Guide
AI medical device compliance
MHRA requirements for AI as a Medical Device (AIaMD) and Software as a Medical Device (SaMD). Covers classification, registration, technical documentation, quality management, post-market surveillance, and data protection for health AI.
Artificial intelligence used for clinical purposes in the UK is regulated as a medical device by the Medicines and Healthcare products Regulatory Agency (MHRA). If your AI software diagnoses conditions, recommends treatments, monitors patients, triages clinical data, or assists clinical decision-making, it is likely classified as a medical device and must be registered with the MHRA before it can be placed on the UK market.
The regulatory framework distinguishes between AI as a Medical Device (AIaMD), where the AI itself is the device, and Software as a Medical Device (SaMD), where software performs a medical function independently of hardware. Both categories require MHRA registration, but the classification rules and conformity assessment routes differ depending on the risk level.
When AI qualifies as a medical device
Software qualifies as a medical device under UK law if it is intended by the manufacturer to be used for one or more medical purposes, and it does not achieve its principal intended action by pharmacological, immunological, or metabolic means. Medical purposes include:
- Diagnosis: AI that analyses medical images (radiology, pathology, dermatology), interprets test results, or identifies conditions
- Treatment recommendation: AI that suggests drug dosages, treatment pathways, or surgical approaches
- Monitoring: AI that tracks patient vital signs, detects deterioration, or predicts clinical events
- Triage: AI that prioritises patients based on clinical urgency
- Risk prediction: AI that calculates a patient's risk of developing a condition or experiencing an adverse event
Software that performs purely administrative functions (appointment scheduling, billing, record-keeping) is generally not a medical device, even if it operates in a healthcare setting.
What is NOT a medical device
The following AI applications in healthcare typically fall outside MHRA regulation:
- Administrative scheduling and resource allocation tools
- Clinical documentation and dictation software
- General-purpose search engines used by clinicians
- Population health analytics that do not drive individual clinical decisions
- Electronic health record systems (unless they include clinical decision support features)
If you are unsure whether your product qualifies, the MHRA's Innovation Office provides pre-submission meetings to discuss classification.
MHRA registration and requirements
AI medical devices must comply with the UK Medical Devices Regulations 2002 (as amended). The MHRA is implementing a new regulatory framework following Brexit, with transitional arrangements in place through the Medicines and Medical Devices Act 2021.
Data protection for health AI
Health data is special category data under UK GDPR Article 9. AI medical devices that process patient data must meet heightened data protection requirements, including identifying both a lawful basis under Article 6 and a special category condition under Article 9. For most clinical AI applications, the relevant conditions are health or social care purposes (Article 9(2)(h)) or substantial public interest (Article 9(2)(g)).
The intersection of MHRA and ICO requirements creates a dual compliance obligation. Your medical device must satisfy MHRA's safety and performance standards whilst simultaneously meeting UK GDPR's data protection principles. A DPIA is almost certainly required.
Continuous learning and adaptive AI
Many AI medical devices are designed to improve over time by learning from new data. This creates a specific regulatory challenge: if the algorithm changes after registration, does the modified version remain compliant?
The MHRA's position is that significant changes to a device's algorithm may constitute a new device requiring fresh conformity assessment. Manufacturers must have a predetermined change control plan that defines:
- Which types of algorithm updates are within the scope of the original registration
- What constitutes a significant change requiring a new submission
- How performance will be monitored after each update
- Rollback procedures if an update degrades performance
The Software as a Medical Device Pre-Submissions Programme allows manufacturers to discuss their change control plans with the MHRA before market placement.
Steps to achieve compliance
The following steps cover the end-to-end process for bringing an AI medical device to the UK market.