Policy paper

The regulation of artificial intelligence as a medical device: government response to the Regulatory Horizons Council

Published 10 March 2025

Letter to Regulatory Horizons Council (RHC) from Baroness Merron

By email on 10 March 2025.

RHC report on the regulation of artificial intelligence as a medical device (AIaMD): government response

Dear Regulatory Horizons Council,

Thank you for producing this report on the regulation of artificial intelligence as a medical device (AIaMD) and for your recommendations to the government. I am writing now to provide you with the government’s response.

Artificial intelligence (AI) continues to progress as a technology with great potential to benefit the health and care sector. As the Prime Minister set out in the AI Opportunities Action Plan, the adoption of AI in health will be critical to achieve this government’s ambitions to raise living standards by growing our economy, and to build a National Health Service fit for the future.

For medical devices in particular, AIaMD exists as a subset of software as a medical device (SaMD) and has advanced significantly in recent years.

The government continues to progress work to ensure that the UK medical device regulations are suitable to protect patients and the public while supporting innovation. Specifically, the Medical Devices Regulations 2002 (as amended) (hereinafter ‘UK MDR 2002’) are undergoing a programme of reform.

The Department of Health and Social Care (DHSC) and the Medicines and Healthcare products Regulatory Agency (MHRA) are leading this work and it is aligned with most of the recommendations which you have made in your report. The approach to this reform of the medical devices regulations was outlined in the government response to a public consultation, published in June 2022.

Chapter 10 of the consultation contains the proposed legislative changes specifically for software and AI products. Additionally, the MHRA is releasing a suite of regulatory and best practice guidance documents to support manufacturers of software and AI medical devices to meet the legislation, with published elements located on the Software and AI as a medical device webpage. 

To ensure products are safe and effective we are developing best-in-class regulations which uphold safety standards, encourage innovative and sustainable product development, and drive better outcomes for patients.

I have laid out below the recommendations from the RHC report and the government’s responses.

Since the publication of this report, generative AI has emerged and revolutionised the way we work and impacted all sectors of the economy. The use of generative AI in healthcare poses significant opportunities, but this requires innovation to be balanced with patient safety.

I have asked my officials to liaise with the RHC, with a view to formally commissioning a review of generative AI in healthcare to ensure we are able to address the pressures mounting on the NHS, while drawing on the opportunity to catalyse the adoption of AI in healthcare through proportionate and innovative regulation. I look forward to continuing to work with the RHC.

Yours sincerely

Baroness Merron

Parliamentary Under-Secretary of State for Patient Safety, Women’s Health and Mental Health

Government response to each of the report’s recommendations grouped by theme

Theme A: regulatory capacity and capability

Recommendation 1

The MHRA should be specifically resourced with a long-term funding commitment to enable them to create and service a regulatory framework that is efficient, proportionate and safe, and supports the UK in being a leader in the innovation, evaluation and utilisation of AIaMD.

Government response

Accept in principle: the government continues to support the appropriate funding required for the operation of the MHRA, taking into account all of its functions. The MHRA’s regulatory functions for medical devices are primarily funded by DHSC, with the remaining funding from fees charged for services.

In October 2023, the NHS AI Lab provided MHRA with £1 million to pilot an AI focused regulatory sandbox, to uncover challenges and solutions to regulating AIaMD safely. In spring 2024, the MHRA launched the AI Airlock, a regulatory sandbox for AIaMD in collaboration with the NHS and Team AB (UK association for medical device approved bodies). The pilot is running until spring 2025, using real-world AI products and prototypes to tackle regulatory challenges, informing future policy and sandboxes. 

Recommendation 2

Strengthen regulatory capacity and capability in AIaMD, addressing pre-market and post-market phases, through targeted training of regulators and other gatekeepers and key contributors across the total product lifecycle.

Government response

Accept: the MHRA is supportive of this recommendation and is working to expand its regulatory capacity in AI within existing resources. The primary audience for guidance documents through the Software and AI as a Medical Device Change Programme is manufacturers of AIaMD being placed on the UK market. However, these documents are also of use for increasing the capabilities of MHRA staff and conformity assessment bodies conducting product assessments.

Further, the MHRA continues to welcome applications from organisations that wish to be designated as UK approved bodies, expanding capacity for the assessment and approval of all medical devices including software and AI.

