UK Accepts All 44 Recommendations to Regulate Healthcare AI

The UK government says it is accepting all 44 recommendations of the National Commission into the Regulation of AI in Healthcare. Its response, published on October 6, 2026 and produced by the Medicines and Healthcare products Regulatory Agency (MHRA), says the post-market measures it describes would enable a “conscious shift towards ongoing assurance rather than overreliance on pre-market assessments and passive adverse event reporting”.

In this publication’s count, 43 of the 44 action-plan entries give Spring 2027 as a date, and one, on draft guidance for predetermined change control plans, gives December 2026. Everything below is the government’s own statement of what it intends, and we have not checked it independently.

What the Response Says

The response carries a foreword from James Frith MP, Parliamentary Under-Secretary of State for Health Innovation. It says: “We are accepting all 44 of their recommendations”. In this publication’s count, each of the 44 entries in the action plan is marked “(Accept)”.

The introduction says: “Because the use of AI has developed considerably since UK MDR 2002 was drafted, as well as the nature and pace of its development, the current medical device regulations are not fit for purpose”. It adds that the MHRA “launched the National AI Commission in September 2025”.

The response groups its commitments into ten priorities. Priority 3 says the MHRA will work to develop and implement “a more proportionate, lifecycle-based approach to regulation that better balances pre-market evidence requirements with robust post-market assurance”.

The response’s priorities are grouped under three themes: “proportionate lifecycle regulation”, system-wide responsibility and safe management, and “trust, transparency and predictability”. Its action plan has three tables, each headed “Key Principle”. In this publication’s count, the first table lists 23 recommendations, the second 11 and the third 10.

From a Single Check to Ongoing Assurance

Priority 3 describes what the shift involves: “enhanced post-market surveillance mechanisms, clearer evidence expectations and improved mechanisms for monitoring and responding to quality signals, device safety and performance changes in real-world settings”. The same sentence ends “enabling a conscious shift towards ongoing assurance rather than overreliance on pre-market assessments and passive adverse event reporting”.

Recommendation 5 says the MHRA will “explore options” for a lifecycle-based framework in which “evidence generation and oversight should increasingly take place across the product lifecycle, supported by robust, ongoing post-market oversight and less reliance on point-in-time pre-market assessments”. It adds: “This may include seeking potential licensing powers, legislative reform, and new guidance”.

Recommendation 17 says the MHRA will “build on its existing post-market surveillance requirements and introduce an enhanced toolkit of mechanisms that could be required individually or in combination to enable a more tailored approach to post-market oversight”. It says the MHRA will also “utilise the third phase of the AI Airlock to investigate post-market surveillance challenges/practices as a key focus area”.

Two other entries touch the same shift. Recommendation 19 says the MHRA will work to “introduce a public facing database/tool where members of the public can access and search for information on reports of adverse incidents for medical devices, including those that are software and AI-enabled”. Recommendation 22 says enforcement options “will include, implementing the civil sanctions regime by the Medicines and Medical Devices Act, enabling the issuance of financial penalties where appropriate”.

Annex A prints the Commission’s own recommendations. Its Recommendation 14 asks for staged authorisation pathways that address “limitations of single-timepoint assessment of software and AI-enabled devices, including demonstrating real world performance, managing uncertainty, and providing lifecycle assurance of device safety and benefit”.

What Has a Date

The first entry says the MHRA “will launch a consultation on a new, proportionate approach to classification and qualification for software and AI-enabled devices”, and that it “intends to launch the consultation by Spring 2027”. Secondary legislation would follow the consultation, the entry says.

The earliest date in the action plan is in Recommendation 6. The MHRA “will issue draft guidance on PCCPs for public comment”, covering “clear approaches for adaptive AI-enabled medical devices”, and “intends to issue draft guidance by December 2026”. PCCP stands for predetermined change control plan.

