September 2026 brought several developments highlighting a shared challenge in AI-enabled healthcare: ensuring that products are appropriately assessed before use and monitored throughout their lifecycle. In the United States, FDA actions maintained existing premarket requirements for specified radiology software, formalized a Class II classification with defined special controls for cardiovascular machine learning-based notification software, and refreshed the public list of AI-enabled medical devices, which now exceeds 1,600 entries. In the UK, the MHRA-convened National Commission into the Regulation of AI in Healthcare published a 119-page report with 44 recommendations for a proportionate, lifecycle-based and system-wide framework, and on October 6 the UK government published its response accepting all 44 and setting out initial delivery priorities. Separately, a WHO/Europe expert dialogue involving participants from 105 countries emphasized governance readiness as the measure of responsible progress on AI in health.
These developments are not the same kind of action. Some are binding regulatory actions, some formally publish an earlier decision, some are non-binding recommendations or policy commitments, and one is an expert discussion report. Where an update formalizes an earlier decision (for example, the FDA’s radiology order, which formalizes an April 2026 denial, and the cardiovascular codification, which follows a 2023 classification), this article states both dates. The UK government’s response was published on October 6, after the September reporting period, and is included as a follow-up to the Commission’s September report.
Disclaimer: This article is produced for educational and informational purposes only. It summarises publicly available regulatory updates and reflects our interpretation of emerging developments; it does not constitute legal, regulatory, financial, or professional advice, nor should it be interpreted as a statement of regulatory intent. Readers should consult qualified counsel before taking any action based on the information presented here.
US
1) FDA Publishes Final Order Confirming Radiology AI Software Remains Subject to 510(k) (September 17, 2026)
The FDA published a final order in the Federal Register (document number 2026-19074) confirming that it will not grant a petition seeking a partial exemption from 510(k) premarket notification for radiology computer-aided detection, diagnosis and triage software. The order was published and took effect on September 17, 2026. The petition denial itself dates to April 1, 2026; the September publication is the formal, statutory completion of that decision rather than a new determination.
Background: the petition
Docket and notice: The petition was handled under Docket No. FDA-2025-P-5560. The FDA published notice of it in the Federal Register on December 29, 2025 (90 FR 60730) and accepted public comments until February 27, 2026.
Device types covered: The petition asked for partial exemption, subject to conditions described in the petition, for four generic device types: radiological computer-assisted diagnostic software for lesions suspicious of cancer (21 CFR 892.2060, product code POK); medical image analyzers (21 CFR 892.2070, product code MYN); radiological computer-aided triage and notification software (21 CFR 892.2080, product codes QAS and QFM); and radiological computer-assisted detection and diagnosis software (21 CFR 892.2090, product codes QBS and QDQ).
What the final order means
No exemption granted: Because the partial exemption was not granted, the four device types covered by the order remain subject to 510(k) premarket notification. Manufacturers must obtain the required FDA clearance before marketing a covered device, subject to any other applicable regulatory provisions.
Narrow in scope: The petition sought a conditional partial exemption for devices meeting specified conditions, and the order addresses only that request for these four device types. It does not establish a new, universal 510(k) rule for all AI healthcare products, and it is not a restriction on radiology AI as such; it leaves the existing premarket pathway in place.
Timing nuance: Organizations tracking regulatory change should record April 1, 2026 as the date of the underlying decision and September 17, 2026 as the date of the formal Federal Register order.
FDA Final Order, Federal Register Document 2026-19074
How it applies to AI in Healthcare:
This order directly shapes market-access planning for developers of imaging AI that performs detection, diagnosis or triage. Anyone building or buying software of the kinds covered by the four device types should assume a 510(k) is required and plan evidence, timelines and budgets accordingly. For planned model changes after authorization, a predetermined change control plan (PCCP) is a mechanism that can be included in a marketing submission, but its flexibility applies only within the scope of the authorized plan and subject to applicable FDA requirements; it does not remove all future submission obligations. Healthcare providers and procurement teams can continue to treat a 510(k) clearance as the baseline premarket check for covered tools.
