UK Commission Proposes Lifecycle Oversight for Medical AI

The UK’s National Commission into the Regulation of AI in Healthcare has published a blueprint for regulating medical AI as something that changes in use, not simply something that passes a test before launch. Its 44 recommendations put continuous monitoring, staged authorization and public-facing safety information at the center of a future framework—an attempt to make oversight keep pace with adaptive health technologies while preserving a route to deployment.

The final report was published on September 10 by the Medicines and Healthcare products Regulatory Agency, which created the Commission in September 2025 as an independent advisory body. The report runs to 119 pages and addresses not only AI-enabled medical devices, but also accountability, transparency, clinical practice and organizational governance.

Its central recommendation is a shift from regulation focused on a one-time pre-market assessment to proportionate oversight across development, deployment, monitoring, updates and learning from real-world use. The logic is practical: AI-enabled health products can iterate after deployment and can perform differently across settings, so an initial decision may not answer every safety question that emerges later.

The staged-authorization proposal is the clearest example of that new approach. Rather than treating authorization as a single all-or-nothing event, it would allow a device to operate in a limited setting first, then broaden its use as evidence builds. A legal analysis compared the model to learner-driver “L-plates,” though the Commission’s recommendation is not a rule now in force.

The report also calls for expanded change-control plans: defined boundaries and guardrails within which adaptive AI can change, including regulated AI agents. That would make the anticipated behavior of a system after launch part of the regulatory design, rather than leaving each meaningful update to be understood only after the fact.

The report’s accountability proposals

• Patients should be told when AI is used in their care and be able to opt out where appropriate.
• Safety information about particular AI-enabled medical devices, including adverse incidents, should be publicly accessible.
• Manufacturers and healthcare providers should allocate all risk controls contractually, alongside clearer responsibility across the product lifecycle.
• Manufacturers should disclose dependencies on general-purpose AI models, associated risks and continuity plans.

The framework would not stop at the company selling a finished medical device. The Commission proposes an optional confidential “Master File” through which developers of general-purpose AI models could share technical specifications with the MHRA to support downstream device applications. Separately, device makers would need to identify their reliance on those models and plan for related risks or service continuity.

The publication does not create new obligations. The Commission is advisory, and it recommends MHRA guidance within the existing framework while broader legislative change is considered. It also calls for a systematic review and update of the UK Medical Devices Regulations 2002.

The next formal signal will come from the promised cross-government response, which is meant to explain how government and system partners will consider and take forward the recommendations. Until then, the report is a detailed proposal for how UK medical-AI oversight could work—not a settled answer to how quickly, or how fully, its mechanisms will be adopted.