UK Accepts All 44 Recommendations on Regulating AI in Healthcare

The UK government said on October 6, 2026 that it accepts all 44 recommendations of the National Commission into the Regulation of AI in Healthcare. The commission is an independent advisory body on how artificial intelligence in medicine should be overseen. The decision came in a policy paper published by the Medicines and Healthcare products Regulatory Agency (MHRA). The MHRA regulates medicines and medical devices in the UK. The paper names ten priority areas for the next year. It says an implementation plan and roadmap will be published by spring 2027.

The paper sets out how the government intends to proceed. It does not itself change the rules that AI medical devices must meet. Most of its commitments are to consult, issue guidance, or consider or explore options. It says an updated definition of a medical device would come later, through secondary legislation that follows a consultation. The AI in Medicine Regulation Tracker follows each step.

What did the government accept?

The MHRA set up the commission in September 2025 as an independent, non-statutory advisory body. Its chair is Professor Alastair Denniston, an NHS consultant. Its deputy chair is Professor Henrietta Hughes, a general practitioner and the Patient Safety Commissioner for England. The agency said the commission gathered evidence from more than 12,000 people before publishing its recommendations on September 10, 2026.

The commission's report concluded that current approaches were largely designed for products that change less and are easier to assess reliably at a single point in time. AI products, it said, may change rapidly and perform differently from one setting to another. The recommendations the MHRA highlighted included:

• Staged authorizations. New AI models would first be deployed under close supervision and tight guardrails. They would then earn fuller authorization by demonstrating real-world safety and performance. The MHRA likened this to L-plates for learner drivers.
• Continuous monitoring. AI-enabled medical devices would be monitored in real-world use throughout their working life, instead of receiving a single point-in-time approval.
• Public safety information. People could search for safety information on a specific AI-enabled device, including any adverse incidents.
• Stronger enforcement. The MHRA would get enhanced enforcement powers.

In the full response, every one of the 44 recommendations is marked as accepted. Elsewhere, the paper's introduction says the government intends to accept them, and the MHRA's announcement says it will. In the foreword, Health Innovation Minister James Frith wrote that the UK needs a new approach to regulating AI products in healthcare. The approach it needs, Frith wrote, is proportionate and based on risk and lifecycle. The response says the current rules, the UK Medical Devices Regulations 2002, are not fit for purpose because AI has developed considerably since they were drafted.

What happens first?

In the paper's action plan, the timeline column names a specific deliverable and date for two of the 44 recommendations:

• By December 2026. The MHRA intends to issue draft guidance, for public comment, on predetermined change control plans. These plans are a way to manage changes to AI-enabled devices as they adapt and improve over time. The draft would describe a proposed approach that lets manufacturers set boundaries for allowable change, instead of only listing specific modifications in advance.
• By spring 2027. The MHRA intends to launch a consultation on how software and AI products are qualified as medical devices and classified. It would then use secondary legislation to update the definition of a medical device. The update would clarify when certain administrative, general wellbeing and decision support software is not a medical device.

For the other 42, the column points only to spring 2027 for further details. On staged authorizations, the response says the MHRA "will explore options to introduce" such pathways.

It also says the MHRA will work to introduce a public database or tool for searching reports of adverse incidents involving medical devices. It says the agency will also work to publish a regularly updated list of AI-enabled medical devices authorized in the UK. On enforcement, it says the agency will explore options that include implementing a civil sanctions regime allowing financial penalties. For patients, the response turns to the Department of Health and Social Care. It says the department will consider how to make clear when AI is used in a person's care and when opting out may be feasible. It says the department will convene a working group on access to redress for substandard care.

The response says the government will establish a cross-system program board, meeting quarterly, to oversee delivery. It says there will be annual progress updates after the roadmap is published.

What is AI Airlock Phase 3?

On the same day, the MHRA opened applications for the third phase of AI Airlock, its regulatory sandbox for AI-enabled medical devices. In it, the agency says, innovators, regulators and healthcare partners explore regulatory challenges using real products.

Phase 3 focuses on post-market surveillance, meaning how devices are monitored and managed after they are deployed. The application page asks developers who want to be considered in the current review wave to apply before October 31. It says the phase is funded until April 2029. The MHRA said the first wave of participants will be selected in November 2026. In April 2026, the agency said the Department of Health and Social Care had allocated £1.2 million a year for three years to the program.

Why does this matter outside the UK?

When the commission reported, STAT noted that health authorities worldwide are trying to work out how to keep reviewing AI products that go on changing after they are authorized. In the United States, the Food and Drug Administration issued a discussion paper on generative AI-enabled medical devices on August 18, 2026. It asked for feedback by October 19, 2026 on risk assessment, premarket evaluation and postmarket monitoring.

What is still unknown?

As of October 6, 2026, several questions remain open:

• Timing of legal change. The response gives no date for new legislation or for staged authorizations to begin.
• Cost. The response gives no figure for the cost of carrying out the recommendations.
• Capacity. The MHRA's September 10 announcement carried a comment from Jennifer Dixon, chief executive of the Health Foundation, the commission's research partner. Dixon said the real test will be whether the NHS has the capacity, skills and systems to implement and monitor AI safely and effectively at the scale needed.
• Scotland. Scottish Health Secretary Angela Constance said in the MHRA's October 6 announcement that Scotland will set out its own response in due course.

Separately, the Health Services Safety Investigations Body says it has launched an investigation into ambient voice technology in hospitals. These AI scribes, which draft notes from clinical conversations, are covered in an earlier article. The body investigates patient safety concerns across the NHS in England. Its notification is dated August 6, 2026, and it says a report is expected in summer 2027.

On September 17, 2026, the Professional Standards Authority, the ten regulators it oversees and the Accredited Registers Collaborative committed to develop high-level principles. The principles are meant to guide how they regulate the use of AI by health and social care professionals. The Pharmaceutical Journal also reported the commitment.

In the MHRA's announcement, Denniston welcomed the response. The commission's chair said it showed the government had listened to the patients, clinicians and members of the public who shaped the recommendations, as pharmaphorum also reported.