How Can Medical AI Stay Safe After Deployment? UK Launches Regulatory Reform and Third Sandbox Phase

Safety concerns do not end with market approval when medical AI enters clinical practice. As software is updated, settings change, or healthcare professionals provide different levels of oversight, can the original assessments continue to reflect actual performance? On October 6, the UK government announced that it had accepted all 44 recommendations from the National Commission on the Regulation of AI in Healthcare, preparing to extend the regulatory focus further across the entire period of product use.

The Medicines and Healthcare products Regulatory Agency (MHRA) opened applications for the third phase of its AI Airlock regulatory sandbox on the same day, using actual products to explore post-market monitoring methods. The policy response and sandbox launch mark the beginning of work to put the commission’s blueprint into practice. Accepting the recommendations does not mean that all new arrangements are already in effect; some measures still require guidance development, consultation or legislative changes.

The third phase will address specific challenges that arise when AI medical devices enter different care settings. The application documents identify local IT infrastructure, clinical workflows, data quality and user interaction as monitoring factors, and also cover home use, direct-to-consumer settings and situations with less human oversight. In addition to identifying changes in safety or performance, the programme will test how to communicate information about updates, risks and rollbacks to previous versions promptly to regulators, healthcare organisations, professionals and patients.

Validation will extend beyond meeting discussions. Airlock can conduct virtual testing using real or synthetic data, or carry out “shadow deployment” using retrospective patient data in actual clinical settings: the system operates alongside clinical workflows, but its outputs are not used in decisions about patients’ care. This allows teams to examine AI performance under everyday working conditions. However, this announcement has not yet provided details of products selected for the third phase, specific datasets or clinical benefit results, so it cannot support any inference that a tool has been proven safe and effective.

Managing software that changes continuously is another central strand of the reform. MHRA expects to issue draft guidance on “predetermined change control plans” before December 2026, explaining how manufacturers can define the scope of permissible changes while maintaining the intended medical purpose. The government will also explore phased authorisation pathways and plans to develop a tool allowing the public to search medical device adverse event reports, making update management and risk information easier to track.

According to the third-phase application documents, programme funding runs through April 2029, with individual testing collaborations generally expected to last 6 to 12 months. Applications are open year-round and reviewed in batches. Those seeking consideration in the current review round must submit by October 31, with the next initial selection round scheduled for spring 2027. There are no application or participation fees, but participants must bear the costs of research, conducting tests and obtaining relevant data.

The UK Health Research Authority (HRA) also confirmed that the government had accepted all recommendations. Chief Executive Matt Westmore said it would work with MHRA and other partners to keep regulatory and research governance arrangements clear, proportionate and aligned. For patients, whether the reform delivers protection will depend on whether these arrangements can identify problems early in actual use, clearly allocate responsibility and enable effective action. A full implementation roadmap is expected to be published in spring 2027.