The UK Will Regulate AI Devices for Life. Hire for the Model After Launch

The UK has decided that an AI medical device is not finished when it is approved. On 6 October 2026 the government accepted all 44 recommendations of the National Commission into the Regulation of AI in Healthcare, and the direction is plain: less weight on the one-off pre-market assessment, more on watching how a model performs for as long as it is in use. If you run a healthcare-AI company, that turns post-launch model performance into something a named person answers for. Most first Head of AI job descriptions I see do not mention it. Before you hire, decide who owns the model after launch, and write that into the brief.

Key takeaways

• On 6 October 2026 the UK government accepted all 44 recommendations of the MHRA-convened National Commission into the Regulation of AI in Healthcare, committing to a lifecycle-based approach to AI medical devices.
• Nothing changes in law today: the MHRA plans draft guidance on predetermined change control plans by December 2026 and an implementation roadmap by spring 2027.
• The US and EU are moving the same way, through the FDA’s final guidance on change control plans and the EU AI Act’s post-market monitoring duty.
• Well-documented hospital cases show why: a widely used sepsis model performed far below its developer’s figures in one health system and had to be switched off in another.
• The leader you hire next should be judged on how they run a model after launch, not only on how they build one.

What the UK actually decided

The commission was set up by the Medicines and Healthcare products Regulatory Agency (MHRA) in September 2025, chaired by Professor Alastair Denniston, and reported on 10 September 2026 after gathering evidence from more than 12,000 people (MHRA press release, 10 September 2026). Its central proposal is staged authorisation: a new model goes into use under close supervision and tight guardrails, and earns fuller authorisation as it shows real-world safety. The MHRA’s own comparison is with learner-driver L-plates.

The government’s response, published on 6 October, accepts every recommendation. In the ministerial foreword, James Frith MP writes that ‘the UK needs a new approach to AI product regulation in healthcare that is proportionate, risk and lifecycle based’ (Government response, MHRA, 6 October 2026). Five commitments matter most to a company building AI products:

• Change control. The MHRA will issue draft guidance on predetermined change control plans, which let a manufacturer agree in advance how a model may change, by December 2026 (recommendation 6).
• Post-market surveillance. The agency will build on its existing surveillance requirements with a toolkit for ongoing oversight (recommendation 17).
• Dependencies. Manufacturers will be told what to report about the general-purpose models their products are built on (recommendation 8).
• Traceability. Guidance will cover mandatory unique device identifiers, so each version can be traced (recommendation 20).
• Enforcement. The MHRA will look at stronger enforcement, including civil sanctions that would allow financial penalties (recommendation 22).

Most of these carry the same timeline: ‘further details to be shared by Spring 2027’. Reuters reported that a draft implementation plan is expected by the end of 2026, and that the MHRA will open a third phase of its AI Airlock sandbox focused on post-market surveillance (Reuters, 6 October 2026). The MHRA’s chief executive, Lawrence Tallon, told Reuters: ‘We’re moving into a much more sophisticated and complex era of AI as a medical device.’

So this is a direction of travel rather than a rulebook. What it means for any particular product is a question for counsel. What it means for hiring is clearer, and you can act on it now.

Why running a model is a job, not a feature

The case for lifecycle regulation rests on a problem that hospitals have already lived through. In 2021 researchers at Michigan Medicine tested the Epic Sepsis Model, one of the most widely deployed clinical prediction tools in the US, on 38,455 hospitalisations. It achieved an area under the curve of 0.63, against 0.76–0.83 in the developer’s documentation, and at its alert threshold it missed 67% of sepsis cases while flagging 18% of all hospitalisations (Wong et al., JAMA Internal Medicine, June 2021). The authors put part of the gap down to how prediction timing was measured, which is itself the point: how a model is evaluated after launch decides what anyone believes about it.

Then the patient population changed. In April 2020 the University of Michigan hospital switched the same model off because pandemic-related shifts in patient characteristics produced spurious alerts (Finlayson et al., New England Journal of Medicine, July 2021). Across 24 US hospitals, daily sepsis alerts rose 43% in the early pandemic while the hospital census fell 35% (Michigan Medicine on a JAMA Network Open study, December 2021). The Finlayson letter, cited more than 800 times according to OpenAlex, recommends that organisations ‘establish a governance committee with multidisciplinary expertise in the AI system and how it will be used clinically’.

