UK health AI regulation: MHRA, AI Airlock and UK GDPR
How the UK regulates health AI in 2026: AI as a medical device under the MHRA, the AI Airlock sandbox now in phase 3, and UK GDPR for health data.
- UK
Key takeaways
- The UK regulates AI through existing regulators; for health, that means the MHRA for medical devices and the ICO for data.
- AI with a medical purpose is software as a medical device and needs a UKCA or recognised CE route.
- The AI Airlock sandbox secured £3.6 million over three years, with £1.2 million a year from DHSC from 2026 to 2029.
- AI Airlock phase 3 launched on 6 October 2026, focused on evolving AI, AI diagnostics and post-market surveillance.
- Being selected for AI Airlock is not regulatory approval.
How does the UK regulate health AI?
Through existing regulators rather than a dedicated AI law. The MHRA regulates AI that meets the definition of a medical device. The Information Commissioner’s Office enforces UK GDPR and the Data Protection Act 2018. NHS bodies add their own procurement and assurance standards.
When is AI a medical device in the UK?
When the manufacturer intends it for a medical purpose, such as diagnosing, preventing, monitoring or treating disease. Such software is regulated as a medical device and needs an appropriate conformity assessment. Purely general wellness tools usually fall outside, but the line depends on claims and intended use.
What is the AI Airlock and where is it now?
| Phase | What happened |
|---|---|
| Pilot | Ran to April 2025 with four products |
| Phase 2 | Seven innovators across three regulatory challenges; completed May 2026; report published June 2026 |
| Phase 3 | Launched 6 October 2026: evolving AI, AI diagnostics and post-market surveillance |
The programme is backed by £3.6 million over three years. Its findings feed into MHRA guidance on topics such as change control plans and when an AI update counts as a significant change.
How does UK GDPR treat health data?
Health data is special category data. You need a lawful basis under Article 6 and a condition under Article 9, usually explicit consent or health and social care purposes, plus a data protection impact assessment for high-risk processing such as AI on health data.
What should a UK-bound health AI team do?
Settle the medical device question early, write a data protection impact assessment, build a plan for monitoring the model after launch, and keep versioned evaluation evidence so you can show when and how behaviour changed.
Frequently asked questions
Do I need MHRA approval for a wellness chatbot?
Not if it has no medical purpose. If it diagnoses, triages, monitors or recommends treatment, it is likely a medical device and needs the right conformity route before it is placed on the market.
What is the AI Airlock?
A regulatory sandbox led by the MHRA with DHSC, the NHS AI team and UK approved bodies. Selected companies work through real regulatory challenges with the regulator, and the findings shape future guidance.
Sources
- AI Airlock: a regulatory sandbox for AI enabled medical devicesGOV.UK
- MHRA expands AI Airlock programme with a £3.6 million funding boost over three yearsGOV.UK
- AI Airlock phase 2 programme reportMHRA · 2026-06
- Medicines and Healthcare products Regulatory AgencyGOV.UK
Found something out of date? Write to contact@brandlabs.app and we will fix it.