2) FDA Codifies Class II Classification for Cardiovascular Machine Learning-Based Notification Software (September 11, 2026)
The FDA published a final order (Federal Register document 2026-18612, 91 FR 57785, Docket No. FDA-2026-N-9907) classifying cardiovascular machine learning-based notification software into Class II with special controls and codifying it at 21 CFR 870.2380. The order is effective September 11, 2026. The classification itself was applicable on August 3, 2023: FDA received Viz.ai’s De Novo request for the Viz HCM device on January 10, 2023 and issued the classification order to the requester on August 3, 2023. The September 2026 publication codifies that classification in the Code of Federal Regulations.
How the regulation defines the device
Function: The software uses machine learning to suggest the likelihood of a cardiovascular disease or condition for further referral or diagnostic follow-up. It identifies a single condition from one or more non-invasive physiological inputs obtained as part of routine medical care.
Boundaries: The regulation states the software is “not intended to provide diagnostic quality output” and is not intended to identify or detect arrhythmias. These limits describe this device type only and should not be extended to other AI products.
Risks addressed: The order maps four risks to mitigation measures: false positives or false negatives; incorrect results from model bias or failure to generalize to the intended use population; use in an unsupported population or with unsupported inputs or hardware; and overreliance on the device output for follow-up.
Special controls (21 CFR 870.2380(b))
Clinical validation: Validation must use real-world data from a representative patient population, with a test dataset independent from training and development data. The dataset must include a minimum of three geographically diverse sites separate from those used in training, and enough cases from important cohorts (for example demographic populations, comorbidities, and hardware and acquisition characteristics) to characterize performance for those subsets. Performance goals must be justified in the context of the risks associated with follow-up testing.
Bias and subgroup reporting: Objective performance measures (for example sensitivity, specificity, positive predictive value or negative predictive value) must be reported, along with summary-level demographic information and subgroup analyses for each study site, relevant demographic subgroups and acquisition systems.
Software verification, validation and hazard analysis: Documentation must describe the model or algorithm, its inputs and outputs and the supported patient population; include integration testing in the intended software environment; and describe the expected impact of sensor acquisition hardware, input signal quality controls and mitigations for user error or subsystem failure.
Human factors: A human factors assessment of the intended users in the intended use environment must evaluate the risk of misinterpretation of the device output.
Labeling: Labeling must include a summary of performance testing, tested hardware and supported populations, subgroup results and expected minimum performance, device limitations and subpopulations where it may not perform as expected, a warning not to rely on the lack of a suspected finding to rule out follow-up, a statement that output should not replace a full clinical evaluation, warnings on sensor acquisition factors, guidance on interpretation and typical follow-up testing, and the types of hardware sensor data used.
The order also confirms that FDA has not determined that this device type should be exempt from premarket notification, so it remains subject to 510(k). Because the device was classified through De Novo, it can serve as a predicate for future devices of this type, which means later sponsors can use the 510(k) pathway rather than submitting a new De Novo request or a premarket approval application.
FDA Final Order, Federal Register Document 2026-18612
How it applies to AI in Healthcare:
For developers of ECG-based and similar single-condition notification tools, this order defines the Class II route and the evidence FDA expects: multi-site validation on representative data, subgroup performance reporting, human factors work and detailed labeling of limitations. Developers of other AI products can read the special controls as an indication of how FDA thinks about validation and subgroup performance for this device type, but they are specific to 21 CFR 870.2380 and are not a universal checklist for every AI product. Providers evaluating tools in this category can use the labeling and validation requirements as a guide to what documentation to request from vendors.
3) FDA Updates Its AI-Enabled Medical Devices List (September 2026)
The FDA’s AI-Enabled Medical Devices List pages carry update dates of September 4 and September 22, 2026. The FDA reports that more than 1,600 AI-enabled medical devices had been authorized for marketing in the United States as of September 2026. The list is updated periodically, and the most recent device decisions shown in the list at the time of writing are dated late June 2026, reflecting the lag between authorization and publication of decision summaries.
