Software and AI Medical Devices in the UK

1. Key takeaways

Software clearly falls within the definition of a medical device in the UK: the definition in UK MDR 2002 reg 2 includes software, and software devices are classified under the rules of Directive 93/42/EEC Annex IX as amended by Schedule 2A. AI medical devices currently have no dedicated UK regulation of their own, but they have been named as a priority of regulatory modernisation: the MHRA 2030 strategy and the recommendations of the National Commission into the Regulation of AI in Healthcare are driving a restructuring of the framework. The practical picture is therefore two-layered. Today’s obligations are concrete and familiar: define the software as a device, classify it under Annex IX, and demonstrate conformity with the relevant essential requirements. Tomorrow’s obligations are still being legislated: official announcements point toward future licensing pathways for software and AI devices developed through primary legislation, but no such text is in force yet. Manufacturers should keep the two layers strictly separate in their planning and in their external communications, because conflating a legislative intention with a current duty leads to wasted preparation on one side and missed obligations on the other. The sections below keep that separation explicit throughout, so that today’s compliance work and tomorrow’s monitoring are each assigned their own owners and cadences.

2. Legal basis

• UK MDR 2002 (SI 2002/618, as amended): reg 2 (definitions, including software), reg 7 (classification), reg 8, reg 9 and Schedule 2A.
• GOV.UK news announcement, Government confirms indefinite recognition of CE marked medical devices (21 October 2026): it states that authorisation will be sought through primary legislation to develop future licensing pathways aimed at software and AI devices.
• MHRA 2030 Strategy (GOV.UK publication, published 14 October 2026): expands recognition and reliance routes with trusted regulators.
• National Commission into the Regulation of AI in Healthcare: its recommendations are cited officially as a basis for the future restructuring of the framework.

3. Expert insights

Insight one: UK software classification rules differ from the EU MDR’s. The UK applies Annex IX of the directives, whereas the EU now uses MDR Annex VIII Rule 11, and the rule texts and their outcomes are not identical. For genuinely new product categories, such as adaptive AI and continuously learning algorithms, the classification conclusions in the two jurisdictions may differ and must be assessed separately. A manufacturer that assumes the EU classification transfers automatically to the UK, or vice versa, risks building a file around the wrong risk tier. GRZAN recommends recording the classification rationale in each jurisdiction side by side, so that divergences are visible, documented and defensible rather than discovered during a review. Where the two jurisdictions differ, GRZAN recommends classifying to the higher tier in product planning conversations until the files are settled, so that resourcing decisions are not built on the more optimistic reading.

Insight two: AI is a legislative target for future licensing pathways. The official announcement states that authorisation will be sought through primary legislation to develop future licensing (licencing) pathways for medical devices, to respond better to advanced technologies including software and AI medical devices. This is a legislative intention; no instrument is in force. The correct posture for manufacturers is monitoring and preparation, not premature compliance. Budgeting, product roadmaps and external claims should all treat the future framework as conditional. GRZAN notes that the monitoring task itself deserves an owner and a cadence, since legislative developments of this kind move through consultations and announcements that are easy to miss between product cycles. Until the pathway exists, GRZAN advises treating all AI-specific statements in marketing and regulatory correspondence as forward-looking, with the wording reviewed by the regulatory function.

Insight three: the MHRA 2030 strategy emphasises recognition and reliance. The strategy sets the expansion of recognition and reliance routes with trusted regulators as one of its directions, consistent in logic with the decision of 21 October 2026 on the indefinite recognition of CE marking. For software and AI manufacturers, the significance is directional rather than operational: the UK’s trajectory favours leveraging assessments already performed elsewhere, while the eventual AI-specific requirements will arrive through the legislative process described above. Planning should therefore favour portable, well-documented evidence that can be reused across jurisdictions as the framework settles. The strategy’s publication on 14 October 2026 places it alongside the CE recognition decision of 21 October 2026, and the two are best read together as a single signal of direction.

4. Practical recommendations

GRZAN recommends that software and AI device manufacturers adopt a two-layer strategy: comply with the current rules while reserving room for the future framework. The first layer is complete and non-negotiable: finish classification under Annex IX and demonstrate conformity with the relevant essential requirements using the ordinary routes. The second layer is preparatory: within the technical documentation, reserve a record structure for algorithm change management, along the lines of a Predetermined Change Control Plan-type mechanism, covering version history, retraining events, validation triggers and release decisions. This structure costs little to establish now and positions the manufacturer to slot into a future licensing pathway quickly when the legislation lands, instead of retrofitting lifecycle governance into a finished file under time pressure. The change management records should also capture who approved each algorithm version, since accountability is likely to be examined under any future framework.

5. Verification checklist

• □ Software classification has been determined under Annex IX
• □ Differences from the EU classification are recorded
• □ Records of algorithm versions and change management exist
• □ Monitoring covers the MHRA 2030 strategy and the AI legislative process
• □ External materials do not present the legislative intention as a current obligation

Regulatory information verified as of 29 October 2026.

GRZAN supports manufacturers entering the UK market with the preparation and maintenance of registration documentation and conformity documentation. Our services for the UK market include:

• UK Responsible Person (UKRP) appointment and authorisation letter support
• Full MHRA registration (DORS) filing and account lifecycle management
• Device classification, GMDN code selection and annual registration fee calculation
• Great Britain and Northern Ireland dual-pathway design and UK(NI) solutions
• Post-market surveillance (PMS) system setup, PMSR/PSUR preparation and vigilance reporting
• Serious incident and field safety corrective action (FSCA) emergency response
• UK regulatory change monitoring and compliance gap assessment

For tailored support with UK software and AI medical device compliance and documentation, contact GRZAN at info@grzanglobal.com.