44 recommendations, all accepted. What changes for healthcare AI.

The honest and perhaps safest answer to “how is AI in healthcare regulated?” has been “it depends” for the longest time. On whether the product is a medical device. On how its manufacturer describes its intended purpose. On which class it lands. On what really happens after it goes live.

This answer is about to change for all the right reasons. The National Commission into the Regulation of AI in Healthcare, convened by the MHRA in September 2025 and chaired by Professor Alastair Denniston, published its recommendations on 10 September 2026. Less than a month later, the government accepted all 44 of them.

The big shift: from a moment to a lifecycle

The Commission’s central idea is simple. Approval is a moment. Safety is a lifecycle. A product that was safe at launch can drift as its model is updated, as its data changes, or as it is used in places nobody planned for. So regulation has to follow the product through its whole life.

The recommendations are grouped under three themes: proportionate lifecycle regulation, system-wide responsibility and safe management, and trust, transparency and predictability. A few stand out.

• A review of the Medical Devices Regulations 2002, including the device definition, classification and the reliance on self-declared Class I.
• Predetermined change control plans that set boundaries and guardrails, so products can improve without starting again, including for AI agents.
• Staged authorisation, an “L-plates” model where new products earn wider use as evidence builds.
• Manufacturers disclosing their dependence on general-purpose AI models.
• Clear allocation of responsibility at every stage, with contracts that assign every risk control between manufacturer and provider.
• Staff training, patients told when AI is used in their care, and a public, searchable database of adverse incidents.

Approval is a moment. Safety is a lifecycle. The UK has now committed to regulating the lifecycle.

What happens next

Acceptance is a direction of travel. It does not create new legal duties overnight. The government has set out ten priority areas and a first set of dates. The MHRA expects to publish draft guidance on managing changes to AI devices in December 2026. An implementation plan and roadmap for all 44 recommendations is due by spring 2027, and the MHRA intends to launch a consultation on how software and AI devices are qualified and classified by the same point. Further details are also promised by spring 2027 on strengthening clinical risk management guidance under DCB 0129 and DCB 0160, and on how responsibilities between manufacturers and providers should be allocated in contracts.

Separately, NHS England’s review of DCB 0129 and DCB 0160 closed its consultation in September 2026. The two pieces of work point the same way.

What it means for suppliers

If you build AI for healthcare, the questions buyers ask are about to get sharper, and they will keep being asked after the contract is signed. Expect to show how you monitor performance in use, how you manage change, which models you depend on, and exactly which risk controls you own. Companies that can answer those questions from a current record will move faster. Those that rebuild the answer for every buyer will feel the weight.

There is upside here too. The Commission wants clearer routes to market, earlier written feedback from the MHRA, and regulation that is proportionate to risk. For teams that already treat quality as part of how they build, that is good news.

What it means for NHS providers

For trusts, ICBs and practices, deployment becomes an assured activity in its own right. Readiness before go-live, monitoring during use, staff training, telling patients, and contracts that leave no control unowned. The Commission is candid that, today, claims are disproportionately likely to be brought against clinicians and providers. Until new indemnity guidance arrives, the safest position is one where you can show what you checked, what you inherited from the supplier, and what you are watching.

Five things to do now

• Map every AI-enabled product you build or use, and its intended purpose.
• For each one, write down who owns each risk control, supplier or provider. Gaps will show quickly.
• Put a monitoring plan in place: what you check, how often, and who acts on it.
• Agree with your suppliers how model and feature changes will be communicated.
• Start training the people who use these tools, and decide how you will tell patients.

Why we care

Qyro exists to break down the barriers that stop good technology reaching patients. Regulation that is clear, proportionate and continuous removes one of the biggest. It rewards the teams doing the work properly and gives buyers something solid to trust.

It is also why we built Qyro the way we did. Qyro Continuum checks every clause as things change. Qyro Assurance Planner turns monitoring into owned, dated steps. Qyro Hazard Studio holds each risk control with its owner, on both sides of the handoff. Lifecycle assurance is the job the platform was designed for.