Key points about the list
Not a regulatory category: The list is a transparency resource identifying authorized devices that contain AI-enabled functions. The FDA states that it is “not a comprehensive resource of AI-enabled medical devices,” so absence from the list does not mean a device contains no AI, and the list should not be treated as a complete authorization database.
How devices are identified: Entries are identified primarily from AI-related terms in the summary descriptions of marketing authorization documents and/or the device classification, using terms based on the FDA Digital Health and Artificial Intelligence Glossary.
Lag in coverage: Authorized devices whose decision summaries had not been published within the data collection period are incorporated in a subsequent update.
Foundation models and LLMs: The FDA says it will explore methods to identify and tag devices that incorporate foundation models, from large language models to multimodal architectures, and encourages sponsors to include appropriate information in their public summaries to support that work in a future update of the list.
Across specialties: The list covers authorized devices across multiple medical specialties, including radiology, and links each entry to its FDA database record.
FDA: Artificial Intelligence-Enabled Medical Devices
How it applies to AI in Healthcare:
For developers, the list is a starting point for researching authorized products and their intended uses, and a reminder that the wording of a public marketing authorization summary affects how a product is identified and categorized. For compliance teams and buyers, it is a useful first step in due diligence on whether a vendor’s product has a US authorization, but it should be verified against FDA’s device databases rather than treated as definitive.
EU & UK
1) UK National Commission Publishes Recommendations for a Future Regulatory Framework for AI in Healthcare (September 10, 2026)
The National Commission into the Regulation of AI in Healthcare, an independent expert advisory body established by the MHRA in September 2025, published its report setting out 44 recommendations across 119 pages. The Commission is chaired by Professor Alastair Denniston, with Professor Henrietta Hughes as Deputy Chair. Its central conclusion is that regulation and assurance of AI in healthcare must become “more proportionate, lifecycle-based and system-wide”. The recommendations are non-statutory: they advise the MHRA, government and system partners and do not by themselves create new legal obligations. The UK government published its response on October 6, 2026, covered in the next item.
The Commission found that public and professional support for AI in healthcare is conditional rather than automatic, and that a framework relying too heavily on a one-off premarket assessment will not be enough for products that iterate quickly and perform differently across settings. The report draws on the Commission’s Call for Evidence, in which two-thirds of industry respondents and half of healthcare providers viewed the current framework as restricting innovation, and 65% of respondents disagreed that current post-market surveillance is sufficient.
Chapter 1: Proportionate lifecycle regulation (Recommendations 1 to 23)
Qualification and classification (Recommendations 1 and 2): The MHRA should review the UK Medical Devices Regulations 2002 so that the definition of a medical device clarifies when administrative, general wellbeing and certain decision-support software is not a device, and should introduce a classification approach that addresses the limits of self-declared Class I, which is where most software and AI devices sit today. The definition of intended purpose should take account of device design and functionality, not just manufacturer claims and promotional material.
Proportionate and function-based oversight (Recommendations 3 and 4): The MHRA should be able to add or relax requirements as evidence emerges, and should consider regulating the specific functions of a product that qualify as medical devices rather than an entire multifunction product, for example ambient voice technology tools or a general-purpose language model with one medical feature.
Lifecycle evidence and change control (Recommendations 5 and 6): Evidence expectations should be rebalanced toward the post-market phase, and predetermined change control plans (PCCPs) should evolve to support adaptive and continuously learning devices by defining boundaries for allowable change, site or sub-population tuning, broad intended purposes and evidence-driven use expansion.
General-purpose AI models (Recommendations 7 and 8): The MHRA should consider an opt-in “Master File” for general-purpose platforms and foundation models, building on similar mechanisms at the FDA, Health Canada and Japan’s PMDA, and manufacturers should report dependencies on underlying general-purpose models, related risks and continuity plans in regulatory submissions and in procurement and contract terms.
Transparency, cybersecurity and usability (Recommendations 9 to 12): Guidance should support model cards, dynamic labelling and user-centred interface design; set out cybersecurity expectations across the product lifecycle, including threats such as data poisoning; clarify expectations for direct-to-consumer applications and wearables; and address human factors and usability.
