20-21 AI in Regulation

The UK, the EU and the US have each spent 2026 moving more of their oversight of medical AI out of the approval process and into real-world use.

For pharma companies moving into AI, that brings conditional authorisation and post-market monitoring duties that could benefit patients and developers alike, but only if the monitoring is properly enforced and funded.

An AI model that performed well in testing at one hospital will not necessarily perform as well at another. Different data environments and a different patient mix can degrade a model’s performance because the data and metadata it now sees may not match the data it learned from. That decline can go unnoticed for months.

Medical device regulation was designed around a single point of assessment, after which a product was expected to behave the same way for years.

That assumption was generous for software even before machine learning arrived, and it does not hold for AI at all. Regulators on both sides of the Atlantic have spent this year acknowledging as much, and their answers matter to pharma as much as to device makers.

Drug developers are moving into AI through companion diagnostics and clinical decision tools, whether they build them in-house or bring them in through acquisitions and partnerships.

The model the regulators are moving towards, with conditional authorisation followed by real-world monitoring, will look familiar to medicines, but for AI the obligations land in different places and on different people.

A life cycle view from the UK

In September, the National Commission into the Regulation of AI in Healthcare, set up by the MHRA, published a 119-page report containing 44 recommendations. Its central finding is that the UK framework was designed for static products assessed once, whereas AI products are updated frequently and can perform differently from one data setting to the next.

The commission wants oversight to run across the whole life of a product, from development through deployment and into real-world monitoring.

Among its more eye-catching proposals is staged authorisation, which the MHRA has compared to L-plates for learner drivers. A new model would be cleared for use within a controlled scope and allowed to expand as real-world evidence accumulates.

It would also replace pre-agreed lists of future software updates with defined boundaries within which a model can be adapted.

Around 77% of public respondents to the commission felt the current framework was somewhat or too loose, while 65% of industry respondents described it as somewhat or too restrictive, and 77% of healthcare professionals called for significant reform or a complete overhaul.

Both sides are pointing at the same imbalance with heavy scrutiny before launch and very little afterwards. A manufacturer can face a lengthy round of documentation for a significant software update, while the hospital using the same product may have no routine way of checking whether it still performs as it did at approval.

Europe buys time

The EU AI Act would have applied its high-risk obligations to AI-enabled medical devices from August 2027. Under the Digital Omnibus agreed this year, that date has moved to 2 August 2028, largely because the EU-wide technical standards that manufacturers would use to show they comply with the Act have not yet been written.

The amended law also lets the European Commission limit specific AI Act requirements where the Medical Devices Regulation (MDR) or In Vitro Diagnostic Regulation already impose equivalent obligations, answering years of complaints about overlapping conformity regimes.

The underlying requirements are unchanged, though, and manufacturers will be building Quality Systems against standards that are still being drafted, with a real risk of rework once the final versions are published.

For patients, the delay means AI-enabled devices will keep reaching the EU market under the MDR alone, without the AI Act’s specific requirements on training data quality, bias and human oversight, so the gap the UK commission identified stays open in Europe until 2028.

The American approach to change

The FDA’s list of AI-enabled devices authorised for the US market had passed 1,450 by early 2026.

To cope with software that keeps changing after clearance, the agency finalised guidance at the end of 2024 on Predetermined Change Control Plans (PCCPs), which let a manufacturer agree in advance the modifications it intends to make and how it will validate them.

Draft guidance published a month later, and not yet finalised, looks further into the life of a device, asking manufacturers to consider transparency and bias from development through to decommissioning, including evidence that a device benefits all the groups it is meant to serve, and inviting comment on post-market performance monitoring plans.

The agency has been less willing to let those plans replace scrutiny before launch. When a radiology AI developer asked the FDA to exempt several types of imaging AI from 510(k) clearance, provided the manufacturer already held a clearance and ran a robust post-market plan, it refused in April and confirmed the decision in a Federal Register order in September.

Its clinical decision support guidance, finalised in January 2026, draws the boundary from the other side, setting out which software falls outside device regulation altogether.

Who carries the risk?

Most AI medical devices depend on a clinician to check their outputs, which moves much of the risk out of the product and onto the people using it.

When an AI tool flags a possible abnormality on a scan, the radiologist checking could be swayed by that flag, particularly under time pressure, a problem known as automation bias. Intended-purpose statements are often clear that outputs should not be relied upon without clinician judgment.

The National Commission found that under the existing negligence framework, claims are disproportionately likely to land on healthcare professionals and providers, creating what it calls ‘liability sinks’ in which frontline staff carry responsibility for AI failures they had little power to prevent. It wants contracts between manufacturers and providers to allocate every risk control explicitly, while accepting that wider legal reform will take longer.

A growing share of healthcare AI products is built on a small number of general-purpose foundation models, most of them owned outside the UK.

An update pushed by a model developer on another continent could alter the behaviour of a triage tool in a UK hospital without anyone in the regulatory chain being told, which is why the commission wants manufacturers to declare these dependencies and developers to be able to share technical detail confidentially with the MHRA.

Some of the most widely used AI sits outside the device framework altogether. Around a fifth of UK GPs surveyed for BMJ Health & Care Informatics said they had used generative AI tools such as ChatGPT in their work, in some cases to suggest diagnoses, and life cycle regulation can only monitor products that enter it.

Who pays for the monitoring?

Staged authorisation spares developers from anticipating every conceivable risk before a single patient has used a product, and gives patients a system that keeps checking performance after launch.

Life cycle regulation only works, however, if somebody pays for the life cycle. Continuous monitoring needs data pipelines and clinical safety officers with time to review incidents, and while manufacturers will carry part of that cost, a significant share falls on the organisations deploying the technology.

The government has said it accepts the commission’s recommendations, and its cross-government response, which has yet to be published, should make clear whether hospitals will be given the funding and staff to monitor AI tools once they are in use.

If that funding does not materialise, hospitals will have nobody to collect the evidence the UK and EU approach relies on, and clinicians will go on carrying the risk when an AI tool gets something wrong.