What healthcare and technology will be talking about in six months.

It feels harder than ever to try and predict what the world will look like just six months into the future. As if the world wasn’t moving fast enough, the rare prospect of the entire landscape of healthcare changing all at once may well be a reality. The entire structure of the NHS is being redrawn. AI regulation is moving from a one-off approval to a lifecycle. The clinical safety standards that underpin digital health are being rewritten. New European rules on liability are taking effect, and medical device rules are being reformed. Each of these would be a big story on its own. Together, they mean the conversation between suppliers and providers will look very different in spring 2027.

1. Who is in charge, and who is buying?

The Health Bill, which would abolish NHS England and move its functions mainly to the Department of Health and Social Care and integrated care boards, has passed the Commons and reaches its Lords second reading in October 2026. The department’s own timetable has the new arrangements starting in April 2027, subject to the legislation passing. Integrated care boards that are clustering are expected to merge by April 2027, while cutting running costs by half. More commissioning responsibility is moving to ICBs.

For suppliers, that means changing buyers, changing priorities and slower decisions in the meantime. For providers, it means doing more with less central support. Expect a lot of conversations about who owns digital decisions, and a premium on suppliers whose evidence is easy to trust without a long review.

2. AI regulation moves to a lifecycle

In October 2026 the government accepted all 44 recommendations of the National Commission into the Regulation of AI in Healthcare. The MHRA expects to publish draft guidance on managing changes to AI devices in December 2026, and an implementation plan for all 44 recommendations is due by spring 2027. New pre-market medical device regulations are also expected to be made around the turn of the year, with most provisions expected to apply from June 2027.

By spring, the question buyers ask will shift from “are you approved?” to “how do you know it is still safe?” Monitoring in use, change control, model dependencies and contracts that allocate every risk control will be the new vocabulary.

3. AI scribes at scale, and under scrutiny

Ambient voice technology is moving from pilots to large regional deployments. In July 2026 the MHRA clarified that scribes used only for transcription and summarising are not medical devices, which puts more of the safety work on deploying organisations. A national HSSIB investigation into AVT in hospitals is under way. Expect AVT to be the test case everyone points to when they talk about safe AI adoption.

4. Clinical safety standards, rewritten

NHS England’s consultation on DCB 0129 and DCB 0160 closed in September 2026. It asked about risk-based tiering, AI, agile development, cybersecurity, the Clinical Safety Officer role, and accountability for risk that passes between organisations. The government has committed to sharing further details by spring 2027 on strengthening clinical risk management guidance under DCB 0129 and DCB 0160. No date has been set for revised standards, but the direction is clear: proportionate, continuous, and joined up between supplier and provider.

5. Cyber assurance tightens

The Cyber Security and Resilience Bill has reached report stage in the Lords. Cyber Essentials changed in April 2026, making missing multi-factor authentication on cloud services, and failing to apply critical or high-risk updates within 14 days, automatic fails. The 2026-27 Data Security and Protection Toolkit was published in October 2026. Suppliers should expect sharper cyber questions in every procurement, and providers more pressure on their supply chains.

6. Data, records and trust

The Single Patient Record could give clinicians access as early as 2027, in specialties including maternity and frailty care. The future of the Federated Data Platform contract will be debated ahead of its break clause in March 2027. Underneath both sits the same question: how do patients and clinicians trust what happens to their data?

7. Europe keeps moving

For UK companies selling into Europe, three dates matter. Legacy devices must be registered in EUDAMED by 28 November 2026. The new Product Liability Directive applies from 9 December 2026 and treats software, including SaaS and AI, as a product. And the European Parliament is expected to set out its position on reforming the MDR and IVDR around the new year. The EU AI Act’s high-risk obligations have moved to December 2027 and, for AI in medical devices, August 2028, which buys time but not much.

By spring, the question will shift from “are you approved?” to “how do you know it is still safe?”

What ties it together

Look across all seven and one theme stands out. Assurance is becoming continuous, shared and accountable. Continuous, because regulators want to know a product is safe in use as well as at launch. Shared, because suppliers and providers are being asked to allocate every risk between them. Accountable, because restructuring and new laws leave less room for responsibilities that nobody owns.

How to be ready by spring

• Suppliers: make your evidence easy to trust and easy to share. Keep it current, and be clear about which risk controls your customers own.
• Providers: know what you are running, what you have inherited from each supplier, and what you are monitoring.
• Both: put a simple monitoring plan in place for every AI-enabled product, and agree how changes will be communicated.
• Both: check your cyber posture against the new Cyber Essentials rules before your next renewal.
• If you sell into Europe: confirm your EUDAMED registrations and review your exposure under the new product liability rules.

This is the world Qyro was built for. One current record, checked as things change, shared between the people who need to trust it, with the next step always clear. We will keep tracking these dates on our regulatory timeline as they move.