Health equity (Recommendation 13): Guidance should set out how manufacturers demonstrate safe and equitable performance for the diversity of the intended population, including ongoing monitoring of subgroups across the lifecycle.
Routes to market (Recommendations 14 to 16): The MHRA should enable temporary staged authorisations that start within a tightly controlled scope and expand once prespecified evidence thresholds are met, continue and extend regulatory sandboxes such as the AI Airlock (whose pilot with four companies produced 40 recommendations), and introduce recognition or reliance pathways with trusted international regulators. The report notes that 59% of respondents to the MHRA’s consultation agreed that software-based devices should be added to international reliance routes.
Post-market assurance (Recommendations 17 to 19): The MHRA should tailor post-market surveillance to risk, using a menu of tools that includes surveillance plans assessed at authorisation, real-world post-market studies, regular performance reporting and escalation processes where performance degradation is detected even without a reportable incident. It should also improve Yellow Card reporting for AI and software devices and consider a public, searchable database of adverse incidents, building on its Drug Analysis Profiles and drawing on the FDA’s MAUDE database.
Infrastructure, monitoring and enforcement (Recommendations 20 to 23): The MHRA should introduce mechanisms to identify AI-enabled devices once deployed, including version control for traceability (for example through unique device identifiers recorded in the patient record), automate low-burden reporting, develop enhanced enforcement mechanisms including timely sharing of early safety signals and financial penalties for non-compliant manufacturers that place patients at risk, and test more responsive compliance approaches with manufacturers and Approved Bodies.
Chapter 2: System-wide responsibility and safe management (Recommendations 24 to 34)
Shared responsibility: The Commission argues that regulation cannot be the only enabler of safe AI use. Manufacturers, providers, professionals, regulators and policymakers all have defined roles, including clear responsibilities and liability arrangements throughout the product lifecycle.
Provider readiness: The report calls for an AI readiness toolkit to support healthcare organisations, strong governance for implementation and monitoring, best practice for procurement, deployment and risk controls, and workforce capability and AI literacy.
Chapter 3: Trust, transparency and predictability (Recommendations 35 to 44)
Transparency and engagement: Recommendations cover a system approach to transparency about AI used in care pathways, inclusive patient and public engagement in policymaking, and better communication about safety concerns to patients and professionals.
Predictability for innovators: The Commission proposes educational resources that demystify the regulatory journey and predictable mechanisms for early engagement with regulators.
Full National Commission Report (PDF, 119 pages)
How it applies to AI in Healthcare:
The report is a strong signal of the direction of UK regulation for software and AI-enabled medical devices, and many of its ideas (staged authorisation, broader PCCPs, performance reporting, master files for foundation models) go beyond current requirements. Manufacturers selling or planning to sell in Great Britain should treat these recommendations as a preview of future evidence expectations, particularly around post-market monitoring, subgroup performance and disclosure of foundation model dependencies. Healthcare providers should note that the report places explicit expectations on them as well, including organisational readiness, procurement diligence and monitoring of AI once deployed. The Commission’s recommendations are advisory and do not themselves create binding requirements, but the Commission recommends that the MHRA provide guidance within the existing framework in parallel with longer-term legislative change. The government’s October 6 response, covered next, confirms the policy direction and sets out what is planned.
2) UK Government Accepts All 44 Commission Recommendations and Sets Initial Delivery Priorities (October 6, 2026)
On October 6, 2026, the UK government published its response to the National Commission’s recommendations, produced by the MHRA and introduced by James Frith MP, Parliamentary Under-Secretary of State for Health Innovation. The response accepts all 44 recommendations, sets out ten initial delivery priorities and gives a government response and timeline for each recommendation. It describes the current UK Medical Devices Regulations 2002 as not fit for purpose for AI-enabled products and commits to a new approach that the government describes as proportionate, risk-based, lifecycle-based and system-wide. Publication took place after the September reporting period and is included here as the follow-up to the Commission’s September 10 report.
The response describes a “conscious shift towards ongoing assurance rather than overreliance on pre-market assessments” and passive adverse event reporting. It is a statement of policy direction and delivery commitments: acceptance of the recommendations does not by itself turn each one into a binding legal requirement. Specific obligations will depend on later consultations, secondary legislation, regulatory guidance and implementation measures.
