The NHS wants to be the world’s most AI-enabled health system. A new commission report says regulation has to catch up

At a glance

The UK’s MHRA-commissioned National Commission issued 44 advisory recommendations arguing that current medical device rules, built for static products, don’t fit AI tools that update often and vary by setting, so oversight should span the whole product lifecycle with stronger post-market monitoring, a public adverse-incident database and a temporary staged-authorization pathway for promising devices. The report also stresses that regulation alone isn’t enough: clear liability and responsibilities, clinician training and more transparency with patients are needed, and expert Dr. Raquel Iniesta cautions that faster access must not shift poorly understood risks onto patients or frontline staff.

The UK’s National Commission into the Regulation of AI in Healthcare published its 119-page final report on September 10, setting out 44 recommendations for how the country should regulate AI in healthcare.

The recommendations are advisory. A cross-government response will follow separately and explain how government and its partners plan to act on them. Responsibility for health policy sits with the Department of Health and Social Care in England and the devolved health departments in Scotland, Wales and Northern Ireland.

The Medicines and Healthcare products Regulatory Agency (MHRA) set up the independent commission in September 2025. Its work supports a government ambition, laid out in the 10 Year Health Plan for England and the Life Sciences Sector Plan, to make the NHS one of the most AI-enabled healthcare systems in the world.

The commission based its recommendations on a research and engagement program that it documented in two earlier reports published in June. A call for evidence drew 761 responses. Among them, 77 percent of patients and members of the public rated the current framework as too loose to some degree, while 65 percent of industry respondents rated it as too restrictive. Healthcare professionals and providers were more evenly split.

The Health Foundation, the commission’s research partner, also surveyed the public and found that people put safety, evidence and human oversight ahead of speed or convenience.

“The UK is in a particularly interesting position because it combines a national health system, strong research and AI expertise, and established regulatory institutions,” says Dr. Raquel Iniesta, a reader in machine learning and AI ethics in healthcare at King’s College London. “There is an opportunity to demonstrate that innovation and strong ethical and safety standards do not need to be competing objectives. The real test, however, will be how these principles translate into everyday clinical practice.”

The commission’s central conclusion is that current rules suit products that stay largely the same after approval, while AI tools can update often and perform differently from one setting to another. The report calls for oversight across a product’s whole lifecycle and recommends that the MHRA review and update the Medical Devices Regulations 2002.

The report also recommends regulating by function. When a product combines medical and non-medical features, the MHRA should focus on the medical ones. An ambient voice product, for example, might pair unregulated transcription with regulated decision support.

The MHRA already runs the AI Airlock, a regulatory sandbox launched in 2024 that tests regulatory questions using real products. The commission wants the agency to keep using sandboxes and extend their remit.

On post-market surveillance, the report says the MHRA should assess a manufacturer’s monitoring plan at the time of authorization, require real-world studies where needed and expect regular performance reporting. Manufacturers should also have a process for escalating performance degradation even when no reportable incident has occurred. The commission proposes a searchable public database of adverse incidents as well. For promising devices, the report recommends staged authorization. Under that approach, the MHRA would allow a device into use within a narrow, closely supervised scope based on early evidence, then widen the authorization once the device meets preset thresholds for safety and performance. The commission says staged pathways should be temporary and clearly communicated to patients.

Iniesta welcomes the focus on transparency and sees the case for staged authorization. But she warns that “the scope, safeguards, accountability and monitoring would need to be extremely clear. Accelerating access should never mean transferring poorly understood risks to patients or frontline professionals.”

The report says safe use of AI depends on more than regulation. Manufacturers, providers, clinicians, regulators and policymakers each need clearly defined responsibilities, including on liability. Healthcare professionals need training on AI and clearer routes for reporting concerns.

To build public trust, the commission wants more transparency about when and how AI is used in care. For developers, it calls for educational resources and earlier, more predictable engagement with regulators.

Iniesta, who works closely with health professionals, says the biggest lesson from the report is that a “technically good AI system is not automatically a good healthcare system.”

“The main concern is about bias, human replacement, responsibility, liability. These are the questions people actually face when AI enters healthcare practice,” she adds.

Siddhant Pusdekar is a scientist-turned science journalist and communicator with a Masters in Neuroscience and a Ph.D. in ecology evolution and behavior. He writes about health, neuroscience and the environment. He can be reached at [email protected].