MHRA Guidance on Software and AI as a Medical Device

The Medicines and Healthcare products Regulatory Authority (MHRA), the UK’s regulatory authority for medical devices, has published guidance on software and artificial intelligence as a medical device and that guidance is evolving rapidly. What began as a framework document has become an active and expanding programme of reform, with significant new developments in 2025 and further regulatory changes expected throughout 2026.

The document highlights the key regulatory requirements applicable to software developers and medical device manufacturers, and provides clarifications and recommendations to support compliance. The MHRA reserves the right to update this guidance as the underlying legislation changes and given the pace of regulatory development in 2025 and 2026, manufacturers should treat this as a living framework requiring regular monitoring rather than a one-time reference.

The agency continues to acknowledge that software, including artificial intelligence, plays a central and growing role in health and social care across the UK and that the regulatory framework governing it must keep pace with that growth.

Innovative Devices: The Role of the Software Group

The MHRA’s Software Group remains responsible for ensuring the safety and regulatory compliance of Software as a Medical Device (SaMD) and AI as a Medical Device (AIaMD). Its core activities continue to include assisting manufacturers with pre-market and post-market regulatory inquiries, conducting technical file reviews, assessing clinical investigations and exceptional use authorizations, and engaging with stakeholders across the healthcare, industry, and patient communities.

A significant addition to the Software Group’s work in 2025 was the completion of the AI Airlock pilot, the world’s first regulatory sandbox for AI as a medical device. This programme, which completed its pilot phase in March 2025, allowed manufacturers of AI-enabled devices to engage directly with regulators in a controlled environment, surfacing practical challenges and shaping future policy. The findings from the AI Airlock pilot are now informing the development of the MHRA’s forthcoming AI-specific regulatory framework, which is expected to be published in 2026.

Classification of Software as a Medical Device or an IVD

Manufacturers and researchers are still required to determine whether their software qualifies as a general medical device or an in vitro diagnostic (IVD) under applicable UK regulatory requirements but the framework governing that determination is changing.

The Software Group continues to refine classification frameworks under the Software and AI as a Medical Device Change Programme Roadmap. In a significant development, the MHRA published final guidance on Digital Mental Health Technologies (DMHTs) in February 2025, a long-awaited output of the Wellcome Trust-funded project that has established the UK as a recognized global leader in regulating this category of device. Additional Wellcome Trust funding has now been secured to continue this work through 2028.

Manufacturers should note that Northern Ireland continues to follow EU regulatory requirements rather than Great Britain’s framework under the Windsor Framework. For manufacturers distributing across both Great Britain and Northern Ireland, this creates a dual compliance obligation that requires careful tracking as both the UK and EU frameworks continue to evolve in parallel.

UK Regulatory Framework for Software as a Medical Device

The MHRA’s Software and AI as a Medical Device Change Programme has moved from planning to implementation. Several significant milestones were reached in 2025 that directly affect manufacturers:

Post-Market Surveillance Regulations (now in force). New post-market surveillance requirements came into force in June 2025, following the PMS statutory instrument being signed into law in December 2024. These regulations introduce stricter PMS obligations for manufacturers, including requirements for comprehensive PMS plans and, for certain risk classes, Periodic Safety Update Reports (PSURs). Manufacturers who had not previously been subject to formal PMS documentation requirements in Great Britain should treat this as an urgent compliance priority.

Pre-Market Statutory Instrument (expected in force 2026). A new pre-market statutory instrument covering new IVD classification rules, revised conformity assessment procedures, and international reliance pathways is expected to come into force in 2026. The necessary legislation is progressing through Parliament.

International Reliance Framework (coming in 2026). One of the most commercially significant developments is the MHRA’s introduction of international reliance pathways, announced in July 2025. Manufacturers who hold a valid authorisation from the US FDA, Health Canada, or Australia’s TGA will be able to use that approval as the basis for a streamlined application in Great Britain — including for SaMD and AI-enabled devices. This pathway is expected to open in the first half of 2026, potentially reducing time to market by six to twelve months for eligible products.

AI-Specific Regulatory Framework (expected 2026). The MHRA has confirmed it will publish a dedicated regulatory framework for AI as a medical device in 2026, as set out in the UK government’s Life Sciences Sector Plan. This will introduce more structured requirements for AI lifecycle governance, transparency, and cybersecurity for AI-enabled medical devices.

The four core areas of the change programme, qualification and classification, pre-market requirements, post-market surveillance, and AI-specific challenges, remain the structural pillars of these reforms, each now at a more advanced stage than when the programme was first announced.

Software and AI as a Medical Device Change Programme Roadmap

On October 17, 2022, MHRA published the Software and AI as a Medical Device Change Programme Roadmap, which provides detailed objectives and deliverables. As new regulatory documents emerge, this roadmap will be updated accordingly.

Qualification and Classification Guidance

The MHRA’s guidance on crafting intended use statements remains in place and continues to be the starting point for manufacturers determining whether their software qualifies as a medical device and what classification applies. These statements are foundational and they determine the regulatory pathway, the level of scrutiny required, and the post-market obligations that follow.

In 2025, the MHRA published additional GMLP mapping guidance, helping manufacturers of AI-enabled devices align their development practices with the Good Machine Learning Practice principles established jointly with the FDA and Health Canada. This guidance is particularly relevant for manufacturers whose intended use statements cover adaptive or continuously learning AI algorithms, where classification and change management intersect in ways that standard SaMD frameworks do not fully address.

Post-Market Surveillance and Vigilance Reporting

Post-market surveillance obligations for SaMD manufacturers in Great Britain changed significantly in 2025. The new PMS regulations, which came into force in June 2025, introduced formal documentation requirements that did not previously exist in Great Britain, including written PMS plans, structured adverse event reporting timelines, and for higher-risk device classes, Periodic Safety Update Reports.