Delivery priorities for the next year
Modernise the regulatory framework (Priority 1): The MHRA will take steps, through legislative reform and guidance, to clarify when a product qualifies as a medical device, improve classification and clarify how intended purpose includes design and functionality.
Equitable access and outcomes (Priority 2): Partners across the health, regulatory and care system will promote approaches that consider equity throughout the lifecycle, with particular attention to underserved and underrepresented groups.
Stronger post-market assurance (Priority 3): The MHRA will develop a more lifecycle-based approach that better balances pre-market evidence with post-market assurance, including enhanced surveillance mechanisms and clearer evidence expectations.
Safe iteration and earlier access (Priority 4): The MHRA will explore practical implementation of predetermined change control plans, novel staged authorisation pathways that generate real-world evidence, and expanded use of regulatory sandboxes, working with NICE and equivalent bodies in the devolved nations.
Safe deployment conditions (Priority 5): The MHRA will develop guidance on how manufacturers identify, describe and communicate the operational conditions needed for safe deployment, with illustrative examples of risk controls.
System capability and readiness (Priority 6): DHSC and NHS England will work with the devolved health departments on an AI Readiness Toolbox, and professional regulators, education bodies and healthcare organisations will work on AI literacy and training.
Accountability and a culture of reporting (Priority 7): DHSC, the MHRA, the Care Quality Commission, NHS Resolution, the Professional Standards Authority, professional regulators and equivalent devolved bodies will form a working group to clarify responsibilities across manufacturers, providers, professionals and regulators, and DHSC will work on patient access to redress.
Transparency and public confidence (Priority 8): The MHRA and partners will increase patient and public engagement in regulatory decision-making, and DHSC will work on a consistent, proportionate approach to informing patients about how AI is used in their care.
Regulatory clarity and navigability (Priority 9): Clearer guidance, resources and opportunities for early engagement for developers and manufacturers.
Regulatory capability and the evidence base (Priority 10): The MHRA and NICE, with equivalent devolved bodies, will align regulatory, evidence-generation and assurance expectations, and the Health Research Authority will clarify when AI development, deployment, evaluation and monitoring activities constitute research requiring research governance.
Specific commitments and timelines
Classification and qualification consultation (Recommendations 1 and 2): The MHRA intends to launch a consultation on a new, proportionate approach to classification and qualification of software and AI-enabled devices by Spring 2027, and then to use secondary legislation to introduce an updated definition of a medical device (including clarity on administrative, general wellbeing and certain decision support software), a new classification approach and an updated definition of intended purpose. In the meantime it intends to update its guidance on medical device stand-alone software, including apps.
Draft PCCP guidance (Recommendation 6): The MHRA intends to issue draft guidance on predetermined change control plans for public comment by December 2026, describing an approach that lets manufacturers set boundaries for the scope of allowable change, including for adaptive AI-enabled devices, while maintaining the device’s intended use.
Lifecycle oversight and guidance (Recommendations 3 to 5, 10 to 13): The MHRA will consider draft guidance on enforcement discretion for sufficiently low-risk software, options for function-based regulation including through secondary legislation, a more lifecycle-based framework that may involve licensing powers, and guidance on cybersecurity (draft), direct-to-consumer devices, human factors and health equity, with further details to be shared by Spring 2027.
General-purpose models (Recommendations 7 and 8): The MHRA will engage experts on proportionate information about general-purpose AI models, which may include a Master File pilot, and will provide guidance on the information manufacturers must provide about provenance, dependencies and related risks, working with DHSC and the devolved health departments to build these expectations into procurement and contract terms.
Staged authorisation and sandboxes (Recommendations 14 and 15): The MHRA will explore staged authorisation pathways, including through proposed licensing powers and statutory sandbox mechanisms, deliver Phase 3 of the AI Airlock programme and support sandbox provisions in the government’s upcoming Regulating for Growth Bill. Alongside the response, the MHRA opened applications for AI Airlock Phase 3, which focuses on post-market surveillance and the safe management of AI-enabled devices across their lifecycle; the government’s announcement states that applications close in November 2026.
