UK accepts all 44 recommendations on regulating AI in healthcare

The UK government has accepted all 44 recommendations made by the National Commission into the Regulation of AI in Healthcare, in a response published by the Medicines and Healthcare products Regulatory Agency (MHRA) on 6 October 2026. The document covers the Department of Health and Social Care (DHSC), NHS bodies and other regulators. It commits to an implementation plan and roadmap by Spring 2027, followed by annual progress updates.

The commission published its recommendations in September, according to HTN Health Tech News. In a ministerial foreword to the response, James Frith MP, Parliamentary Under-Secretary of State for Health Innovation, wrote that the government agreed the UK needed a new approach to regulating AI products in healthcare that was proportionate, based on risk and the product lifecycle, and took a system-wide approach to overseeing safe use. He described the response as the next stage of a continuing conversation rather than the end of the process.

What changes, and when

The firmest dates concern medical device rules. The MHRA plans to launch a consultation by Spring 2027 on a new approach to the classification and qualification of software and AI-enabled devices. The MHRA will then use secondary legislation to introduce an updated definition of a medical device, a new classification system and an updated definition of intended purpose. No date is given for that legislation. Draft guidance on predetermined change control plans (PCCPs) is due for public comment by December 2026.

Most other actions carry the note that further details will be shared by Spring 2027. They include:

• an AI readiness toolbox for healthcare organisations, to be developed by DHSC and NHS England with the devolved health departments, building on the CERSI-AI readiness checklist;
• MHRA guidance on how manufacturers identify and communicate the operational conditions needed for safe deployment and use;
• draft MHRA guidance and educational resources on cyber security expectations for software and AI-enabled devices, with the agency drawing on its role as co-chair of the IMDRF cyber security working group;
• a public, searchable tool for adverse incidents involving medical devices, including AI and software, which may need legislative change;
• work on staged authorisation pathways, potentially through new licensing powers and sandboxes, including how evidence from them could support NICE appraisals;
• a third phase of the MHRA AI Airlock sandbox, which will also examine post-market surveillance, and work with the Department for Business, Innovation, Science and Trade on sandbox provisions in its forthcoming Regulating for Growth Bill.

DHSC and the devolved health departments, working with the MHRA, the Care Quality Commission and equivalent bodies, will focus on strengthening reporting, monitoring and learning from the real-world use of AI, and the MHRA will explore automating low-burden reporting by embedding it into systems such as electronic patient records. A separate working group including DHSC, the MHRA, the Care Quality Commission, NHS Resolution and the Professional Standards Authority will make responsibilities clear across manufacturers, providers, professionals and regulators. DHSC will support a coordinated approach to improving AI literacy, building on the NHS Digital Academy and the AI Ambassador Network.

Governance and money

A cross-system programme board with health, regulatory, research and devolved representatives will meet quarterly and report quarterly to the Life Sciences Delivery Board. The response refers to the government commitment, announced earlier in 2026, of up to GBP 10 billion over three years for technology, digital and data. It does not say how much of that sum is for AI or for delivering these recommendations, and no budget for the additional MHRA work is disclosed.

The response follows a discussion at the NHS England board, reported by HTN on 1 October, in which concerns were raised about the lack of a single clear vision for AI in the NHS and the risk of delay and duplication.

Our reading

Analysis by The Healthcare Daily.

• For AI suppliers, the December 2026 draft guidance on change control plans is the nearest practical milestone. The classification consultation and the secondary legislation that follows mean the rules for many software products are unlikely to settle before 2027.
• For NHS trusts, the readiness toolbox and the guidance on operating conditions for safe deployment point to more assurance work on the buyer side, which procurement and clinical safety teams will need to resource.
• Electronic patient record suppliers may be asked to support automated incident reporting, which would add an integration requirement to future contracts.
• With no funding attached to the programme, delivery depends on MHRA and DHSC capacity. Investors should treat the Spring 2027 roadmap as the point at which the real timetable becomes visible.

Sources: government response on GOV.UK and HTN Health Tech News (6 October) and HTN Health Tech News (1 October).