Specific reporting timelines under the new regulations are as follows:

• Serious public health threats: report within 2 calendar days
• Death or unanticipated serious deterioration in a patient’s health: report within 10 calendar days
• All other reportable incidents: within the applicable standard timelines

The Yellow Card Scheme and Yellow Card App remain the reporting mechanisms for England and Wales. Scotland uses NHS National Services Scotland’s online system alongside local incident recording platforms. Northern Ireland reports to the Northern Ireland Adverse Incident Centre and local reporting systems, and for manufacturers operating in Northern Ireland, EU MDR post-market surveillance obligations also apply.

Manufacturers who were not previously subject to formal PMS documentation requirements in Great Britain should treat compliance with the June 2025 regulations as an immediate priority. The MHRA published guidance to support implementation in January 2025, which should be reviewed alongside the new statutory requirements.

Artificial Intelligence in Medical Devices

U.S. Food and Drug Administration (FDA) and Health Canada,

The MHRA’s work on AI in medical devices has moved well beyond the research phase described in the original guidance. The Brunel University research from 2021–2022 provided early-stage insights into approaches for regulating adaptive AI — but since then, the MHRA’s AI programme has expanded significantly.

In March 2025, the AI Airlock — the world’s first regulatory sandbox for AI as a medical device — completed its pilot phase and published its findings. The AI Airlock provided a structured environment for manufacturers to work through real regulatory challenges with AI-enabled devices alongside MHRA experts, generating practical insights that are now being incorporated into formal policy.

In December 2025, the MHRA launched a formal Call for Evidence to inform the recommendations of the National Commission into the Regulation of AI in Healthcare. The Commission, chaired by Professor Alastair Denniston, brings together experts from technology, healthcare, law, patient groups, and the NHS. Its recommendations, expected to be published in 2026, will directly shape the MHRA’s new AI medical device regulatory framework.

The three core regulatory principles co-developed with the FDA and Health Canada remain in place: Good Machine Learning Practices (GMLP), Predetermined Change Control Plans (PCCPs), and Transparency Guidelines. In 2025, updated IMDRF guidance on GMLP (document N88) further developed these principles, and the MHRA has published mapping guidance to help manufacturers apply them in practice.

Digital Mental Health Technology (DMHT) Regulation

The MHRA’s Digital Mental Health Technology programme has progressed from a time-limited project to an established and internationally recognised area of regulatory leadership. Final guidance for DMHT manufacturers was published in February 2025, a landmark output of the original Wellcome Trust-funded project. This guidance provides manufacturers with clear direction on when and how to apply medical device regulations to digital mental health tools, an area where manufacturers had previously faced significant uncertainty.

In December 2025, the MHRA announced that additional Wellcome Trust funding has been secured to continue this work through 2028. The programme’s ongoing scope includes further refinement of evaluation frameworks, engagement with healthcare professionals and patient groups, and continued collaboration with NICE.

The UK’s approach to DMHT regulation is now recognized globally as a model framework, something manufacturers developing digital mental health tools for international markets should be aware of as other regulators begin to develop their own approaches.

International and National Collaborations

The MHRA’s collaboration network for software and AI regulation has expanded alongside its domestic programme. The core partnerships remain in place, with IMDRF, the AI and Digital Regulations Service for Health and Social Care, NICE, the University of Birmingham’s STANDING Together Initiative, NHS England, and the Connected Medical Devices Security Steering Group.

Two additions are particularly significant for 2026. First, the international reliance framework, formalizing the MHRA’s alignment with the FDA, Health Canada, and the TGA, moves these partnerships from principle to practice, with direct implications for manufacturers seeking market access in Great Britain. Second, the National Commission into the Regulation of AI in Healthcare is drawing on expertise from across the UK and internationally, with its recommendations expected to shape both domestic and potentially global approaches to AI medical device oversight.

Conclusion

The MHRA’s regulatory programme for software and AI as a medical device is one of the most actively developing regulatory frameworks in the world. In 2025 alone, the UK introduced new post-market surveillance regulations, published final DMHT guidance, completed the world’s first AI regulatory sandbox, launched an international reliance pathway, and initiated a National Commission to shape the future of AI medical device oversight.

For manufacturers of SaMD and AI-enabled medical devices, this pace of change creates both opportunity and risk. The international reliance pathway represents a genuine opportunity to accelerate UK market access. The new PMS requirements represent an immediate compliance obligation. And the forthcoming AI-specific regulatory framework, expected in 2026, will set the terms for how AI-enabled devices are governed in Great Britain for years to come.

Staying ahead of this programme requires more than an annual review of MHRA publications. It requires continuous monitoring of regulatory developments, rapid impact assessment against your specific device portfolio, and the ability to act on changes before deadlines arrive.

Source

https://www.gov.uk/government/publications/software-and-artificial-intelligence-ai-as-a-medical-device/software-and-artificial-intelligence-ai-as-a-medical-device

How Can RegDesk Help?

RegDesk is an AI-powered Regulatory Information Management System (RIMS) designed to simplify global compliance for medical device companies. With regulatory intelligence covering 120+ markets, RegDesk helps you prepare and publish global submissions, manage standards, conduct impact assessments, and stay ahead of regulatory changes all from a single, centralized platform.

As the MHRA’s regulatory programme for SaMD and AI continues to evolve, with new PMS obligations now in force, an international reliance framework launching in 2026, and a dedicated AI regulatory framework on the way, RegDesk ensures your team has real-time visibility into what is changing, what it means for your products, and what action is required. Expanding into new markets, including Great Britain, has never been more manageable.