What Happens When the Medical AI You Approved Keeps Changing?

On October 6, the UK government accepted all 44 recommendations of an independent commission whose central finding fits in one sentence: AI medical devices keep changing after they are approved, so approving them once is no longer enough. The Medicines and Healthcare products Regulatory Agency (MHRA) will now move from a single pre-market assessment to oversight that follows each AI tool across its working life, through every update and every round of retraining.

Anyone who has sat beside a parent while a doctor reads a scan knows the question that fills that moment. Can we trust what the screen is telling us? For most of modern medicine, the answer rested on a decision made long before the device reached the hospital, and that decision held because the device stayed the same. An AI model reading the same scan may have been retrained since its approval, and the family in that chair has no way of knowing.

Rules written for a slower world

Every institution that governs AI runs into the same structural problem, and I call it rules written for a slower world. Medical device regulation was designed, sensibly, for products that stay the way they shipped. A hip implant is tested and approved, then performs the same way for as long as it stays in the body, so a rigorous assessment at the front door was exactly the right design. AI-enabled devices broke that assumption. They receive software updates and get retrained on new data, which means the version a clinician uses in March can differ from the version that was assessed the previous summer.

What stands out in the UK response is that the institution named this problem in its own terms and then redesigned its process around it. The MHRA established the National Commission into the Regulation of AI in Healthcare itself, in September 2025, as an independent, non-statutory body chaired by Professor Alastair Denniston and led by NHS doctors. Over a year-long program, the commission engaged more than 12,000 patients, clinicians and members of the public. Its report was published on September 10, and less than a month later the government accepted every recommendation, across 10 priority areas.

Professor Henrietta Hughes OBE, the commission's deputy chair and Patient Safety Commissioner for England, put what those 12,000 people asked for in a single line:

"Patients have told us they want artificial intelligence that improves care without compromising safety."

What changes, and when

The core shift is from a one-time gate to a lifecycle. Staged authorization pathways, run through the MHRA's AI Airlock program, will let promising tools enter closely supervised NHS use earlier, with their performance tracked as they change. AI Airlock Phase 3 has 3 additional years of government funding secured. The government has also attached dates to the work, which is the detail I would point any policymaker to first.

Health Innovation Minister James Frith described the commitment plainly: "This will be a continually-evolving process as the technology itself develops." A rule that plans for its own revision is the kind of rule that can keep pace with what it governs.

Two features of this response deserve credit

The first is its reach across government. Alongside the MHRA and ministers in Westminster, health ministers in Wales, Scotland and Northern Ireland each issued statements supporting the direction, so every nation of the UK has put its name to the same approach. Patients and clinicians move across those borders, and agreement among four governments on something this technical takes patient, unglamorous work that rarely makes headlines.

Some technology companies have tried a private-sector version of this same instinct, building their own AI standards before any regulator required it. The MHRA's shift shows a government doing the harder version of the same thing, inside a process built on years of precedent.

The second feature worth crediting is that the MHRA changed its own method. In the book I am writing now, The Great Relearning, I describe the Relearning Organization as one that changes how it works when the thing it manages changes underneath it. We usually apply that idea to companies retraining their people. The MHRA has applied it to regulation itself, which is harder, because a regulator's methods are built into guidance and precedent that took years to settle.

A one-time approval asks whether a tool was safe. A lifecycle asks whether it still is.

In September, the US Food and Drug Administration asked the public for input on how to oversee AI medical devices that change after clearance, a question I wrote about at the time. Two governments are working the same structural problem through their own processes, and the overlap is useful evidence in itself: the challenge comes from the technology, whichever country is regulating it.

Where outside experience can help

I advise the California State University system on AI governance. The questions that take the most care in that work arrive after a tool has already been approved, when it changes and someone has to decide whether the earlier approval still holds. Healthcare carries higher stakes than a university does, yet the shape of the question is the same. The UK has now committed to answering it in public and on a schedule, with draft guidance on managing AI device changes due in December and a consultation on qualifying and classifying AI-enabled devices beginning in early 2027. Those are the stages where people who have managed software that keeps changing after release can help a deliberative body move quickly at the front end.

If you are a patient, or the person sitting beside one, you can ask a fair question today: when was this tool last updated, and who checked it afterward? The UK has just committed to building a system designed to have an answer.

For leaders outside healthcare, the same question travels well. Which AI tools did your organization approve last year that have changed since, and who is watching them now? Take that into your next leadership meeting. Britain's answer took a year and 12,000 voices, and yours can start with a single list. The family in that hospital chair deserves an answer that stays current, and so does everyone who relies on the tools you approve. If you see it differently, I'm easy to find.

Here is what makes Alex a credible voice on this topic: Alex advises the California State University system on AI governance, the same lifecycle question the MHRA is now answering for a tool that keeps changing after approval.

Talk with Alex about AI governance for your organization →