Theme B: whole product lifecycle

Recommendation 3

The UK should aim for an AIaMD regulatory framework that is ‘legislatively light’ and maximises the role of standards and guidance and builds on existing regulations for SaMD while also addressing the specific challenges of AI technologies.

Government response

Accept: the MHRA supports this recommendation which aligns with the UK’s cross-sector pro-innovation approach to regulating AI. It also recognises that the identified risks most associated with AIaMD products are appropriately covered within the existing UK medical device regulations to provide safety oversight.

Further, the legal framework for medical devices is undergoing updates as initially outlined in the government response to the MHRA consultation in 2021. The changes to this framework remain light-touch for software and AI products, with the relevant content to AI-specific challenges being produced via the Software and AI as a Medical Device Change Programme, which has dedicated work packages to tackle specific challenges such as bias, interpretability and adaptive change.

Recommendation 4

Manufacturers should be required to provide evidence that they have evaluated and mitigated risks of the 2 major issues of (1) poor generalisability and (2) AI bias that can arise due to the use of AI.

Government response

Accept: the MHRA supports this recommendation. The UK medical devices regulations require that products are designed to be sufficiently safe for their intended use population under normal conditions of use. Risks relating to generalisability and bias that may arise for AI products would be covered by the general requirements of the essential requirements which manufacturers are required to comply with under regulation 8 of the UK MDR 2002.

Manufacturers must produce documented evidence against these requirements for their product’s intended use. Guidance on generalisability, bias and other AI focused considerations across the product lifecycle will be produced via our Software and AI as a Medical Device Change Programme. Specifically, the issues of generalisability and bias are covered by work package 9 (‘AI Rigour’).

Recommendation 5

Manufacturers should provide information regarding the extent to which the basis of the outputs of the AIaMD is interpretable and can be interrogated.

Government response

Accept: the MHRA accepts and support this recommendation. The UK MDR 2002 requires manufacturers to take into account the state of the art^{[footnote 1]} when conforming to safety principles when reducing risks. As such, the level of understanding of the intended user must be accounted for in the design of the medical device. In the context of AIaMD products, this would include the information, tools and access required for relevant stakeholders to interpret and interrogate the outputs of the AIaMD.

The Software and AI as a Medical Device Change Programme dedicates work package 10 (‘Project Glassbox’) to work items to articulate the safety, effectiveness and quality concerns that can arise from poorly interpretable AIaMD. More broadly, this work seeks to provide guidance to understand the need to optimise the safety of the Human-AI team which requires gaining a level of trust of AIaMD for both end users and patients.

Recommendation 6

The regulatory framework should support innovative mechanisms that enable accelerated access with more evidence generation occurring after deployment.

Government response

Accept: the MHRA supports a pro-innovation approach to the safe regulation of software and AI products and accepts this recommendation. The MHRA is strengthening the post-market surveillance (PMS) aspects of the UK MDR 2002 through its legislative reform work, with new legislation taking effect in June. This will increase patient safety with additional obligations and clarity on gathering data in the post-market phase of the product lifecycle.

Supporting this work, the Software and AI as a Medical Device Change Programme has work packages and individual items that highlight the need to monitor and gather data across the entire product lifecycle. This includes, but is not limited to, work package 4-02, which provides software and AI-specific guidance on adverse event reporting and work package 9 ‘AI Rigour’, which covers evidence generation for AI products both pre and post-market.

Beyond legislative reform and supporting guidance, since September 2023 the MHRA and its partners have been delivering the Innovative Devices Access Pathway (IDAP) pilot. The IDAP is an initiative designed to accelerate the development of innovative medical technologies that meet an unmet clinical need in the NHS.

Recommendation 7

Prior to a local deployment, manufacturers should work with health institutions to provide evidence that the AIaMD is likely to perform safely within their local setting, and work with them to provide that evidence where still needed.

Government response

Accept in principle: the UK MDR 2002 requires manufacturers to design medical devices to operate safely and effectively within their intended use environment. For AIaMD this includes both the generalisation of model to the intended use environment and the assessment and management of local variability issues during deployment.

This issue is not unique to AI products, but current evidence indicates that AIaMD products may be more sensitive to differences in infrastructure and sub-group distributions within the intended patient population that can be experienced at a local level. To appropriately address this, the Software and AI as a Medical Device Change Programme contains work items that will identify aspects of the development and deployment lifecycle for best practice compliance (work package 9-04). This includes the use of staged deployment approaches and on-site validation activities ahead of full deployment.