International recognition (Recommendation 16): The MHRA will work with recognised international regulators to establish recognition and reliance arrangements for AI-enabled devices, alongside continued engagement through the IMDRF and bilateral and trilateral relationships including with the FDA, Health Canada and the TGA.
Post-market surveillance and reporting (Recommendations 17 to 21): The MHRA will build an enhanced toolkit of post-market mechanisms that could be required individually or in combination, improve the Yellow Card scheme for AI and software devices, work toward a public database of device adverse incidents building on its Drug Analysis Profiles, publish guidance on unique device identifiers and version control for software and AI-enabled devices, and explore automated reporting.
Enforcement (Recommendation 22): The MHRA will explore strengthening its enforcement approach, including implementing the civil sanctions regime under the Medicines and Medical Devices Act to enable financial penalties where appropriate.
Transparency (Recommendations 35 and 37): DHSC will consider how information governance requirements could clarify transparency expectations and patient choices where AI is used in care, including when opt-out arrangements may be feasible, and the MHRA will work toward publishing a regularly updated list of authorised AI-enabled medical devices in the UK.
Provider readiness and training (Recommendations 24, 28 to 34): Commitments include a working group on clear allocation of responsibility, NHS England and NHS Resolution guidance on indemnity, a review of how responsibilities are allocated between manufacturers and providers in contracts, an AI Readiness Toolbox building on the existing AI Readiness Checklist, national best practice on lifecycle management, and support for providers to meet existing staff training obligations.
Governance and next steps
Programme Board: The government will establish a cross-system Programme Board with representation from health, regulatory and research bodies and the devolved authorities, meeting quarterly and reporting progress quarterly to the Life Sciences Delivery Board.
Implementation roadmap: An implementation plan and roadmap setting out roles, responsibilities, timelines and key deliverables is to be published by Spring 2027, with annual progress updates thereafter. For most recommendations, the response states that further details will be shared by Spring 2027.
Government Response (PDF, 42 pages)
GOV.UK: Government backs recommendations of NHS doctors-led AI Commission
How it applies to AI in Healthcare:
The response moves the Commission’s blueprint from advice to stated government policy, and gives manufacturers a first set of dates to plan around: draft PCCP guidance by December 2026, a consultation on classification and qualification by Spring 2027, and a delivery roadmap by Spring 2027. Developers selling or planning to sell in Great Britain should follow these consultations and drafts closely, particularly on post-market surveillance, foundation model dependencies, subgroup performance and cybersecurity, and consider whether the AI Airlock is relevant to their product. Healthcare providers should prepare for expectations on readiness, procurement and contract terms, staff training and patient transparency. Because acceptance does not itself create binding obligations, organisations should monitor implementation, subsequent consultations, guidance and legislation rather than assume specific requirements are already in force.
3) WHO/Europe Report Says Governance Readiness, Not Deployment Speed, Should Measure Progress on AI in Health (September 1, 2026)
The WHO Regional Office for Europe published the findings of its first Knowledge Community on responsible AI in health, a five-week structured online dialogue held between October and December 2025. It brought together researchers, policy-makers and digital health experts from 105 countries, mostly from the WHO European Region. The report concludes that “governance readiness, not speed of deployment” should be the measure of responsible progress. The project was co-funded by the European Commission.
Key findings
The central obstacle is institutional: Participants concluded that the main barrier to responsible AI in health is not the technology itself, but the strength of the institutions meant to govern it.
Persistent barriers: Fragmented and biased datasets, unclear accountability and gaps in AI literacy were identified as the most persistent obstacles to safe and effective use.
Enablers: Robust governance frameworks, co-design with patients and clinicians, transparency, and equitable access to data and tools.
Ethics as an ongoing practice: Ethics should be woven into the daily functioning of health systems rather than applied once at the point of deployment. This requires continuing scrutiny and, at times, a willingness to delay or reject an AI tool that cannot be governed responsibly.
