The Regulation Of New Medical Tech Is Becoming A Lifelong Process

For most of the history of medical device regulation, approval has been treated as a single moment: a device is tested, assessed and authorised, and the questions that follow are largely about whether it keeps performing as it did on the day it was approved. Artificial intelligence as a medical device (AIaMD) does not fit that model well. Software can be updated, retrained or deployed in settings its developers did not fully anticipate, and its performance may change as data, workflows and clinical environments change. Two UK publications released in 2026 show regulators moving firmly away from the single-moment model and towards oversight across a device's whole lifecycle. That shift has implications well before a device reaches the market, including for how early-stage clinical research is designed today.

An Update to UK regulation

The Medicines and Healthcare products Regulatory Agency (MHRA) launched the AI Airlock in 2024 as a regulatory sandbox for AIaMD, bringing manufacturers, the MHRA, NHS teams and Approved Bodies together to test real AI-enabled devices under close supervision. The Phase 2 programme report, published in June 2026, draws on seven case studies and sets out a series of findings that go beyond any single product. While the report does not constitute formal MHRA guidance, its findings provide an important indication of the regulatory challenges being explored for AIaMD

Several of those findings point in the same direction. The report notes that "real-world performance is not sufficiently replicated or represented by controlled testing alone", and that AI medical devices benefit from a lifecycle approach in which post-market monitoring complements pre-market evidence. It suggests manufacturers can design validation studies with real-world deployment in mind, identifying which assumptions about user behaviour, data quality and clinical context may not hold in practice. Human oversight is not static either: as a system proves reliable, users tend to apply less scrutiny, so oversight has to be monitored across the lifecycle rather than assumed. Performance thresholds should be grounded in clinically meaningful outcomes, not statistical significance alone.

One finding is particularly relevant to early-stage research. The report concludes that "the regulatory significance of a change cannot be determined from the type of change in isolation". Instead, assessment "will need to start with intended purpose but extend to function, clinical role, user interaction, level of autonomy, deployment environment, benefit-risk impact and human oversight."

The programme has now moved into a third phase, supported by £1.2 million a year of funding through to 2029, with a focus on turning these insights into practical regulatory guidance.

In September 2026, the independent National Commission into the Regulation of AI in Healthcare published its recommendations for a future regulatory framework. They include staged authorisation, likened to "L-plates for learner drivers", under which new AI systems are deployed under supervision and tight controls before receiving fuller authorisation; continuous real-world monitoring throughout a device's operational life rather than a single point-in-time approval; public access to safety information about AI medical devices, with patients told when AI is used in their care; and stronger enforcement powers for the MHRA. Taken together with the Airlock findings, the direction of travel is clear: regulation of AI in healthcare is becoming something that runs alongside a device for its entire life, not a gate it passes through once.

The Forest 1 case study

PHARMExcel is currently managing a UK neuroscience research programme that shows why this matters for studies taking place long before any authorisation decision. Run in partnership with Barking, Havering and Redbridge University Hospitals NHS Trust and funded by the UK's Advanced Research and Invention Agency (ARIA), the programme is a feasibility and early-safety study of Forest 1, an ultrasonic neural interface and whole-brain computer interface developed by US-based Forest Neurotech. Forest 1 uses ultrasound to measure brain activity, rather than relying on the implanted electrodes typical of earlier brain-computer interface approaches. The study recruits participants who have previously undergone a decompressive craniectomy, as the resulting gap in the skull allows ultrasound to reach brain tissue that intact bone would otherwise block.

At its current stage of development and for the purposes of this study, Forest 1 is being used as a research tool rather than as a medical device within a regulated clinical investigation. The study therefore sits within a different regulatory and governance framework from a medical device clinical investigation. As the technology develops towards neuromodulation and potential therapeutic applications, its intended purpose, risk profile and regulatory requirements will change

As the contract research organisation managing the study, PHARMExcel supports the investigators and the Trust with its day-to-day delivery, including study set-up, approvals, participant safety monitoring and data quality. Because the current study is not being conducted as a regulated medical device clinical investigation, its oversight is shaped by research ethics review, Health Research Authority approval, NHS research governance and the sponsor's own quality processes.

What the 2026 reports mean for studies like Forest 1

The AI Airlock and the National Commission both focus on AI as a medical device, but the principles behind their findings apply more broadly to any novel device whose regulatory status is expected to change over the course of its development.

The first is that a change in function can matter as much as a change in technology. Forest 1 illustrates why intended purpose and function need to be considered early in development. A platform used initially to measure brain activity may have a very different risk and regulatory profile when developed towards neuromodulation and potential therapeutic use, even where much of the underlying technology remains the same. Recognising that early, rather than treating the later stage as a separate project, allows research to be planned with the next stage of development in view.

The second is that lifecycle thinking starts in research, not at market authorisation. If regulators expect validation studies to be designed with real-world deployment in mind, the earliest studies are where that design begins. For sponsors of experimental studies, that raises practical questions: which data collected now will still be useful once the device enters a regulated pathway, how design decisions and their rationale are documented, and how outcomes that are clinically meaningful, not just statistically significant, are defined from the outset. For a study like Forest 1, these are not abstract questions: the move from measuring to modulating is already anticipated, so the evidence gathered in the current phase sits at the start of a longer regulatory journey.

The third is that staged, supervised progression is already familiar territory in clinical research. The Commission's "L-plates" model describes new AI systems moving from tightly controlled use towards fuller authorisation. Novel devices in early research follow a comparable path, from experimental study to regulated investigation and, eventually, to authorisation, with the level of oversight changing at each step. The Commission's emphasis on continuous monitoring and on patients understanding how technology is used in their care also reflects questions that research teams deal with from the first participant onwards, through safety monitoring and informed consent.

In Conclusion

The 2026 publications make it clear that the most important regulatory questions for AI and other novel medical technologies are no longer only about whether a device is approved, but about how it is overseen before, during and after that point. For sponsors working at the earliest stages of development, that means considering the full lifecycle of a device from the first study onwards, and collaborating with research partners, such as CROs, who can support the generation of robust evidence for today’s research questions while anticipating the regulatory, clinical and operational requirements that may come next. PHARMExcel's work on Forest 1 is an example of that kind of early-stage research: a novel device, studied under the governance that fits its current status, with a regulatory pathway ahead of it.

Sources