In addition, the MHRA has outlined both legislative and guidance aspects to the introduction of predetermined change control plans (PCCPs). PCCPs are a new regulatory tool that allows pre-approved modifications to software products to be implemented without requiring further regulatory review. This mechanism may assist manufacturers and health institutions in ensuring performance is maintained at a local level.

Recommendation 8

Key stakeholders including NHS, regulatory agencies (MHRA, Care Quality Commission (CQC)), and manufacturers should work together to create standards that ensure that post-market monitoring of performance and safety should be pro-active, systematic and an essential condition of deployment.

Government response

Accept: the MHRA accepts this recommendation. Under the UK MDR 2002, manufacturers are already required to conduct post-market surveillance activities. These requirements are being strengthened through legislative reform activities expected to come into force from June. Additionally, the MHRA is working with the NHS on the Artificial Intelligence Deployment Platform (AIDP) project to ensure post-market surveillance is factored into deployment plans from the start. Finally, the MHRA is engaged with academic partners and CQC on the topic of AI safety monitoring.

Recommendation 9

In addition to safety monitoring, stakeholders should work together to create systems in which AIaMD performance can be optimised through model updating and innovation within a secure data environment of the NHS.

Government response

Accept in principle: much of this recommendation falls beyond the scope of the MHRA’s remit, which focuses on safety monitoring through reporting and updating AIaMD to address safety concerns. The MHRA also recognises the patient benefits to ensuring optimal product performance and is supportive of this recommendation.

The MHRA is working with several partners who are looking to advance AI deployment to ensure that safety monitoring is kept in mind. Substantial work is underway to understand how to develop a streamlined and scalable process for deploying regulatory compliant AIaMD products into NHS infrastructure safely and sustainably. The MHRA has been working closely with the NHS AI Lab to increase safety by design from the ground up.

Recommendation 10

The health institution and device manufacturer should be required to agree, as part of contractual negotiations prior to deployment, an approach for monitoring and responding to performance and safety issues that adequately assures patient safety and ensures that there is a ‘plan B’ in case of the need for device withdrawal.

Government response

Accept in principle: the MHRA’s interpretation is that this recommendation should be included in wider procurement requirements rather than within medical devices regulations themselves. Accordingly, this requirement does not directly apply to the UK MDR 2002. Nevertheless, the MHRA agrees with the spirit of the requirement and is supportive of this recommendation, which increases patient safety.

Manufacturers should have a plan in place should they withdraw their product from the market, and work package 5-03 from the Software and AI as a Medical Device Change Programme intends to cover this topic within best practice guidance. Please note that this issue is not unique to AIaMD and will therefore fall under this broader SaMD guidance on managing software products that that are no longer being supported by the manufacturer.

Theme C: open transparency, patient and public involvement

Recommendation 11

The end-to-end regulatory pathway for AIaMD needs to be clearly communicated and supported by guidance that is accessible to innovators that are new to medical device regulation.

Government response

Accept: the MHRA supports the need to clearly communicate medical device regulatory requirements; greater education and understanding of healthcare product safety regulations will improve patient safety. The MHRA accepts this recommendation and strives for high quality, accessible guidance through the Software and AI as a Medical Device Change Programme to convey legislative requirements and best practice for innovators looking to create medical device products. This clarity is of particular importance for the manufacturers of SaMD and AIaMD products, where the MHRA observes many new innovations developed by established organisations whose prior operations are outside of the healthcare space and may not be as experienced in medical device regulatory requirements.

Secondly, the digital health space in general, and medical device market more widely, has a large proportion of small and medium-sized businesses that typically have more limited resources. Therefore, the MHRA is investing in clear guidance which will benefit the full range of stakeholders to enable greater access to safer medical devices. Further, the agency is working across the healthcare sector with other agencies via the Artificial Intelligence and Digital Regulations Service (AI DRS) project that brings together the MHRA, National Institute for Clinical Excellence (NICE), Health Research Authority (HRA) and CQC to help navigate the regulatory landscape for developing and adopting AI in health and social care.

Thirdly, the AI Airlock pilot is providing a collaborative approach to exploring regulatory challenges in a transparent manner. Within this approach the project is working closely with the MHRA’s patient engagement and involvement team on a per candidate basis to ensure the lived experiences are also informing these discussions. 