Priority actions
Five priority areas: Participants agreed that delays in these areas could pose a greater risk than delays in technology adoption itself: governance; data; validation; workforce capacity; and participation by patients, communities and frontline professionals.
Next steps: WHO/Europe says it will build on the Knowledge Community through continued technical dialogue, regional exchanges and capacity-building activities, translating the findings into guidance and practical support for countries.
Important caveat
The report reflects the views of Knowledge Community participants and does not necessarily represent the formal position of WHO. The participants were not a statistically representative sample of stakeholders; academic institutions were the most represented group, followed by the private sector, government and health authorities, and nongovernmental organizations. It should be read as an expert perspective on direction of travel, not as binding guidance.
WHO/Europe: Progress on AI in health should be determined by strength of governance, WHO forum urges
How it applies to AI in Healthcare:
While not a regulation, the report indicates what international health authorities are likely to prioritise in future guidance: demonstrable governance, validation evidence, workforce training and patient participation. Vendors can use these five priorities as a framework for describing how their product supports a customer’s governance, and health organisations deploying AI in European markets can use them to structure internal readiness assessments, including the option of declining a tool that cannot be governed responsibly.
Cross-Cutting Themes
Disclaimer: The cross-cutting themes below are analytical observations based on the sources cited in this article and reflect our interpretation of emerging regulatory and policy developments. They do not constitute legal, regulatory, or professional advice, nor should they be interpreted as statements of regulatory intent. Readers may wish to consult qualified advisors regarding the application of any regulatory requirements to their specific circumstances.- Lifecycle assurance is a shared emphasis. The UK Commission’s emphasis on post-market evidence, performance reporting and flexible change control, and the UK government’s acceptance of those recommendations, sit alongside FDA developments such as special controls and PCCPs. These are similar in direction, but they are different kinds of action (recommendations and policy commitments in the UK, regulatory orders in the US) and should not be read as a coordinated regulatory position.
- Existing premarket pathways are being confirmed, not replaced. The FDA’s radiology order and its cardiovascular codification both keep 510(k) as the working route for the device types concerned, while adding specificity about evidence expectations for the cardiovascular type. Developers should expect more detail within existing pathways rather than wholesale exemptions for these device types.
- Subgroup performance is becoming an explicit evidence topic. The cardiovascular special controls, UK Recommendation 13 (and the government’s commitment to guidance on it) and the WHO/Europe emphasis on biased datasets all point to subgroup performance and limitation reporting as an expected part of validation and labeling.
- Transparency tools are converging. Model cards, dynamic labelling, public adverse-event data, a planned UK list of authorised AI-enabled devices and the FDA’s public AI device list reflect a shared push toward making AI-enabled products visible and understandable to buyers, clinicians and patients.
- Governance extends beyond the regulator. The UK Commission’s system-wide framing, the government’s delivery priorities on readiness, accountability and training, and WHO/Europe’s governance-readiness message place responsibility on providers, procurers and policymakers as well as manufacturers.
Key Considerations for Regulatory Alignment
Disclaimer: This checklist is provided for general informational purposes only and does not constitute legal, regulatory, or professional advice; organizations should consult with their legal and compliance departments to ensure adherence to specific jurisdictional requirements.
For Founders & Business Owners
- Plan for 510(k) on the radiology software types covered by the order. If your product falls within one of the four device types named in the FDA order (21 CFR 892.2060, 892.2070, 892.2080 or 892.2090), build the 510(k) submission into your timeline and budget; the FDA has not granted the requested partial exemption.
- Use the cardiovascular special controls as a reference, not a universal checklist. The 21 CFR 870.2380 controls (representative real-world validation data from at least three geographically diverse sites, subgroup reporting, human factors, labeling of limitations) show how FDA approaches validation and subgroup performance for that device type. They apply to that device type only, though they are a useful reference for validation planning elsewhere.
- Plan PCCPs carefully. A predetermined change control plan can be included in a marketing submission, but its flexibility applies within the authorized scope and subject to applicable FDA requirements; it does not remove all future submission obligations.
