J Med Internet Resjmir1Journal of Medical Internet ResearchJ Med Internet Res1438-8871JMIR PublicationsToronto, Canadav28i1e11299210.2196/112992News and PerspectivesThe United Kingdom’s New Blueprint for Regulating AI in Health CareAthniTejas SJMIR CorrespondentCleggKayleigh-Ann2026510202628e1129922509202625092026© JMIR Publications. Originally published in the Journal of Medical Internet Research (https://www.jmir.org), 5.10.2026. 2026Current medical device regulation is insufficient for addressing the unique features and evolving nature of AI technology, leaving gaps that regulators across the world are working to close. In this News and Perspectives article, JMIR Correspondent Tejas S Athni reports on a recently released report outlining 44 recommendations that, if implemented, could provide a more comprehensive, life cycle–based regulatory framework for health care AI in the United Kingdom.
artificial intelligenceAIhealth care AIUnited KingdomUKNational Health ServiceNHSAI regulationmedical devicesMedicines and Healthcare Products Regulatory AgencyMHRAAI governanceregulatory sandboxKey Takeaways
The United Kingdom’s National Commission into the Regulation of AI in Healthcare set out 44 recommendations that propose life cycle–based regulation, calling for continuous postmarket monitoring of AI technologies.
The recommendations provide a blueprint for a future regulatory framework that clarifies when AI counts as a regulated medical device; strengthen the existing AI Airlock sandbox; introduce regulatory tools like Master Files, unique device identifiers, and adverse event reporting; and build up medical workforce preparedness.
The United Kingdom’s National Commission into the Regulation of AI in Healthcare set out 44 recommendations for new ways to regulate AI in health care, as per a report published in September 2026. The commission was established by the Medicines and Healthcare Products Regulatory Agency (MHRA) 1 year prior to advise the government on how AI in health care should be overseen, with a stated mission to “help ensure that patients can benefit from safe and effective AI technologies, support the government’s ambition to make the NHS the most AI-enabled healthcare system in the world, and establish a globally competitive regulatory environment that attracts investment and supports innovation.”
This marks one of the most ambitious regulatory rethinks of AI in health care by any national health system to date.
The commission argues that the United Kingdom’s existing medical device rules were built for products that do not change after they are approved (eg, surgical tools and diagnostic kits), whereas AI technology can be updated frequently and can perform differently depending on the hospital, patient population, or workflow in which it is deployed, necessitating ongoing oversight throughout the life cycle. The commission’s conclusions draw on evidence gathered from more than 12,000 people, including patients, clinicians, AI researchers, innovators, and international regulatory experts.
The Current LandscapeAI-enabled software in the United Kingdom is currently regulated as a medical device under the UK Medical Devices Regulations 2002, which was written long before AI-driven tools existed. Most AI devices are self-declared as low-risk and undergo a single assessment before launch, with limited follow-up after launch. The commission found that 65% of the 761 respondents in its public Call For Evidence felt that this kind of postmarket monitoring was substandard.
By comparison, the European Union treats AI systems that are also medical devices as automatically high-risk under its AI Act—the first legal framework on AI globally—with extra requirements layered on top of existing EU device rules. In the United States, the Food and Drug Administration (FDA) lets manufacturers preapprove certain planned updates to their AI models through a predetermined change control plan. The agency also maintains their public AI-Enabled Medical Device List, so clinicians and patients can see which products on the market use AI. The UK commission’s recommendations borrow pieces from both approaches while simultaneously adding more continuous, real-world monitoring than either currently requires.
Expanding the AI AirlockA key part of the commission’s recommendations centers around expanding the MHRA’s existing AI Airlock program, which was established in 2024 as a regulatory sandbox where manufacturers and regulators can test new AI tools together before full authorization.
In its first pilot, the AI Airlock worked with four companies: Philips (product: a generative AI tool to help radiologists draft final report impressions), OncoFlow (product: AI-assisted personalized cancer treatment planning), AutoMedica (product: a health care–focused retrieval augmented generation tool built on large language models with verified knowledge bases), and Newton’s Tree (product: a federated AI monitoring service [FAMOS] to detect performance and safety issues in health care AI products in clinical settings).
Beyond the original AI Airlock, real-world regional test beds are already launching in London and Manchester, in partnership with NHS (National Health Service) England and local health innovation networks. For instance, the London site alone is poised to support up to 10 AI-enabled devices in gathering evidence in real clinical settings. The commission also flags the National HealthTech Access Programme (NHAP)—a joint initiative spearheaded by the National Institute for Health and Care Excellence (NICE) that is fast-tracking a small number of promising AI tools, including devices for detecting prostate and breast cancer—as a complementary effort. However, the UK commission recommends that the MHRA coordinate with the NICE and other NHAP partners to avoid confusion between the two pathways for developers.
Three Main Areas of RecommendationsLife Cycle RegulationThe commission calls for clearer rules on when an AI product counts as a medical device and how much oversight it requires, based on potential risk to patients. A device’s design and functionality—not just a manufacturer’s claims and promotional materials—must factor into this decision. The MHRA would be able to add or relax safety requirements as new evidence emerges. For AI tools with multiple functions, the commission recommends regulating only the specific function that meets the medical device definition.
The commission also proposes a “Master File” system, whereby developers of general-purpose AI models share technical details confidentially with regulators. This system would be built upon similar work undertaken by the US FDA, Health Canada, and Japan’s Pharmaceuticals and Medical Devices Agency. This would prevent downstream device-makers from getting blocked by a lack of access to a model’s inner workings. In conjunction, the commission recommends unique device identifiers, which could act as digital barcodes to better track and follow devices throughout their life cycle.
Shared ResponsibilityResponsibility for AI safety should be shared among multiple stakeholders, the commission recommends, including manufacturers, health care providers, regulators, and policymakers, with clear agreements spelling out who is responsible for areas like cybersecurity and staff training. Though legal reform will take time, the commission emphasizes that increased clarity must be provided for legal liability when AI contributes to patient harm.
Trust and TransparencyWith no universal requirement for routine disclosure under current law, the commission recommends that patients receive access to information on how AI is involved in their clinical care, in conjunction with clearer pathways for patients to raise concerns. They also propose a public, searchable database of adverse incidents tied to specific AI devices, modeled on the US FDA’s Manufacturer and User Facility Device Experience (MAUDE) database and the MHRA’s own Drug Analysis Profiles tool. Improvements to the United Kingdom’s existing Yellow Card reporting scheme—the MHRA’s running system for reporting suspected drug and device safety issues—are recommended to better equip it for AI and software adverse event reporting. The commission further recommends regularly surveying both patients and providers about their attitudes toward AI.
Cybersecurity and Workforce TrainingThe commission regards cybersecurity as a critical part of patient safety and not just an IT issue, warning that AI tools are increasingly connected to hospital data systems in ways that create openings for malware disruptions and corrupted training data. Their recommendations call for the MHRA to issue clear cybersecurity guidance—built into AI devices from the design stage—and tailored rules for consumer health apps and wearables. The commission points to warnings from senior NHS leaders that cyberattacks now pose a larger threat to the health service than another pandemic. They also recommend that AI training becomes a part of medical education from the early stages of medical school and that health care providers train staff specifically on the AI tools that they use.
![]()
The Next StepsWhile the commission’s recommendations are advisory and do not create new legal precedent on their own, the goal—and perhaps the outcome, if the recommendations are successfully implemented—is to help the UK health system adopt AI safely while maintaining public trust.