Introduction 

Artificial intelligence (AI) is increasingly being used to support clinical tasks, including medical imaging, diagnosis and administrative work. These applications can improve the speed and consistency of healthcare, but their safe use depends on evidence, clear responsibilities and continued monitoring after deployment. Healthcare AI also operates in a data-intensive environment, where personal and health information must be handled responsibly. 

On 6 October 2026, the UK Government accepted all 44 recommendations made by the National Commission into the Regulation of AI in Healthcare. Its response sets out initial delivery priorities for a regulatory approach that is proportionate, risk-based, lifecycle-based and system-wide. On the same day, the Medicines and Healthcare products Regulatory Agency (MHRA) opened applications for Phase 3 of its AI Airlock regulatory sandbox. The Government’s response makes clear that acceptance is the beginning of implementation, not the end of the regulatory process. 

For healthcare providers, developers and manufacturers, the practical question is how to demonstrate that an AI-enabled product remains safe and effective in real-world use, while ensuring that its data practices are appropriate to the clinical purpose. 

What the Government Has Accepted 

The National Commission’s recommendations seek to move healthcare AI oversight beyond a single assessment before a product reaches the market. The Government’s response identifies three broad themes: proportionate lifecycle regulation; system-wide responsibility and safe management; and trust, transparency and predictability. The aim is to support adoption of AI that is safe and effective while providing clearer expectations for the organisations that develop, procure and use it. 

The Government has identified ten priority areas for initial delivery. These include modernising the regulatory framework for AI-enabled medical devices, improving equitable access and outcomes, strengthening post-market assurance, enabling safe product updates, clarifying operational risk controls, improving workforce readiness, strengthening accountability and reporting, increasing transparency, making regulatory pathways easier to navigate, and strengthening regulatory capability and evidence. The detailed action plan assigns different actions and timelines to the MHRA and other system partners; acceptance of a recommendation should not be read as meaning that every measure is already in force.

Lifecycle-Based Oversight of Medical AI 

A central feature of the proposed approach is that evidence and oversight should continue throughout a product’s lifecycle. AI-enabled medical devices may change through software updates, new data or changes in the settings where they are used. A one-time assessment may not, by itself, establish how a product will perform after those changes or across different patient populations. 

The Government says the MHRA will explore a more lifecycle-based framework, with stronger post-market surveillance and clearer expectations for evidence about real-world safety and performance. It also plans to explore approaches for managing changes to AI-enabled devices, including Predetermined Change Control Plans (PCCPs), and to consider how reporting, traceability and information sharing can support continued assurance. These are implementation actions to be developed, rather than a statement that every proposed mechanism is already operational. 

For organisations deploying medical AI, this points to the importance of recording product versions, documenting the intended purpose and conditions of use, monitoring performance after deployment, and having processes to escalate safety concerns. The Government also intends to improve clarity about responsibilities across manufacturers, healthcare providers, professionals and regulators. 

What Is the MHRA’s AI Airlock Helping With? 

The AI Airlock is the MHRA’s regulatory sandbox for AI-enabled medical devices. A sandbox provides a structured setting in which regulatory questions and practical challenges can be explored with relevant stakeholders. Phase 3 is intended to build on earlier phases and test approaches to issues arising in the development, regulation and use of AI-enabled medical devices. The MHRA’s call for applications opened on 6 October 2026 and is described as remaining open year-round unless the application page is updated to say it has closed. 

The Phase 3 application page invites applications from candidates and gathers information about their AI-enabled medical devices or prototypes. The Government’s response identifies Phase 3 as part of its wider work on regulatory sandboxes and highlights post-market surveillance as a key focus area to be explored. The programme is therefore particularly relevant to testing how safety and performance can be monitored in practice, rather than treating market entry as the end of regulatory scrutiny. 

The Airlock does not replace the applicable regulatory requirements or amount to blanket approval for a product. Its value lies in helping the regulator and participants examine practical challenges and learn what guidance, evidence or regulatory approaches may be needed. 

Why This Matters Amid Global Privacy Developments 

The decision is particularly relevant as data protection frameworks continue to evolve alongside the use of AI. Healthcare AI may rely on health records, imaging, clinical observations and other information connected to an identifiable person. The regulatory question is therefore not limited to whether a device performs safely: organisations must also understand what personal data it uses, why that processing is necessary, who can access the information and how it is protected. 

In the UK, the Data (Use and Access) Act 2025 introduced changes to the country’s data protection and privacy framework while retaining the UK GDPR and Data Protection Act 2018. The Government’s published implementation plan describes a staged commencement process, including changes to data protection legislation that came into force in February 2026. This broader legal change makes it important for organisations to assess AI governance alongside their current data protection obligations, rather than treating the two as separate compliance exercises. 

The EU is also developing a more structured approach to health data. The European Health Data Space (EHDS) Regulation entered into force on 26 March 2025 and is scheduled to apply from 26 March 2027, with key rules introduced in phases. It addresses the use and exchange of electronic health data for healthcare and, subject to its safeguards and conditions, secondary uses such as research, innovation and policymaking. This illustrates the growing importance of secure processes, controlled access and appropriate protections when health data is used beyond the immediate care context. 

These developments do not mean that the UK’s AI healthcare recommendations are a privacy law, or that the frameworks impose identical obligations. Their relevance is practical: AI safety, clinical governance and data protection can overlap when a product is trained, evaluated, procured or used with health information. Privacy considerations should therefore be assessed at each relevant stage, including data collection, access, retention, sharing and monitoring. Organisations should identify the applicable legal basis and safeguards for each processing activity rather than assuming that a clinical or regulatory purpose automatically resolves every data protection issue. 

What Healthcare Organisations and Developers Should Review 

The Government’s response provides a basis for reviewing current governance and preparing for implementation. Organisations should consider the following practical steps: 

1.  Map the product lifecycle. Document the intended purpose, users, clinical setting, product versions and the evidence available before and after deployment. 

   
   

2. Clarify accountability. Identify responsibilities across the manufacturer, healthcare provider, clinical professionals and relevant oversight teams, including who reviews incidents and decides when action is needed. 

   
   

3. Plan post-market monitoring. Establish proportionate processes for tracking safety and performance, receiving user feedback, recording changes and escalating concerns. 

   
   

4.  Review data practices. Map the personal and health data used by the system, the purposes of processing, access permissions, retention arrangements and any sharing with suppliers or other organisations. 

   
   

5. Assess privacy and security risks. Review whether processing is necessary for the stated purpose and apply appropriate safeguards. Consider security, traceability and data protection requirements alongside device safety obligations. 

Conclusion 

The UK Government’s acceptance of all 44 recommendations signals a move towards proportionate, lifecycle-based and system-wide oversight of AI in healthcare. The next phase will depend on implementation: clearer regulatory pathways, continued assessment of real-world safety and performance, and better-defined responsibilities across the healthcare ecosystem. The MHRA’s AI Airlock offers a practical setting to explore some of the challenges involved in testing and overseeing AI-enabled medical devices. As privacy frameworks and health-data governance continue to develop in the UK and internationally, healthcare organisations should consider patient safety, accountability and data protection together. The objective is not simply to accelerate the use of AI, but to support adoption that is demonstrably safe, transparent and responsible throughout the product lifecycle. 

Want to stay ahead?  

Reach out to the experts at Tsaaro today.