- Document foundation model dependencies. The UK Commission’s Recommendations 7 and 8, both accepted by the government, point toward disclosure of underlying general-purpose models, related risks and continuity plans, and a possible Master File pilot. Start tracking provenance, versions and fallback arrangements now.
- Design for post-market monitoring. Build logging, drift detection, user feedback channels and performance reporting into your product architecture, since UK policy and FDA special controls both place weight on evidence generated and monitored after deployment.
- Mind your public summaries. The FDA draws on public summaries to populate its AI-enabled device list and has signalled interest in identifying LLM-based functionality, so describe AI components accurately and consistently.
For Compliance & Regulatory Specialists
- Track both dates on formalized decisions. Record the underlying decision date and the Federal Register publication date separately (April 1 and September 17, 2026 for the radiology order; August 3, 2023, when the classification became applicable, and September 11, 2026, when the codifying order took effect, for the cardiovascular classification) so that change logs reflect what is new.
- Monitor UK implementation, not just the recommendations. The Commission’s report is advisory and the government’s acceptance of all 44 recommendations sets policy direction without itself creating binding requirements. Track the follow-on items: draft PCCP guidance (intended by December 2026), the classification and qualification consultation (intended by Spring 2027), later guidance and secondary legislation, and the implementation roadmap due by Spring 2027.
- Map evidence expectations across the lifecycle. Compare your current premarket and post-market evidence plans against the UK’s tailored surveillance toolkit (surveillance plans, real-world studies, regular performance reporting, escalation of performance degradation) and identify gaps.
- Verify the FDA AI list independently. The list is explicitly not comprehensive and lags device decisions, so confirm a vendor’s US authorization status through the FDA’s device databases rather than relying on the list alone.
- Use WHO/Europe’s priorities for readiness reviews, with the caveat in mind. Governance, data, validation, workforce capacity and participation provide a sensible structure for internal AI governance assessments, but the report reflects participant views rather than a formal WHO position.
Sources
FDA Final Order: Radiology CAD/CADx/Triage Exemption Petition, Federal Register Document 2026-19074 (Released: September 17, 2026)
https://www.federalregister.gov/d/2026-19074FDA Final Order: Cardiovascular Machine Learning-Based Notification Software Classification, Federal Register Document 2026-18612 (Released: September 11, 2026)
https://www.federalregister.gov/d/2026-18612FDA: Artificial Intelligence-Enabled Medical Devices (Updated: September 2026; list page dated September 4 and September 22, 2026)
https://www.fda.gov/medical-devices/digital-health-center-excellence/artificial-intelligence-enabled-medical-devicesGOV.UK / MHRA: National Commission into the Regulation of AI in Healthcare, Recommendations for a Future Regulatory Framework (Released: September 10, 2026)
https://www.gov.uk/government/publications/national-commission-into-the-regulation-of-ai-in-healthcare-recommendations-for-a-future-regulatory-frameworkNational Commission into the Regulation of AI in Healthcare: Full Report (PDF) (Released: September 10, 2026)
https://assets.publishing.service.gov.uk/media/6aa2662962ec7fe7bedf52b9/Full_National_Commission_Report_-_Publication__1_.pdfGOV.UK / MHRA: Government Response to the National Commission’s Recommendations on the Regulation of AI in Healthcare (Released: October 6, 2026)
https://www.gov.uk/government/publications/government-response-to-the-national-commissions-recommendations-on-the-regulation-of-ai-in-healthcareGovernment Response to the National Commission’s Recommendations (PDF) (Released: October 6, 2026)
https://assets.publishing.service.gov.uk/media/6ac3b9e0c9bd185c481eca06/National_Commission_Government_Response_v1.0.pdfGOV.UK: Government backs recommendations of NHS doctors-led AI Commission (Released: October 6, 2026)
https://www.gov.uk/government/news/government-backs-recommendations-of-nhs-doctors-led-ai-commissionWHO/Europe: Progress on AI in health should be determined by strength of governance, WHO forum urges (Released: September 1, 2026)
https://www.who.int/europe/news/item/01-09-2026-progress-on-ai-in-health-should-be-determined-by-strength-of-governance–who-forum-urges
