UK Accepts 44 Health-AI Reforms—but No New Rules Take Effect Yet

On 6 October 2026, the UK government accepted all 44 recommendations from the National Commission into the Regulation of AI in Healthcare. The Medicines and Healthcare products Regulatory Agency (MHRA) opened applications for the next phase of its AI Airlock programme the same day. The acceptance commits the government to developing the reforms; it does not make the proposed regulatory changes binding on patients, NHS organisations, clinicians or developers.

The government’s 6 October delivery plan schedules draft guidance on changes to AI-enabled medical devices by December 2026, a consultation on device qualification and classification by spring 2027, and an implementation roadmap by spring 2027. Existing requirements continue to apply while those steps proceed. Whether an AI product is regulated as a medical device depends on its intended purpose, functionality and use; other products may fall under data protection, professional or organisational rules.

Which changes are active, and which are planned?

The response combines an open testing programme with work that regulators and health bodies have yet to complete. The distinction is particularly important for organisations making purchasing or development decisions now:

• Open now: AI Airlock applications. Innovators can propose a regulatory challenge for testing with the MHRA and its partners. A place in the sandbox creates an opportunity to generate evidence; it does not itself authorise routine clinical deployment.
• Draft guidance promised: device changes. The MHRA plans to seek public comment on predetermined change control plans. Its proposed approach would let manufacturers define boundaries for permissible changes to an AI-enabled device while maintaining its intended use. The scope of that approach remains subject to the draft and subsequent decisions.
• Consultation planned: device qualification and classification. The MHRA intends to examine which software and AI products count as medical devices and how their risks should be classified. The response envisages secondary legislation after consultation, so possible exclusions for some administrative, wellbeing or decision-support software are proposals rather than current law.
• Further design required: oversight across a device’s life. Staged authorisation, stronger post-market surveillance, clearer responsibilities and more public safety information are accepted objectives. The response leaves many of their detailed mechanisms and delivery dates for later work.

This is a programme across regulators, health departments and care organisations, rather than a single new set of MHRA rules. The planned roadmap is meant to assign responsibilities and timelines across that system.

What the AI Airlock is testing now

The MHRA’s Airlock application notice makes post-market surveillance and lifecycle oversight the current priority. It asks applicants seeking consideration in the present review wave to apply before 31 October 2026, while keeping applications open afterward. Candidates need a defined regulatory challenge and a proposal ready for a bespoke testing plan; selection is assessed against the programme’s criteria.

The questions extend beyond whether a device worked during its initial assessment. The programme is looking at how local infrastructure, clinical workflows, data quality and user interaction can affect performance after deployment. It also examines how manufacturers detect safety signals when oversight varies between settings, and how information about performance, updates or rollbacks reaches regulators, providers, professionals and patients.

One Airlock testing environment can observe a tool where it would eventually be used, alongside normal clinical processes and retrospective patient data. In that arrangement, its outputs stay outside decisions about actual patients. This allows developers and healthcare partners to examine performance in realistic conditions while the programme develops evidence for future regulatory guidance. Participation remains a test of regulatory questions, not a substitute for the requirements governing a product’s use in care.

What NHS buyers and clinicians face in the meantime

For NHS buyers, the response points toward more information about what sits inside an AI-enabled product and the conditions under which it can be used safely. Planned guidance would address dependencies on underlying general-purpose models, with related information eventually reflected in procurement processes and contracts. Other work would clarify which responsibilities belong to manufacturers and which belong to providers. Those proposed additions have not become standard contract terms through the October decision.

Existing assurance and clinical risk processes remain relevant. The government identifies the Digital Technology Assessment Criteria as a current national assurance gateway for AI and other digital technologies. It plans an AI Readiness Toolbox that builds on work already under way, alongside clearer guidance on operational conditions, staff capability and clinical risk management. For clinicians, that means current professional and organisational duties continue while the proposed AI-specific guidance is developed.

Monitoring after deployment is another area where the proposed responsibilities could become more precise. The response calls for improved reporting and information sharing between manufacturers, providers and regulators, including changes to the Yellow Card scheme. It also proposes better version traceability for software and AI-enabled devices, potentially linking version information to electronic patient records. The final requirements will depend on the guidance and any legislative changes that follow.

What patients can expect from the response

The government plans to make information about AI use in care clearer and to develop more accessible information about device safety. It also intends to examine complaints and redress when care falls below the expected standard, and whether an opt-out could be appropriate in particular circumstances. The response does not establish a universal AI disclosure or opt-out rule. Its proposed approach also calls for evidence about performance among underserved groups as products are evaluated and monitored.

Health Research Authority chief executive Matt Westmore said in the HRA’s response to the announcement that realising AI’s benefits depends on maintaining the “confidence and trust of patients and the public”. The HRA is also due to clarify when developing, evaluating or monitoring an AI tool amounts to research requiring research governance, a distinction that matters as more evidence is collected after deployment.

The next scheduled test of the government’s approach is the MHRA’s draft guidance on managing changes to AI-enabled medical devices. It should set out a proposal manufacturers and healthcare organisations can examine before the wider consultation and implementation roadmap follow.

Also read:

• China Is Winning the AI Race Not Just with Open-Source Models — But with Unmatched Speed of Real-World Implementation
• Horizon Worlds Is Leaving VR Headsets — But Don't Bury the Metaverse Just Yet
• Mythos Just Rewrote the Rules of Cybersecurity: One AI Found 271 Firefox Vulnerabilities in a Month — More Than Human Teams Had in 18 Months