Exploring the future of Medical Device regulation with the MHRA’s AI Airlock

Exploring the future of Medical Device regulation with the MHRA’s AI Airlock

How can AI medical devices be improved at pace, while maintaining patient safety?

With the AI Airlock programme, we applied new regulatory ideas to a Large Language Model (LLM) AI tool to explore how future regulation could allow more frequent and rapid updates to medical devices.

Designing updates in advance

The MHRA launched the AI Airlock programme in 2024 to explore regulatory challenges around AI-enabled medical devices. By providing a safe space and hosting scenario-based workshops, the programme tests new ideas and addresses regulatory challenges to ensure that regulation and innovation come hand-in-hand. In addition, candidates like NHS England provide a virtual testing environment where potential solutions can also be tested.

One such emerging challenge is that of implementing pre-determined change control plans - PCCPs. PCCPs are intended to allow manufacturers to make pre-defined software changes to improve device performance and safety, without needing to seek regulatory approval each time. Aligning with the MHRA’s 5 guiding principles, a PCCP describes:

• What scope of changes can be made within the PCCP;
• How these changes will be implemented safely;
• And an impact assessment including the benefits of the changes.

PCCPs are a recent concept developed by the Food and Drugs Administration (FDA) in the US and are intended to be introduced to the UK in upcoming changes to MRHA regulation for medical devices. The goal is that PCCPs will provide a mechanism for rapid innovation while maintaining device safety and performance.

Whilst the utility of PCCPs is clear, their introduction will raise significant questions. Namely, how can we design them to make sure that they effectively balance allowing meaningful changes without compromising safety?

Using AI for summarisation

Over the past few years, Large Language Model (LLM) AI products such as ChatGPT, Claude, and Copilot have become increasingly popular in day-to-day use. They can process and ‘understand’ large amounts of text in a short time and generate new text in response, for example searching the internet and providing an answer that considers different sources of information, or writing a summary of meeting notes and actions.

Harnessing this type of technology in healthcare settings could potentially save time for NHS staff, whether it’s GPs using transcribing tools to summarise conversations with patients, or helping hospital staff to write summaries of patient care. Some of these products may meet the definition of a medical device, and such products would require additional safeguards subject to medical device regulation.

Safe summarisation as a test case

This work was conducted using synthetic data and pre-trained models, with no patient data being used for model training or testing, and all testing took place within the AI Airlock’s testing environment.

To explore how this might work in healthcare, we used an LLM-based summarisation tool as a test case for how PCCPs can be designed and monitored to enable effective change management, in the AI Airlock’s testing environment.

For example, could the scope for a PCCP include swapping out the LLM for an updated version (such as upgrading from Claude 3.7 to 4.6), or updating the prompts given to the LLM?

Another aspect of medical device regulation is post-market surveillance (PMS), the gathering of data on how a device is performing. It’s a critical part of ensuring that medical devices are, and remain, safe. While exploring PCCPs, we also looked at how PMS could be used to both trigger pre-determined changes and then make sure that the tool is still working as intended and meeting safety requirements after an update is rolled out.

Through scenario-based testing we demonstrated that when deployed together, PMS processes and PCCPs can be an effective combined mechanism for monitoring and managing changes to AI medical devices. Well-designed PCCPs, informed by PMS, could provide manufacturers with a pre-authorised pathway for anticipated maintenance activities, such as addressing semantic drift or model degradation, with confidence that the changes will remain within the regulatory boundaries established at the time of approval. With PMS used to both trigger and evaluate changes, it goes from being a reactive monitoring tool to an effective active control measure.

This is provided that the PCCP includes robust methods and acceptance criteria to effectively compare performance before and after changes are made, and that there is confidence in the PMS signals used to inform how changes are planned for implementation.

With a key stipulation being that changes made under PCCPs must maintain the device within its intended use, this new mechanism may become an effective part of maintenance and safety updates. PCCPs will require tight definitions and clear boundaries to mark which changes are in scope and which would require a new regulatory submission.

The AI Airlock programme provided valuable insight into how future regulatory frameworks could enable faster, safer iteration of AI medical devices, supporting innovation while maintaining high standards of patient safety. The Phase 2 Programme Report can be found on the MHRA website.

These lessons will help shape how AI tools developed and deployed in the NHS are monitored, updated and governed over time.