Summary

The UK Medicines and Healthcare products Regulatory Agency (MHRA) has confirmed that Great Britain will regulate artificial intelligence in healthcare through a sector-by-sector approach rather than adopting a horizontal law equivalent to the EU AI Act. Following a September 2026 report from the National Commission into the Regulation of AI in Healthcare, the MHRA published its response in October 2026, outlining planned civil sanctions, revised classification criteria for AI software, staged authorisation pathways, and lifecycle oversight frameworks. Organisations developing or deploying AI-enabled medical devices in the UK must prepare for a materially more stringent enforcement environment from late 2026 onwards.

AI-enabled medical devices in Great Britain: what the MHRA's regulatory overhaul means for your compliance strategy

The UK's MHRA is reshaping the regulatory landscape for AI-enabled medical devices. In October 2026, the agency published its formal response to a National Commission report containing 44 recommendations on AI in healthcare, confirming a sector-specific model that diverges deliberately from the EU AI Act's horizontal architecture. For sponsors, contract research organisations (CROs) and healthtech developers operating across the UK and the European Economic Area, this divergence creates parallel compliance obligations that must be managed simultaneously.

This article sets out the core elements of the MHRA's planned reforms, maps them against existing clinical data obligations including those arising under 21 CFR Part 11 clinical data rules for US-facing studies, and identifies the practical steps organisations should take now.

What is the MHRA's sector-by-sector approach and why does it matter?

The MHRA's sector-by-sector approach means that AI used in healthcare will be regulated through existing and adapted medical device, medicines and diagnostics legislation rather than through a single overarching AI statute. This contrasts with the EU AI Act (Regulation (EU) 2024/1689), which applies horizontally across sectors and classifies AI systems by risk level regardless of the industry in which they are deployed.

The National Commission into the Regulation of AI in Healthcare, whose September 2026 report prompted the MHRA response, concluded that healthcare AI carries sufficiently distinct characteristics to warrant dedicated sectoral rules. The MHRA agreed, arguing that medical device legislation already provides the conceptual scaffolding for safety, efficacy and post-market surveillance that a horizontal law would need to replicate.

For organisations that operate in both the UK and the EU, this means maintaining two separate compliance tracks. A high-risk AI system used in a clinical trial that qualifies as a medical device under UK law will be assessed against MHRA criteria, while the same tool deployed at an EEA site must simultaneously satisfy the EU AI Act's requirements for high-risk AI systems under Annex III, as well as the Medical Device Regulation (EU) 2017/745 where applicable.

Focus: the European Economic Area context

The EU AI Act came into force on 1 August 2024 and applies in full to high-risk AI systems from August 2026. AI systems intended for use as safety components of medical devices, or which are themselves medical devices, fall within Annex III and attract the highest pre-market scrutiny. Sponsors running multinational trials that include both UK and EEA sites must therefore map each AI tool against both frameworks and document the outcome in a dual compliance record.

What are the MHRA's planned enforcement changes and when will they take effect?

The most immediately consequential element of the MHRA's October 2026 response is the activation of civil sanctions that were legislated under the Medicines and Medical Devices Act 2021 but have never been applied. These sanctions include compliance notices setting binding remediation deadlines and financial penalties for non-compliance.

The MHRA intends to begin using these powers as guidance rolls out from late 2026. Organisations that have treated UK medical device regulation as a relatively light-touch regime should revise that assumption. The enforcement model will increasingly resemble the approach taken by data protection authorities under the UK GDPR, where the Information Commissioner's Office (ICO) can issue fines of up to £17.5 million or four per cent of global annual turnover, whichever is higher.

Additional planned enforcement-adjacent changes include:

1. A Spring 2027 consultation on redefining which software and AI systems qualify as medical devices, with the stated intention of potentially widening scope to capture more software-based clinical tools.
2. Clearer pre-market advice channels and staged authorisation pathways under existing MHRA licensing powers, reducing ambiguity for developers seeking early engagement.
3. An improved Yellow Card adverse-incident reporting scheme to capture AI-specific harms more systematically.

Focus: civil sanctions and clinical data obligations

For organisations subject to 21 CFR Part 11 clinical data requirements, the activation of MHRA civil sanctions introduces a second enforcement vector. 21 CFR Part 11 is the US Food and Drug Administration regulation governing electronic records and electronic signatures in clinical investigations; it requires that electronic systems used to create, modify or transmit clinical data meet defined validation, audit trail and access-control standards. A UK-based AI tool that generates or processes electronic clinical records for a study with US regulatory ambitions must simultaneously satisfy 21 CFR Part 11 and the forthcoming MHRA AI device rules. Non-compliance with either framework can delay or invalidate a regulatory submission.

How does the MHRA approach post-market lifecycle oversight for continuously updating AI?

Post-market lifecycle oversight for continuously updating AI is one of the most technically complex aspects of the MHRA's reform agenda. Traditional medical device regulation assumes a relatively static product; once approved, the device does not materially change without a new conformity assessment. AI models that learn from real-world data or that are retrained periodically do not fit this model.

The MHRA plans to publish guidance on predetermined change control plans (PCCPs) by the end of 2026. A PCCP is a structured document, already recognised by the FDA in its own AI and machine learning software guidance, that specifies in advance the types of modifications a developer anticipates making to an AI model and the validation procedures that will govern each modification. By agreeing a PCCP with the regulator before deployment, a developer can make defined changes without triggering a full re-authorisation process.

