002 remain the British legal base, and they impose vigilance and incident reporting. That model measures the product at the moment it enters the market. A system that learns, by contrast, changes performance between one version and the next, and the difference surfaces in ward data.

The regulatory delta concerns the moment of measurement: from the certificate to the time series of performance in use.

The response speaks of a proportionate and agile framework, with patient safety as a firm limit. The keyword remains «lifecycle»: compliance becomes a flow of evidence, updated at every release.

AI Airlock enters its third phase

Alongside the response, the MHRA opened the third phase of AI Airlock, its regulatory sandbox for medical devices with AI. The test themes come straight from the Commission's recommendations.

Applications are open to developers of devices with AI who meet the criteria. A webinar for prospective participants is set for 22 October 2026. The phase tests how a device is tracked and managed after installation, with developers, regulators and healthcare providers at the same table.

The outcomes will feed future MHRA guidance and regulatory policy choices. The sector's technical press reported the government's backing of the Commission's report^[3] within the same hours.

The sandbox produces evidence and method, and binding force arrives later, with the instruments that take it up.

The governance signal: a commitment under implementation

Here is the exact status of the act: a government response, under implementation, with no article of law and no date of effect.

The Commission's report is an independent recommendation. The response of 6 October 2026 is a political commitment, and it is worth as much as the instruments that will follow. Sandbox participation remains voluntary, and it covers a narrow number of projects.

In the meantime the live obligations remain those of 2002, resting on the manufacturer and the responsible person. The NHS trust that installs the device answers for clinical use and informed consent.

Anyone reading this page as a waiver from current duties has the perimeter wrong. The audit remains mandatory: what changes is its object, which becomes performance over time.

This desk's position

A commitment accepted wholesale is worth as much as the name written next to each obligation.

Ten priority areas and 44 recommendations describe a direction, and governance begins when a named role signs a duty with a date. As long as the lifecycle lives in voluntary guidance, the burden of proof stays entirely with the manufacturer and with the department that installs. Documentation grows, and the chain of accountability stays the same.

This also opens an advantage: companies that build the audit trail and risk classification now gain months when enforcement arrives. Early compliance is an industrial asset, and the market will pay for it.

What would change this reading: a UK secondary instrument fixing post-market surveillance duties, with an article, a date of effect and a penalty. Such an instrument, published by the end of 2027, would move the judgement from commitment to rule.

Three decisions for the board

The board has three choices in front of it, and each has a precise owner.

1. Review the compliance dossier of devices with AI already installed, with the performance data gathered after approval.
2. Add model performance drift to the risk register, with thresholds and a named owner.
3. Decide by 22 October 2026 which device to put forward for the third phase of AI Airlock.

The General Counsel measures exposure on two fronts: the technical dossier submitted to the approved body and the performance logs gathered after installation. The Chief Risk Officer updates the risk register with an entry dedicated to model drift.

The audit committee decides what disclosure to give shareholders on devices with AI already in use. The chief executive assesses the application to the third phase, with a window that closes in a few weeks. Those who enter gain direct access to the regulator and a seat in the design of future guidance.

The question to put in the minutes: which named role answers for the clinical performance of the model after deployment, by name and in writing?

London and Brussels measure the same problem

The European Union treats the same subject with an article and a date. Regulation 2024/1689 classes as high-risk those AI systems acting as a safety component in the products covered by Regulation 2017/745 on medical devices.

Article 6(1) carries that classification. Article 72 requires the provider to run a post-market monitoring system, with a documented plan. Obligations for this category take effect on 2 August 2027, and the Digital Omnibus proposal under discussion in Brussels moves them to December 2027.

The comparison is useful: Brussels has the text, London has the testing method. A manufacturer selling in both markets builds a single surveillance set-up and presents it twice.

Regulatory horizon

The state of play as at 7 October 2026 is this. The United Kingdom has a government commitment under implementation, and a sandbox open for applications.

• Government response to the 44 recommendations: published 6 October 2026, under implementation, jurisdiction United Kingdom.
• Commission report: published 10 September 2026, status of a recommendation.
• AI Airlock, third phase: applications open, webinar on 22 October 2026, voluntary participation.
• Medical Devices Regulations 2002: in force, basis of current UK obligations.
• EU Regulation 2024/1689, Articles 6 and 72: high-risk obligations from 2 August 2027, European Union.

The legal framework remains that of the Medical Devices Regulations 2002, pending the instruments that will take up the 44 recommendations. The European Union runs on its own calendar, with 2 August 2027 as the pivotal date for this category.

This desk's forecast

By 30 June 2027 the MHRA publishes guidance or a formal consultation on the post-market surveillance of medical devices with AI. The document comes out of the outcomes of the third phase of AI Airlock. Confidence: 70 out of 100, horizon 266 days.

Falsification signal: as at 30 June 2027 the MHRA has published zero guidance or consultation documents on this subject.