UK Puts L-Plates on Medical AI That Never Stops Changing

A UK commission published 44 recommendations on 10 September 2026 that would keep medical AI under watch after it reaches the ward. The National Commission into the Regulation of AI in Healthcare, set up by the Medicines and Healthcare products Regulatory Agency in September 2025, wants learner-style limits on new models, clinic-level reporting, and stronger MHRA powers. A government reply will come later, with no date attached.

The list is sold as faster, safer access. The machinery underneath is a living-product rulebook in which sign-off is only the start of the work.

L-Plates for Models That Keep Changing

The commission, chaired by Professor Alastair Denniston, an NHS eye consultant and regulatory science professor at the University of Birmingham, and deputy-chaired by Professor Henrietta Hughes, England’s Patient Safety Commissioner and a GP, spent a year taking evidence from more than 12,000 patients, clinicians, industry staff and the public. MHRA chief executive Lawrence Tallon said the independent panel had set out, “in more detail than ever before,” how AI should be regulated in healthcare.

Its 44 recommendations for a future framework sit in a 119-page report and rest on three linked aims the panel branded Safe, Fast and Trusted. Current device rules, it said, were built for products that stay still and can be judged at one moment. AI tools can iterate, drift, and behave differently in different hospitals.

Recommendation 14 is the public hook. The MHRA should enable staged authorisations, which the agency compared to L-plates for learner drivers. A new model would go out under close watch and tight limits, then gain a wider licence only after it showed safety and performance in real care. The pitch is world-first access for UK patients. The practical effect is that a model can be in use for a long time before anyone calls it fully authorised.

AI is already in the NHS to pick up strokes and skin cancers, and in voice tools that cut typing time, the MHRA said. On 29 July 2026 the agency also clarified that ambient voice products used only to transcribe, summarise, draft letters or suggest codes for a clinician to review are not medical devices, while tools that support diagnosis, treatment or unreviewed orders are.

📢 New recommendations by the NHS doctor-led National AI Commission, informed by 12,000+ people's views, on how the UK can safely speed up access to AI to support clinicians and benefit patients balancing innovation with patient safety.

Read more 🔗https://t.co/x3OhrppcHI pic.twitter.com/3UtJiRC8dS

— MHRAgovuk (@MHRAgovuk) September 10, 2026

THE COMMISSION IN NUMBERS

• 44 recommendations: Issued on 10 September 2026; a cross-government reply will follow separately.
• More than 12,000 people: Patients, the public, clinicians, health leaders and developers over the course of a year.
• 760 submissions: The Call for Evidence, which closed on 2 February 2026, drew 760 people and institutions.
• 78 members of the public: The Health Foundation ran workshops in Cardiff, Milton Keynes and York in March and April 2026.

Two-thirds of industry respondents to that Call for Evidence, and half of healthcare providers who replied, said the current rules restrict innovation. The staged path is the commission’s answer to that complaint, and it still leaves the hard proof until after a tool is in a clinic.

The Ward, Not the Lab, Is Where Proof Starts

Recommendation 5 asks the MHRA to rebalance evidence across a product’s life, with more weight on what happens after launch. For adaptive tools, pre-market data may shrink if post-market monitoring is strong enough. That is the bargain: a faster front door, a heavier back door.

Most software and AI devices on the UK market are self-declared as Class I, the report said, which can mean light oversight for tools that later matter a lot in a care pathway. Recommendation 1 would rewrite the UK Medical Devices Regulations so administrative software, general wellbeing tools and some decision support sit outside the device definition, while higher-risk products get a classification that tracks clinical risk, benefit and the product’s life, not a manufacturer’s marketing copy.

Once a tool is out, the panel wants a watch system that looks more like a drug safety file than a one-off certificate.

THE SHIFT FROM CLEARANCE TO WATCH

Professionals at roundtables often did not know Yellow Card already covers devices, the report said, and under-reporting is built into the present system. Recommendation 21 would let manufacturers automate low-burden reports, including by feeding them into Yellow Card and electronic records, which only works if assessors get tools to handle the extra volume.

Dr Haris Shuaib, chief executive of Newton’s Tree, which monitors AI in live NHS sites, said performance can change once systems are in routine use, and called continuous monitoring “exactly right.” That is the second-order cost. Trusts become sensor sites. Clinicians become reporters. The MHRA becomes a standing operations room, not a stamp office.

