How will UK AI regulation in healthcare affect clinical research? The National Commission into the Regulation of AI in Healthcare published 44 recommendations on 10 September 2026, and the government accepted all of them on 6 October 2026. The effect on research is indirect and dated: draft guidance in December 2026, an implementation roadmap by Spring 2027.
How Will UK AI Regulation in Healthcare Affect Clinical Research?
The Commission is an expert, non-statutory advisory body established by the Medicines and Healthcare products Regulatory Agency (MHRA). It launched on 26 September 2025 under Professor Alastair Denniston as chair, with Professor Henrietta Hughes OBE as deputy chair. Its final report, Recommendations for a future regulatory framework, carries 44 recommendations. The government response of 6 October 2026 accepts all 44 and organises delivery under ten priorities.
The recommendations address AI-enabled medical devices and AI used in care, so most of the 44 pass a research site by. Four land directly on how a UK site runs and evidences AI in clinical trials, and one of those four was written about research governance.
| Change | Recommendation | What it asks for | What it means at a research site |
| Lifecycle oversight replaces a single pre-market gate | 5 and 17 | Less reliance on point-in-time pre-market assessments, and an enhanced MHRA post-market oversight toolkit | Evidence becomes a dated chain across the model’s life rather than one certificate held at go-live |
| Model updates run to a declared plan | 6 | Draft MHRA guidance on predetermined change control plans, out for public comment by December 2026 | A vendor declares its change boundary in advance, and the site reads that boundary into its own change control |
| Responsibility is mapped across the lifecycle | 24 and 25 | A cross-system working group on how responsibility is distributed, and work on patient redress | The chain is clarified rather than moved, so the investigator keeps the delegated activity |
| Patients are told when AI is used | 35 and 37 | A system-level approach to transparency, and a published list of authorised AI-enabled devices | Participant-facing wording and information governance records come under review |
The rules a UK site works to today are unchanged. The dates that change them sit ahead.
What Is the National Commission into the Regulation of AI in Healthcare?
The MHRA set the Commission up to advise government on a future regulatory framework for AI in healthcare. It held nine public meetings between 15 October 2025 and 17 July 2026 and ran a call for evidence. The Commission’s page on GOV.UK carries the minutes of every meeting.
The government response groups the 44 recommendations into three sections. Recommendations 1 to 23 cover proportionate regulation, 24 to 34 cover system-wide responsibility, and 35 to 44 cover trust, transparency and predictability. Delivery runs under ten priorities, and a cross-system Programme Board convenes quarterly to oversee progress.
| Priority | Stated aim | Bearing on clinical research |
| 1 | Modernise the regulatory framework for AI-enabled medical devices | Sets the classification a research tool would be read against |
| 2 | Deliver equitable access and outcomes, with a focus on underserved populations | Touches recruitment and representativeness questions |
| 3 | Shift towards stronger post-market assurance | The largest change for a site, because assurance becomes continuous |
| 4 | Enable safe iteration and earlier patient access | Staged routes generate evidence under supervision |
| 5 | Create the assurance conditions for safe real-world deployment, including risk controls | Maps onto the risk-based validation a site already documents |
| 6 | Build system capability and readiness, including workforce training | Training and competence records for staff who use an AI feature |
| 7 | Strengthen accountability, including a culture of safety and reporting | Reporting routes for an AI-assisted error |
| 8 | Strengthen transparency and public confidence | What participants are told when AI touches their care |
| 9 | Improve regulatory clarity and navigability | Recommendation 44 sits here, addressed to research governance |
| 10 | Strengthen regulatory capability and the evidence base for AI in healthcare | Shapes what evidence a regulator expects, and from whom |
Also Read: The EMA and FDA Good AI Practice Principles: What They Mean for Clinical Trials
What Does the Move to Lifecycle Oversight Mean for Research?
Recommendation 5 would explore a more lifecycle-based framework with, in the response’s words, “less reliance on point-in-time pre-market assessments”. Recommendation 17 asks the MHRA to build an enhanced toolkit of post-market oversight mechanisms, with legislative reform and guidance where needed. Priority 3 commits the system to stronger post-market assurance, including better monitoring of real-world device performance.
That direction matters to a research office because of what it does to evidence. A point-in-time assessment produces one artefact, filed once. Lifecycle oversight produces dated artefacts that stay current for as long as the system is in use.
- Staged authorisation and sandboxes let a tool reach patients earlier under close supervision, which means more real-world evidence is gathered during use rather than before it. Phase 3 of the MHRA AI Airlock programme runs on this logic.
- Post-market performance monitoring watches a model in the setting it runs in, which means a site may be asked for observations it does not collect today.
- Improved Yellow Card reporting gives AI-related incidents a named route, which allows a quality lead to escalate an AI-assisted error like any other safety signal.
- Aligned MHRA and NICE evidence expectations cut the number of separate packages, which allows an adopting organisation to read one set rather than two.