In this publication’s count, 42 of the other entries give the delivery timeline as “Further details to be shared by Spring 2027”, or the same words without “by”. That includes Recommendation 17 on post-market surveillance and Recommendation 19 on the public database of adverse incidents.

On delivery, the response says: “An implementation plan and roadmap, published by Spring 2027, will provide further detail on roles, responsibilities, timelines and key deliverables, with annual progress updates thereafter”. It also says a cross-system Programme Board “will convene quarterly”.

The AI Airlock Call for Applications

The MHRA also published an AI Airlock phase 3 call for applications on gov.uk. It says: “The current priority regulatory challenge area is Post-Market Surveillance (PMS) and oversight across the lifecycle for AI enabled Medical Devices”. It adds: “The current phase of the AI Airlock is funded until April 2029”.

For the current application review wave, the page says to “apply before the 31st October”, with “a subsequent shortlisting period” in Spring 2027. It says candidates “should generally expect to scope their individual Airlock testing/engagement to within 6 – 12 months”.

The Structural Read

The response names the shift in Priority 3 and returns to it in three entries. Recommendation 5 speaks of less reliance on point-in-time pre-market assessments, Recommendation 17 of an enhanced toolkit of post-market mechanisms, and Recommendation 19 of a public database of adverse incident reports. The response says Recommendation 5 may include seeking potential licensing powers and legislative reform.

In this publication’s count, the dates are mostly one date. Spring 2027 is given for the consultation under Recommendation 1 and for further details under 42 other entries. Draft guidance on predetermined change control plans, under Recommendation 6, is the only entry with an earlier date, December 2026. The response also says an implementation plan and roadmap will be published by Spring 2027.

Recommendation 17 says the MHRA will use the third phase of the AI Airlock to investigate post-market surveillance. The AI Airlock page says post-market surveillance and oversight across the lifecycle is the current priority regulatory challenge area, that the current phase is funded until April 2029, and that applicants should apply before the 31st October for the current review wave.

Three Implications

THE SHIFT IS STATED AS AN INTENTION The response says the MHRA will work to develop a lifecycle-based approach and will explore options. Its entries describe consultations, guidance and possible legislative reform still to come, and its post-market entries use words such as “could be required” and “may include”.

MOST DATES ARE THE SAME DATE In this publication’s count, 43 of the 44 entries give Spring 2027 as a date. The response says its implementation plan and roadmap will give further detail on roles, responsibilities, timelines and key deliverables.

WHAT REMAINS OPEN The mechanisms are described as a toolkit that could be required individually or in combination. This publication found no funding figure for the regulatory programme in the response text, and it did not read the Commission’s report or contact the MHRA.

What Is Not Established

The response describes intentions, consultations and guidance still to come. Many entries use verbs such as “explore” and “consider”, and the post-market entries describe options, such as mechanisms that “could be required individually or in combination” and steps that “may include” seeking licensing powers, rather than named requirements with dates.

This publication found no funding figure for the regulatory programme in the response text. The one sum the response states is that “Earlier in 2026, the Government committed up to £10 billion over the next three years to invest in technology, digital, and data initiatives”. The AI Airlock page says its current phase is funded until April 2029, that there is no fee to apply or take part, and that candidates are expected to fund their own studies and delivery of any Airlock testing.

This publication read the response’s foreword, introduction, priorities and the action plan for all 44 recommendations, the opening of Annex A, and the AI Airlock phase 3 page. It did not read the Commission’s own report or the four plain-language explainers published with the response, and it did not contact the MHRA or the Department of Health and Social Care. It reported on a different government’s AI plan the same day, EPA’s evidence plan, and draws no comparison.

The Bottom Line

The UK government says it is accepting all 44 recommendations of the National Commission into the Regulation of AI in Healthcare, and says it intends a “conscious shift towards ongoing assurance rather than overreliance on pre-market assessments and passive adverse event reporting”. Its dates are mostly Spring 2027, with draft guidance on predetermined change control plans by December 2026. All of it is the government’s own statement of intent; this publication verified none of it independently.