Who Carries the Blame When a Model Drifts?

Public support in the commission’s work was wide and conditional. People wanted strong safety standards, a human still in charge, and a clear say when AI is used in their care. The Health Foundation, the commission’s research partner, set out those tests in its public’s views on AI in health care, including a red line that AI should not mean worse care for any group. Accuracy was the top public priority in that work.

Generative AI is not like other medical technologies we’ve regulated before. It can behave differently in different circumstances, and it can evolve after its initial deployment. That means we can’t rely on a single point of approval and assume the job is done.

Professor Neil Lawrence, Chair of the Technology Working Group and DeepMind Professor of Machine Learning, University of Cambridge, MHRA briefing

Hughes said patients want to know when AI is used, that it supports rather than replaces clinicians, and that someone is accountable if things go wrong. Recommendation 35 asks health bodies in England and the devolved nations to meet a reasonable expectation of being told, and to allow opt-outs where that is possible or appropriate. It also says consent at every click would be unworkable, so the panel wants system-level notice for common uses and a fuller conversation for higher-risk ones.

The liability problem is older than the report, and the report does not close it. Under current negligence law, claims tend to land on clinicians and providers because they have the clearest duty of care. The commission called that a “liability sink,” and said people should not carry risks they cannot reasonably manage.

WHERE THE RISK SITS NOW

• Manufacturers: Rec 22 would add fines when they fail to fix safety problems or ignore MHRA orders after a tool is in use.
• Trusts: Rec 28 would force contracts to name who holds each risk control, including data sharing needed for post-market watch.
• Clinicians: Rec 24 asks the Department of Health and Social Care and devolved bodies to map duties across the product life, so front-line staff are not left holding the whole bag.
• Patients: Rec 25 says DHSC should convene bodies so people can still get redress if care falls below a reasonable standard, while wider product-liability reform is left for later.

Dr Sarah Townley, deputy medical director at Medical Protection, welcomed the liability-sink language on 11 September 2026 and said it was disappointing that the report made no specific ask to update product liability law. Clearer product rules, she said, would stop doctors taking the blame for software errors and would push developers toward safer design. Until that law moves, the watch system still runs through people who did not build the model.

£3.6 Million Keeps the Airlock Open

The commission is not starting from a blank page. The MHRA opened the AI Airlock in spring 2024 as a sandbox for AI as a medical device. The pilot, which closed in April 2025, ran four products. Phase 2 finished in May 2026 with seven more innovators across three problems: evolving applications, AI diagnostics, and post-market watch. Across both rounds the programme worked with 11 innovators on seven regulatory challenges, including note-taking, cancer diagnostics, eye-disease detection and obesity support.

On 8 April 2026 the Department of Health and Social Care put £3.6 million to expand the AI Airlock, at £1.2 million a year from 2026 to 2029. Phase 3 is still being designed. The report also nods to new London and Manchester regional sandboxes, and to a National Healthtech Access Programme launched earlier in 2026 whose first wave includes tools for prostate and breast cancer detection on histopathology slides.

Separate Great Britain rules on post-market surveillance for medical devices came into force on 16 June 2025, tightening incident reporting after a device is on the market. The commission is asking for an AI-specific layer on top of that, including versioned identifiers in the record so a later model can be tied to a later outcome.

THE AIRLOCK CALENDAR

1. 9 May 2024: The MHRA launches the AI Airlock sandbox for AI as a medical device.
2. 16 June 2025: New post-market surveillance duties take force in Great Britain.
3. 26 September 2025: The National Commission is launched as an independent advisory body.
4. 11 June 2026: Evidence reports from the year of engagement are published.
5. 10 September 2026: The 44 recommendations are published; ministers have not set a reply date.

Recommendation 6 would put predetermined change control plans into UK practice, with a twist. Instead of listing each future change in advance, manufacturers could define boundaries and guardrails, then tune a model for a site or a subgroup inside those lines. Airlock work, the report said, showed that the meaning of a change depends on intended use, autonomy, the ward, and how much a clinician is expected to override the tool, including the risk of automation bias.