Our guide to AI for compliance and inspection readiness covers how to score what a vendor actually offers on these grounds.
What Is a Predetermined Change Control Plan?
A predetermined change control plan (PCCP) is a document in which a manufacturer sets the boundary of changes it may make to a model after authorisation, instead of listing only specific prespecified modifications. Recommendation 6 commits the MHRA to issue draft guidance on PCCPs for public comment, and the government response states the intention to publish that draft by December 2026.
The practical question for a site is narrow. A model that changes inside a declared boundary still changes the output a research nurse or a quality lead is reading.
- Ask a vendor whether it holds a PCCP, and what the declared boundary covers.
- Record the model version in use at the point any AI-assisted record is created.
- Decide which changes inside that boundary still trigger a local review.
- Keep the site’s own change control record aligned with the vendor’s release notes.
How a site runs that change control, and what intended-use validation looks like for a probabilistic feature, is covered in Validating an AI Feature in a Regulated Clinical Trial System.
Who Is Liable When an AI Tool Goes Wrong in a Study?
Recommendation 24 asks the Department of Health and Social Care (DHSC) and healthcare organisations across England and the devolved authorities to work together so that responsibility at each stage of the AI product lifecycle is clear and appropriate to their roles. The response creates a working group for that purpose, drawing in the DHSC, the MHRA, the Care Quality Commission, NHS Resolution, the Professional Standards Authority and the professional regulators.
One sentence settles the scope of that group. It states that “the group will not determine or redistribute responsibilities”. NHS England and NHS Resolution continue separate work on indemnity guidance, and Recommendation 25 convenes a further group on patient redress.
Clarification is the aim. The investigator keeps the delegated activity either way.
The chain as it stands today, link by link, and what the delegation log records when a named person confirms an AI proposal, is set out in Who Is Accountable When AI Gets It Wrong at a Trial Site?
What Will Participants Be Told When AI Is Used?
Recommendation 35 asks for a proportionate, system-level approach to transparency about AI-enabled products in patient care, including patients’ “reasonable expectation of being informed” that such technologies were used. The response adds that the DHSC will consider how information governance requirements could clarify transparency, what choices patients have, and when opt-out arrangements might be appropriate.
- Recommendation 37 includes publishing a regularly updated list of authorised AI-enabled devices in the UK, which allows a research office to check a tool’s regulatory status against a public register.
- Recommendation 39 asks the MHRA to develop guidance on user-centred design that supports transparency for device users, including patients, professionals and the public.
- Recommendation 38 proposes a periodic AI sentiment census covering patients and professionals, which gives sponsors a published read on attitudes.
Transparency duties that already bind a UK site, and the minimisation and retention rules that sit beside them, are covered in our guide to UK GDPR for clinical trial sites.
What Does Recommendation 44 Ask of the Health Research Authority?
Recommendation 44 is the one written about research. It asks the Health Research Authority (HRA), and equivalent organisations in the devolved authorities, to build on existing guidance and decision-support tools to help organisations determine when development, deployment, evaluation and monitoring activities constitute research and require research governance, and where they may sit outside research and need oversight through other mechanisms. The recommendation states that this work should align with MHRA and wider system guidance as the framework develops.
The question behind it is a real one. A hospital evaluating an AI tool on its own patients has to decide whether that evaluation is research, a service evaluation, or post-market surveillance. The answer sets which approvals apply and which file the records live in.
The HRA welcomed the report on 10 September 2026. It states that it worked closely with the Commission and had asked for “greater clarity about when AI-related activities constitute research”. Matt Westmore, Chief Executive of the HRA, is quoted saying that “it is essential that innovation is ethical and is supported by clear governance, transparency and public trust”.
The HRA will consider the recommendations alongside its own plan to enable safe, AI-powered innovation in health and social care research, which runs across 2026 to 2028 and carries three priorities.
- Be clear where AI development, evaluation and implementation activities are research. The deliverable is an update to the “Is my study research” decision tool and its supporting guidance, which gives a research office a single reference point for the question above.
- Clarify when health information can be accessed using AI and data-driven approaches, including consistent governance across Secure Data Environments and the Health Data Research Service.
- Make review of AI-enabled research informed, rigorous and consistent, through reviewer capability and better-prepared applications, which means a sponsor can expect a more predictable review.
The plan also commits the HRA to clarify expectations for AI used to support research activities, naming protocol writing, consent processes and lay summaries.
What Changes at a UK Research Site Today?
Nothing in the Commission’s report is law. The government has accepted the recommendations, and the instruments that would bind a site are still to be drafted and consulted on. The government’s explainer for healthcare providers, published on 6 October 2026, describes support rather than duties: training matched to staff roles, clearer expectations about safeguards, and better support for monitoring and reporting once a tool is in use.