Recommendation 12

Regulatory processes for AIaMD should have adequate explanation for public and patients to have trust in the system, which should be supported by the MHRA providing a public-facing register to include all AIaMD on the UK market, including their risk class, their intended use statement and a plain English summary of their intended use statement.

Government response

Accept in principle: the MHRA places patients and the public at the heart of its organisational strategy, striving for better engagement and public-facing communication activities across all of its functions. For guidance relating to software and AI products through the Software and AI as a Medical Device Change Programme, the MHRA endeavours to produce plain English summaries to better communicate technical and regulatory requirements with as wide an audience as possible.

There are no plans to legally enforce the publishing of information on a device’s intended use within the current legislative reform. As such the MHRA accepts this recommendation in principle but is unable to implement it in full at this time. However, the agency encourages manufacturers to make this information available to the public in our guidance, specifically within the added value section of work package 1-02 Crafting an intended purpose in the context of software as a medical device (SAMD).

Regarding the recommendation for a public facing register for all AIaMD on the UK market, the MHRA has a public access database for medical devices registered with the agency, called Public Access Registration Database (PARD). PARD allows users to identify the risk classification of the product and the legal manufacturer or UK responsible person, and registration is a legal requirement for all medical device products placed on the UK market.

Recommendation 13

Manufacturers, regulators and other stakeholders should demonstrate and role model greater patient and public involvement in the design, evaluation and regulation of AIaMD.

Government response

Accept: the MHRA accepts this recommendation and has work items within the Software and AI as a Medical Device Change Programme that will encourage the inclusion of patient and public involvement in the design, evaluation and regulation of AIaMD products. Specifically, work package 9 Best Practice AIaMD Development and Deployment will highlight the need to engage with relevant stakeholders across the product lifecycle, and this approach is in alignment with the wider MHRA patient and public engagement strategy.

Theme D: UK leadership and international collaboration

Recommendation 14

The UK should demonstrate international leadership in the regulation of AIaMD, leveraging its expertise and position to support international harmonisation in this area.

Government response

Accept: AIaMD products, and SaMD more broadly, are increasingly becoming global products as the development and deployment barriers can be lower than those for hardware products which must be physically transported between manufacturing sites and end users. The growth of software as a service (SaaS), improved interconnectedness via cloud infrastructure and the post pandemic shift toward remote interactions, all allow digital products to reach users more easily. Changes such as these and more lead to new challenges in the creation and use of safe AIaMD products which regulations must adapt to.

Since the UK’s departure from the European Union, the MHRA has gained full membership to the International Medical Device Regulators Forum (IMDRF) as a sovereign regulator to ensure the agency has a voice at the international level. Further, the MHRA is co-chairing the Artificial Intelligence/Machine Learning-enabled (AI/ML) Working Group, which seeks international harmonisation on AI regulatory positions held by IMDRF members and regional harmonisation initiatives. This co-chairing, along with having a strong independent voice in other working groups, provides the UK the opportunity to demonstrate international leadership both in the regulation of AIaMD and harmonisation of medical device regulations more broadly.

Beyond IMDRF, the MHRA has established relationships with several other medical device regulatory bodies around the world and this is leading to bilateral and/or multilateral working relationships. For example, a trilateral working relationship focused on AI and digital health between the MHRA, the USA’s Food and Drug Administration (FDA) and Health Canada has developed over the past couple of years. Through this group, the good machine learning practice (GMLP) guiding principles were developed and published. Following on from the GMLP principles, 2 additional work items have been jointly published, the first on principles of PCCPs and the second on transparency in machine learning medical devices.

Recommendation 15

The UK should aim for regulatory efficiency in AIaMD by adopting good reliance practices (GReIP) in medical device regulatory decision making.

Government response

Accept: the MHRA has developed strong working relationships with many international regulators in the digital and AI spaces to promote consensus generation and alignment. Additionally, the MHRA is working both domestically and internationally with standards bodies such as the British Standards Institution (BSI), public-private partnership initiatives such as the Medical Device Innovation Consortium (MDIC) and centres of academic excellence.

Furthermore, the MHRA is currently developing an international reliance framework. The objectives of this framework are to ensure patients have safe access to medical devices that best suit their needs, to speed up patient access, and to reduce the duplication of regulatory effort for businesses.

1. The ‘state of the art’ is a legal term used to capture the generally accepted consensus of the method for how something should be done - this may be the latest or most advanced method or it may be the broadly accepted method until innovation shifts the consensus. ↩