The UK is moving AI medical device regulation away from a single assessment at launch. On 6 October 2026 the government accepted all 44 recommendations of the National Commission into the Regulation of AI in Healthcare and committed to assessing and monitoring AI-enabled medical devices throughout their working life. The MHRA now owes draft guidance on managing changes to those devices by December 2026.
What The Government Accepted
The independent Commission, set up by the MHRA in September 2025, published its recommendations on 10 September 2026 after a year-long UK-wide evidence programme involving more than 12,000 people. The government response accepts all 44 recommendations and sets out initial next steps for each one.
The Commission concluded that regulation has to move to a more proportionate, lifecycle-based framework. In the words of the GOV.UK announcement, AI-enabled medical devices should be assessed and monitored throughout their working life "instead of over-relying on one-time assessments."
The Dated Commitments
- By December 2026: MHRA draft guidance on a new approach to managing changes to AI-enabled medical devices as they adapt and improve over time.
- 2027: an MHRA consultation on how AI-enabled devices are qualified and classified, which was the Commission's first recommendation.
- By Spring 2027: a full implementation roadmap with timelines and responsibilities across all 44 recommendations, followed by regular progress updates.
- Under exploration: staged authorisation pathways that would let promising AI tools be used in the NHS earlier, under close supervision, while more real-world evidence is gathered.
A new Programme Board will work across government, the MHRA, NHS partners and the devolved authorities on the ten priority areas set out in the response.
AI Airlock Phase 3
The MHRA also opened applications for Phase 3 of AI Airlock, its regulatory sandbox for AI as a medical device, with three more years of government funding. Phase 3 focuses on post-market surveillance and oversight across the device lifecycle. The application page lists three priority topics:
- Surveillance that captures the deployment context (local infrastructure, workflow integration, data availability and quality, user interaction), with clear criteria for when a safety or performance signal gets acted on.
- Surveillance that still detects and responds to signals where local oversight is thin, such as remote, direct-to-consumer or higher-autonomy systems.
- Telling regulators, providers, professionals and patients about performance, safety, updates and rollbacks promptly.
The application window stays open year-round, with applications reviewed in waves. To be considered in the current wave, apply before 31 October 2026. The first wave of participants is due to be selected in November 2026, and the next shortlisting period is in Spring 2027.
The Same Shift Outside Health
Three other publications from 6 October 2026 push checks past launch day:
- Colorado's interim draft ADMT and Chatbot Safety Rules ask chatbot operators to describe how they check that their safety protocols keep working over time and after material changes to the service, and to report metrics from post-deployment monitoring.
- OpenAI and Ironclad graded agents on the finished contracting setup against 8 to 50 criteria per task. GPT-6 Astra met 55.0% of them on average.
- Anthropic's expanded Cyber Verification Program verifies each organization before granting cyber access, then requires data retention so it can keep monitoring for misuse.
What Operators Should Change
If an agent product is, or sits inside, an AI-enabled medical device sold in the UK, plan for post-market monitoring from the start and treat each model update as a managed change. The December draft guidance will be the first MHRA text on what a managed change looks like. Outside health, keep the same habit: re-check the finished system in production after every model or prompt change, and record which version produced each result.
What This Does Not Settle
- The response is government policy. It does not change UK law, and the change-management guidance and the classification consultation have not been published yet.
- This note draws on the GOV.UK announcement, the response landing page and the AI Airlock application page. It does not summarise the government's answer to each of the 44 recommendations in the full response.
Related: The United Kingdom jurisdiction page carries the health AI commitments and the AI Airlock window. The verify-loop playbook covers agents that fail while their transcripts look clean, and how to grade the end state instead.