Focus: the FDA's PCCP framework

The FDA issued its final guidance on PCCPs for AI and machine learning-enabled medical devices in December 2024. The MHRA's adoption of a broadly similar concept reflects regulatory convergence between the UK and US frameworks, which is significant for sponsors conducting trials in both jurisdictions. Where a sponsor has already agreed a PCCP with the FDA for a US study, the MHRA's guidance may allow a comparable plan to be adapted for UK use, reducing duplicative development effort.

Focus: implications for 21 CFR Part 11 clinical data integrity

AI systems that continuously update their outputs can create audit trail challenges under 21 CFR Part 11 clinical data rules. If the model that generated a clinical data point at day one of a trial has been retrained by day 90, the audit trail must record both the data point and the model version that produced it. Sponsors should ensure that their electronic data capture (EDC) systems and validation protocols are configured to log model versioning alongside standard audit trail entries. This requirement applies irrespective of whether the study is conducted under the EU Clinical Trials Regulation (EU CTR 536/2014) or under UK post-Brexit clinical trials legislation.

Comparing the MHRA and EU AI Act frameworks: key differences for clinical developers

The table below summarises the principal differences between the MHRA's planned sector-specific approach and the EU AI Act's horizontal model as they apply to AI-enabled medical devices used in clinical research.

<table><tr><th>Feature</th><th>MHRA (Great Britain)</th><th>EU AI Act (EEA)</th></tr><tr><td>Legislative architecture</td><td>Sector-specific via medical device and medicines law</td><td>Horizontal regulation across all sectors</td></tr><tr><td>Classification basis</td><td>Medical device risk classification adapted for AI</td><td>AI risk tiers (minimal, limited, high, unacceptable)</td></tr><tr><td>Pre-market pathway</td><td>Staged MHRA authorisation; PCCP guidance by end 2026</td><td>Conformity assessment; CE marking; notified body involvement for high-risk</td></tr><tr><td>Civil sanctions</td><td>Compliance notices and fines under Medicines and Medical Devices Act 2021</td><td>Fines up to EUR 30 million or 6% of global turnover under Article 99</td></tr><tr><td>Post-market lifecycle</td><td>PCCP guidance; Yellow Card enhancements</td><td>Continuous monitoring obligations under Article 72</td></tr><tr><td>Bias and transparency</td><td>Forthcoming MHRA guidance</td><td>Articles 9 and 13 requirements on risk management and transparency</td></tr><tr><td>General-purpose AI models</td><td>Guidance in development</td><td>Title VIII, Articles 51 to 56</td></tr><tr><td>Spring 2027 consultation</td><td>Planned for classification scope</td><td>Not applicable; Act already in force</td></tr></table>

Focus: Scotland, Wales and Northern Ireland

The MHRA's reforms apply to Great Britain, comprising England, Scotland and Wales. Northern Ireland occupies a distinct position: under the Windsor Framework, medical devices placed on the Northern Ireland market must comply with EU rules, meaning that AI-enabled medical devices deployed at clinical sites in Northern Ireland will be assessed against EU AI Act and EU MDR criteria rather than the MHRA's sector-specific framework. Sponsors opening sites across all four nations of the United Kingdom must account for this jurisdictional split in their compliance documentation.

Practical compliance steps for sponsors and clinical developers

Organisations that develop, sponsor or deploy AI-enabled medical devices in the UK should take the following steps in preparation for the MHRA's enforcement activation:

1. Audit current AI tools used in clinical operations against the UK medical device classification criteria and flag those that may fall within the widened scope proposed in the Spring 2027 consultation.
2. Review electronic records and signature systems for compliance with 21 CFR Part 11 clinical data requirements where studies have US regulatory destinations, and document the validation status of any AI-assisted data capture or analysis tools.
3. Prepare a predetermined change control plan for AI models that are retrained or updated during a study, aligning the plan with both the anticipated MHRA guidance and the FDA's December 2024 PCCP guidance where dual jurisdiction applies.
4. Map each AI tool against the EU AI Act Annex III criteria for sites in the EEA, and maintain a dual compliance record where a tool is deployed in both Great Britain and the EEA.
5. Engage the MHRA's pre-market advice service at the earliest opportunity to understand the staged authorisation pathway applicable to a specific tool.
6. Update trial master file (TMF) templates to include AI governance documentation, including model version logs, PCCP summaries and any MHRA or FDA pre-market correspondence.
7. Review the Yellow Card scheme participation obligations and ensure that adverse incident reporting procedures are extended to cover AI-specific harms.

How iliomad can support your AI device compliance strategy

Iliomad provides specialist data protection and AI governance support to sponsors, CROs and healthtech developers operating in the UK, EU and internationally. Our team assists clients in building compliance frameworks that address MHRA medical device obligations, EU AI Act requirements, UK GDPR and 21 CFR Part 11 clinical data standards within a single integrated programme.

If your organisation is developing or deploying AI-enabled medical devices and needs to prepare for the MHRA's forthcoming enforcement environment, contact iliomad's AI governance team to discuss a tailored compliance assessment.