The rules that do bind a UK site are the ones already in force. The amended Clinical Trials Regulations took full effect on 28 April 2026. Regulation 28(1A) makes compliance with the ICH E6(R3) Good Clinical Practice principles a legal requirement, and Principle 9.3 asks that computerised systems are fit for purpose, through risk-based validation where appropriate. Those are the provisions an MHRA inspector reads an AI-assisted record against today.
- Record which AI features are live, in which module, and who uses each.
- Hold the model version alongside every AI-assisted entry, so a dated chain exists before anyone asks for one.
- Name who approves a new AI use, and who reviews AI-raised signals.
- Put AI-related errors on an existing reporting route rather than a parallel one.
- Ask each vendor in writing whether it holds a PCCP, and what its change boundary covers.
Sites that already run a written procedure have little to add. The structure is in How Should a Research Site Govern the Use of AI?, and what AI may and may not do inside a regulated system is covered in AI in GxP clinical trial systems.
Which Dates Should a Research Office Hold?
Five dates carry real content. Everything else reports annually once the roadmap lands.
| Date | What happens | Who leads | What a research office can do |
| 6 October 2026 | Government response published accepting all 44 recommendations, and the Programme Board established | DHSC with the devolved administrations | Read the action plan sections covering Recommendations 24, 35 and 44 |
| By December 2026 | MHRA issues draft guidance on predetermined change control plans for public comment | MHRA | Respond to the consultation, and ask vendors how they will use a PCCP |
| By Spring 2027 | Consultation launches on how AI-enabled devices are qualified and classified | MHRA | Check whether any tool in use would meet the device definition |
| By Spring 2027 | Implementation plan and roadmap published, with annual updates after that | Programme Board, reporting to the Life Sciences Delivery Board | Set a review point in the site’s AI governance procedure |
| 2026 to 2028 | HRA delivers its AI plan, including the updated “Is my study research” tool | HRA | Use the tool when deciding whether a local evaluation is research |
Also Read: How Is AI Used in Clinical Trial Monitoring?
Preparing for Lifecycle Oversight Inside the AQ Platform
Lifecycle oversight asks for a dated chain rather than one certificate. AQ holds that chain in records a site already keeps. Connected Intelligence is the AI capability across the platform, and AQ Assist is the in-platform assistant. AQ’s AI proposes, flags and drafts, and a named person reviews and confirms. Every AI action is in the audit trail, with the proposal, the model version and the human confirmation held against the same record.
AQ QMS holds the procedure and training record behind each approved AI use. AQ CAPA gives an AI-assisted error the same route as any other quality event. AQ Digital DoA records who was delegated the activity a confirmation sits inside. AQ is validated to GxP standards with every release, covering IQ, OQ and PQ and a 21 CFR Part 11 and EU Annex 11 assessment, and the platform is built for MHRA GCP inspection.
See how the record holds together across modules. Book a live demo.
Frequently Asked Questions
How will UK AI regulation in healthcare affect clinical research?
The effect is indirect and dated. The National Commission’s 44 recommendations, accepted in full on 6 October 2026, reach a research site through four changes: lifecycle oversight in place of a single pre-market assessment, predetermined change control plans, a clarified map of responsibility, and transparency about AI use in care. Recommendation 44 asks the HRA to clarify when AI activity counts as research.
What is the National Commission into the Regulation of AI in Healthcare?
It is an expert, non-statutory advisory body established by the MHRA and launched on 26 September 2025, chaired by Professor Alastair Denniston with Professor Henrietta Hughes OBE as deputy chair. Its final report, Recommendations for a future regulatory framework, was published on 10 September 2026.
Did the government accept the Commission’s recommendations?
Yes. The response published on 6 October 2026 accepts all 44 recommendations and sets out how they will be delivered across the UK. Delivery runs under ten priorities, overseen by a cross-system Programme Board that convenes quarterly and reports to the Life Sciences Delivery Board.
What is a predetermined change control plan?
It is a document in which a manufacturer declares, in advance, the boundary of changes it may make to a model after authorisation, rather than listing only specific prespecified modifications. Recommendation 6 commits the MHRA to publish draft guidance on these plans for public comment by December 2026.
Does the Commission change what a UK research site has to do today?
No. The report is advisory and the response describes work to come. The provisions in force remain the amended Clinical Trials Regulations, in full effect from 28 April 2026, and the ICH E6(R3) Good Clinical Practice principles made a legal requirement by regulation 28(1A). An inspector reads an AI-assisted record against those today.
Which recommendation matters most to clinical research?
Recommendation 44. It asks the HRA and equivalent bodies in the devolved authorities to build on existing guidance and decision-support tools so organisations can determine when development, deployment, evaluation and monitoring activities constitute research, and where they sit outside research and need oversight by other means.
When will the new AI rules take effect in the UK?
No commencement date has been set. Draft MHRA guidance on predetermined change control plans is due by December 2026. A consultation on qualification and classification of AI-enabled devices launches by Spring 2027, and the implementation roadmap is published by Spring 2027, with annual progress updates after that.
