The Regulation Of New Medical Tech Is Becoming A Lifelong Process
For most of the history of medical deviceregulation, approval has been treated as a single moment: a device is tested,assessed and authorised, and the questions that follow are largely aboutwhether it keeps performing as it did on the day it was approved. Artificialintelligence as a medical device (AIaMD) does not fit that model well. Softwarecan be updated, retrained or deployed in settings its developers did not fullyanticipate, and its performance may change as data, workflows and clinicalenvironments change. Two UK publications released in 2026 show regulatorsmoving firmly away from the single-moment model and towards oversight across a device'swhole lifecycle. That shift has implications well before a device reaches themarket, including for how early-stage clinical research is designed today.
An Update to UK regulation
The Medicines and Healthcare productsRegulatory Agency (MHRA) launched the AI Airlock in 2024 as a regulatorysandbox for AIaMD, bringing manufacturers, the MHRA, NHS teams and ApprovedBodies together to test real AI-enabled devices under close supervision. ThePhase 2 programme report, published in June 2026, draws on seven case studiesand sets out a series of findings that go beyond any single product. While thereport does not constitute formal MHRA guidance, its findings provide animportant indication of the regulatory challenges being explored for AIaMD
Several of those findings point in the samedirection. The report notes that "real-world performance is notsufficiently replicated or represented by controlled testing alone", andthat AI medical devices benefit from a lifecycle approach in which post-marketmonitoring complements pre-market evidence. It suggests manufacturers candesign validation studies with real-world deployment in mind, identifying whichassumptions about user behaviour, data quality and clinical context may nothold in practice. Human oversight is not static either: as a system provesreliable, users tend to apply less scrutiny, so oversight has to be monitoredacross the lifecycle rather than assumed. Performance thresholds should begrounded in clinically meaningful outcomes, not statistical significance alone.
One finding is particularly relevant toearly-stage research. The report concludes that "the regulatorysignificance of a change cannot be determined from the type of change inisolation". Instead, assessment "will need to start with intendedpurpose but extend to function, clinical role, user interaction, level ofautonomy, deployment environment, benefit-risk impact and humanoversight."
The programme has now moved into a thirdphase, supported by £1.2 million a year of funding through to 2029, with afocus on turning these insights into practical regulatory guidance.
In September 2026, the independent NationalCommission into the Regulation of AI in Healthcare published itsrecommendations for a future regulatory framework. They include stagedauthorisation, likened to "L-plates for learner drivers", under whichnew AI systems are deployed under supervision and tight controls beforereceiving fuller authorisation; continuous real-world monitoring throughout adevice's operational life rather than a single point-in-time approval; publicaccess to safety information about AI medical devices, with patients told whenAI is used in their care; and stronger enforcement powers for the MHRA. Takentogether with the Airlock findings, the direction of travel is clear:regulation of AI in healthcare is becoming something that runs alongside adevice for its entire life, not a gate it passes through once.
The Forest 1 case study
PHARMExcel is currently managing a UKneuroscience research programme that shows why this matters for studies takingplace long before any authorisation decision. Run in partnership with Barking,Havering and Redbridge University Hospitals NHS Trust and funded by the UK'sAdvanced Research and Invention Agency (ARIA), the programme is a feasibilityand early-safety study of Forest 1, an ultrasonic neural interface andwhole-brain computer interface developed by US-based Forest Neurotech. Forest 1uses ultrasound to measure brain activity, rather than relying on the implantedelectrodes typical of earlier brain-computer interface approaches. The studyrecruits participants who have previously undergone a decompressivecraniectomy, as the resulting gap in the skull allows ultrasound to reach braintissue that intact bone would otherwise block.
At its current stage of development and forthe purposes of this study, Forest 1 is being used as a research tool ratherthan as a medical device within a regulated clinical investigation. The studytherefore sits within a different regulatory and governance framework from amedical device clinical investigation. As the technology develops towardsneuromodulation and potential therapeutic applications, its intended purpose,risk profile and regulatory requirements will change
As the contract research organisation managingthe study, PHARMExcel supports the investigators and the Trust with itsday-to-day delivery, including study set-up, approvals, participant safetymonitoring and data quality. Because the current study is not being conductedas a regulated medical device clinical investigation, its oversight is shapedby research ethics review, Health Research Authority approval, NHS researchgovernance and the sponsor's own quality processes.
What the 2026 reports mean for studies like Forest 1
The AI Airlock and the National Commissionboth focus on AI as a medical device, but the principles behind their findingsapply more broadly to any novel device whose regulatory status is expected tochange over the course of its development.
The first is that a change in function canmatter as much as a change in technology. Forest 1 illustrates why intendedpurpose and function need to be considered early in development. A platformused initially to measure brain activity may have a very different risk andregulatory profile when developed towards neuromodulation and potentialtherapeutic use, even where much of the underlying technology remains the same.Recognising that early, rather than treating the later stage as a separateproject, allows research to be planned with the next stage of development inview.
The second is that lifecycle thinking startsin research, not at market authorisation. If regulators expect validationstudies to be designed with real-world deployment in mind, the earliest studiesare where that design begins. For sponsors of experimental studies, that raisespractical questions: which data collected now will still be useful once thedevice enters a regulated pathway, how design decisions and their rationale aredocumented, and how outcomes that are clinically meaningful, not juststatistically significant, are defined from the outset. For a study like Forest1, these are not abstract questions: the move from measuring to modulating isalready anticipated, so the evidence gathered in the current phase sits at thestart of a longer regulatory journey.
The third is that staged, supervisedprogression is already familiar territory in clinical research. TheCommission's "L-plates" model describes new AI systems moving fromtightly controlled use towards fuller authorisation. Novel devices in earlyresearch follow a comparable path, from experimental study to regulatedinvestigation and, eventually, to authorisation, with the level of oversightchanging at each step. The Commission's emphasis on continuous monitoring andon patients understanding how technology is used in their care also reflectsquestions that research teams deal with from the first participant onwards,through safety monitoring and informed consent.
In Conclusion
The 2026 publications make it clear that themost important regulatory questions for AI and other novel medical technologiesare no longer only about whether a device is approved, but about how it isoverseen before, during and after that point. For sponsors working at theearliest stages of development, that means considering the full lifecycle of adevice from the first study onwards, and collaborating with research partners,such as CROs, who can support the generation of robust evidence for today’s researchquestions while anticipating the regulatory, clinical and operationalrequirements that may come next. PHARMExcel's work on Forest 1 is an example ofthat kind of early-stage research: a novel device, studied under the governancethat fits its current status, with a regulatory pathway ahead of it.
Sources MHRA, AI Airlock Sandbox Phase 2 ProgrammeReport (June 2026):https://www.gov.uk/government/publications/ai-airlock-sandbox-phase-2-programme-report MHRA MedRegs blog, Advancing AI regulation inhealthcare: insights from AI Airlock Phase 2 (June 2026): https://medregs.blog.gov.uk/2026/06/09/advancing-ai-regulation-in-healthcare-insights-from-ai-airlock-phase-2/ National Commission into the Regulation of AIin Healthcare: Recommendations for a future regulatory framework (September2026): https://www.gov.uk/government/publications/national-commission-into-the-regulation-of-ai-in-healthcare-recommendations-for-a-future-regulatory-framework ARIA: https://aria.org.uk/