Washington Already Files Change Plans in Advance

The US Food and Drug Administration already reviews predetermined change control plans for AI devices as part of a marketing file. Final guidance issued on 18 August 2025 (first published on 4 December 2024) tells sponsors to describe planned modifications, the method to develop and test them, and an impact assessment. If a change stays inside an authorised plan, it should not need a fresh 510(k), De Novo or PMA filing.

That US model still wants specific, planned modifications. The UK panel wants room to describe an operating envelope instead. If MHRA follows that advice, a British licence could absorb more live learning than an FDA plan that lists the next updates in advance. It would also demand more continuous proof from the sites using the tool.

Recommendation 7 would add an optional Master File for general-purpose models, so a foundation-model builder can share technical detail with the regulator without dumping trade secrets on every device maker. Recommendation 8 would make manufacturers report when a medical product depends on such a model, including continuity plans. The report flags a sovereignty risk if many UK devices rest on a few models owned outside the country. Function-based regulation (Recommendation 4) would try to police only the medical feature of a large model, not the whole product.

Recommendation 16 would add international recognition routes for software and AI, after 59% of respondents to a separate MHRA routes-to-market consultation backed putting software-based devices on those paths. Northern Ireland still follows EU device law through the Windsor Framework, so any Great Britain reclassification has to be checked against access there.

Trusts Get a Toolbox Before They Get a Mandate

Jennifer Dixon, chief executive of the Health Foundation, said the MHRA’s role is only part of the story, and that the test is whether the NHS has the capacity, skills and systems to implement and monitor AI at the scale now asked of it. Recommendation 29 tries to answer that with an “AI readiness” toolbox that trusts could use to judge themselves before they buy.

WHAT THE TOOLBOX WOULD ASK A TRUST

• Self-assessment: Can this organisation safely deploy this specific product, not AI in the abstract?
• Risk controls: Can it actually deliver the controls the manufacturer and regulator say the setting must provide?
• Governance: Can it show the structures that will watch the tool after go-live?

Recommendation 30 would add national best-practice expectations and a learning function so one trust’s failure is not silently repeated in the next. Recommendation 32 would coordinate training across initial education, postgraduate years and continuing development, with the medical royal colleges in the room. An AI Ambassador Network of more than 14,000 NHS England members already exists; the panel says it still does not cover the whole workforce. Recommendation 13 would treat health equity as a safety issue, with subgroup monitoring through the life of a device, after public workshops drew a hard line against worse outcomes for any group.

Steve Lee, executive director of regulation at the Association of British HealthTech Industries, welcomed a proportionate, predictable, lifecycle-based approach and clearer paths from regulation to adoption. techUK, which ran roundtables for the commission, backed dual-path thinking: a lighter track for low-risk tools and a full route for higher-risk products. Those industry notes sit beside the two-thirds of industry respondents who still called the present rules a brake. Staged access does not, on its own, pay for a model. HealthAI chief executive Ricardo Baptista Leite, who took part in the commission’s wider work, argued that reimbursement paths are still missing if tools are to scale.

44 Asks Now Sit With Ministers

Denniston said one message came through from more than 12,000 people: the public is open to AI in care if it is safe, overseen by humans, and if they know when it is being used. Tallon said those gains arrive only with a modern, dynamic rulebook that speeds safe adoption and holds public and professional confidence. The government and the MHRA will now consider the list, with a formal response “in due course.”

Legislative change can take time, the report itself warns, and it tells the MHRA to issue nearer-term guidance inside today’s law while the bigger rewrite is argued. That gap is where the second-order load sits. Clinics are being asked to report, contract and train as if the new watch system already exists. Doctors are still the easy defendant if a model drifts. Manufacturers would face fines only after ministers give the agency the powers, the staff and the data pipes to use them.

Dr Stephen Harden, president of the Royal College of Radiologists, urged the government and the MHRA to put the recommendations into practice without delay, and said in-use monitoring is what would give doctors confidence to use the tools. Until that reply lands, the L-plates are a drawing on a 119-page paper, and the ward is still the place where a changing model either holds or does not.

Disclaimer: This article is news reporting on published regulatory recommendations and is for information only. It is not medical advice, legal advice, or guidance on how to deploy, buy or rely on any AI product in care. Readers who need advice on clinical use, device compliance, contracts or liability should consult a qualified clinician, a regulatory specialist or a solicitor before acting. Figures, duties and statuses reflect the cited official papers as of 10 September 2026 and will change when ministers, the MHRA or the courts respond.