United Kingdom proposes staged approvals and continuous audits for health AI

A radiologist at a busy NHS trust logging into an imaging workstation may soon see a digital marker indicating that their clinical AI assistant is operating under an "L-plate" provisional license. Under a regulatory framework proposed in a report by a clinical commission hosted by the Medicines and Healthcare products Regulatory Agency (MHRA), medical software would no longer receive static clearance. Instead, adaptive tools must undergo a staged authorization process, entering clinical environments under tight supervision and continuous performance audits before earning full market access. This marks a significant departure from how digital health tools are evaluated, deployed, and commercialized in the UK.

The commission's report outlines 44 recommendations designed to restructure the regulatory pathway for healthcare software. Rather than treating AI as a traditional medical device that receives a one-time approval, the proposed framework establishes a phased system. Under this model, developers do not obtain an immediate, system-wide clearance to distribute their tools across the NHS. Instead, they receive a provisional license that permits deployment only within controlled clinical settings. This allows the NHS to evaluate how the software performs when integrated into daily clinical workflows, ensuring that patient safety is monitored in real-world environments.

The inquiry, led by NHS clinicians Professor Alastair Denniston and Professor Henrietta Hughes, focused on the operational realities of healthcare delivery. By structuring the evaluation around real-world performance, the framework addresses a major gap in current procurement and safety standards, where software that performs well in retrospective validation studies struggles to replicate those results in active clinical settings.

The challenge of adaptive models

The regulatory update is driven by the realization that legacy medical device frameworks, designed for static hardware like pacemakers and joint replacements, cannot accommodate adaptive software. Static devices do not alter their behavior after leaving the assembly line. By contrast, machine learning models are designed to learn from new data, meaning their clinical performance can shift over time.

The commission warns that traditional static approvals fail to account for this capacity to evolve. A software tool that achieves high accuracy during a clinical trial may exhibit decreased performance when deployed in a different hospital. This clinical drift can occur due to variations in patient demographics, differences in scanning equipment, or subtle changes in how local clinical teams input data.

To mitigate these risks, the proposed framework introduces continuous lifecycle surveillance. Rather than relying on point-in-time clearances, developers will be required to establish ongoing monitoring pipelines that continuously track model outputs against clinical outcomes. If an algorithm's performance falls below established safety margins, its provisional license can be suspended or modified. The framework also calls for clear guidelines on patient consent, ensuring that patients are informed when adaptive AI tools contribute directly to their diagnostic or treatment pathways.

Shifting developer economics

For healthcare technology vendors, these recommendations fundamentally rewrite the economics of product development and distribution. Historically, regulatory compliance was treated as a significant but finite capital expenditure. A startup or enterprise developer would invest in clinical trials, secure regulatory clearance, and then transition to a commercialization phase characterized by predictable software maintenance costs and high gross margins.

Under the proposed UK model, compliance transitions from a capital expense to a perpetual operating cost. Because software must undergo continuous lifecycle surveillance, developers must maintain active engineering and clinical monitoring pipelines. This requires permanent infrastructure to ingest real-world performance data, flag anomalies, and report drift back to regulators.

This shift alters the competitive landscape. Large, well-capitalized technology companies with robust data engineering infrastructure are better positioned to absorb these ongoing compliance costs. Early-stage startups, conversely, may find the financial burden of continuous auditing restrictive, potentially slowing the pace of early innovation or forcing earlier consolidation. Vendors will need to restructure their pricing models, moving away from simple software-as-a-service fees toward pricing structures that account for the ongoing cost of active clinical validation.

The MHRA must now determine how to implement these recommendations without exacerbating the administrative burden on NHS staff. For the staged authorization model to succeed, the clinical supervision required for L-plate installations must be clearly defined. If supervision requires excessive manual review by senior clinicians, the system could introduce bottlenecks into an already constrained healthcare workforce.

Furthermore, integrating explicit patient consent into digital clinical workflows presents an operational challenge. Healthcare providers must find ways to secure and document consent without adding friction to patient check-ins or delaying urgent clinical decisions.

As regulatory agencies worldwide struggle to govern generative AI and adaptive algorithms, the UK's proposed framework offers a potential model for post-market surveillance. By focusing on continuous performance tracking rather than static gatekeeping, the MHRA could establish a regulatory pathway that balances clinical safety with technological adoption.