These are US hospital examples of a vendor model in clinical use, not a start-up’s regulated device, so treat them as an illustration of the mechanism rather than a forecast for your product. The mechanism is the same, though. Patients, workflows and upstream data change after launch, and somebody has to notice, decide and act. Under staged authorisation in the UK, noticing and acting will also be how a product earns its way from L-plates to a full licence.

The US and EU are heading the same way

If you sell in more than one market, this is not a UK quirk to plan around separately. The FDA finalised its guidance on predetermined change control plans for AI-enabled device software on 4 December 2024; a plan sets out the modifications a manufacturer intends, the protocol for making them and an assessment of their impact (FDA CDRH webinar transcript on the final PCCP guidance, January 2025). In September 2025 the FDA asked for public comment on how to measure and evaluate AI-enabled device performance in the real world, including how sponsors detect and respond to data drift (FDA docket FDA-2025-N-4203, 30 September 2025).

In the EU, Article 72 of the AI Act requires providers of high-risk AI systems to ‘establish and document a post-market monitoring system’ that collects and analyses performance data throughout the system’s lifetime (Regulation (EU) 2024/1689, Article 72). For AI built into medical devices, those obligations now apply from August 2028, as we set out in our analysis of the EU AI Act deadline change. And Great Britain’s strengthened post-market surveillance rules for all medical devices have applied since 16 June 2025 (MHRA, 15 January 2025).

The instruments differ, but each regulator expects the manufacturer to be able to show how its model is performing in use and what it will do when performance moves.

What this changes in the job description

Most first Head of AI briefs I am shown describe building: a team, a platform, a first model, a roadmap. The UK response adds a set of duties that are about running. My reading of what the role now has to cover, which is inference from the commitments above rather than anything the MHRA has prescribed, is this:

• Performance monitoring. Choosing the metrics that show whether the model is still safe and effective in use, and the thresholds that trigger review.
• Change control. Writing and keeping to a change control plan that the regulator can agree in advance, so that retraining does not mean a new submission every time.
• Dependency management. Knowing exactly which foundation or third-party models sit underneath the product and what happens when one of them changes.
• Version traceability and incidents. Being able to say which version a patient’s result came from, and working with your regulatory lead when something goes wrong.

Not all of that belongs to one person. Your quality and regulatory lead owns the submission and the incident reporting. But the technical judgement about whether a model has drifted, and what to do about it, sits with whoever leads AI. If the brief does not say so, you will hire someone who is excellent at the first year and unprepared for the second.

Ownership needs settling before the search starts, too. In building a healthcare AI leadership team we looked at sequencing the roles; the new rules add a question to that sequence. If your CTO, your Head of AI and your regulatory lead each assume one of the others owns post-launch performance, nobody does.

Where to look for this person

The obvious pool is people who already lead AI at healthcare companies, and some of them have run models in production under a quality system. Many have not. A strong research leader may have taken models to a clinical validation study and handed them over. This is the same gap between pilot and production we described in hiring the leaders who operationalise AI, with a regulator now watching the second half.

In my judgement, three adjacent pools are worth searching. The first is machine learning operations leaders who have run models in other regulated settings, where monitoring and audit trails were already expected; we describe that market on our MLOps and ML engineering page. The second is AI governance and assurance specialists, who know how to turn a monitoring duty into a process; see our AI governance and responsible AI page. The third is medical-device software leaders who have shipped under a quality management system and have since moved into machine learning. None of these is a perfect fit on its own, which is why the brief has to say which gaps you will cover with other hires and which you will not.

The interview question I would add is simple: tell me about a model you had to retrain, roll back or switch off after launch, and how you knew. Candidates who have only built models tend to answer with a story about the build.

What to do this quarter

1. Name the owner. Write down who owns post-launch model performance today, and get your CTO, Head of AI (or the person acting as one) and regulatory lead to agree it in writing.
2. Rewrite the brief. Add monitoring, change control and dependency management to the role description before you brief anyone, including us.
3. Test for running, not just building. Use the retrain-or-switch-off question with every finalist, and ask for a specific model, metric and decision.
4. Diary the dates. Draft UK guidance on change control plans is due by December 2026 and the implementation roadmap by spring 2027. If you are building a device, ask your regulatory adviser whether phase 3 of the AI Airlock suits you.
5. Take advice on your product. Whether staged authorisation or the new surveillance toolkit applies to a given product is a question for counsel or a regulatory consultant, not for a recruiter.

For how we run a senior mandate, see our executive search approach. For the team-design questions behind the hire, see what Every Cure teaches about building healthcare AI teams.

Fergal Nolan is the founder of Banba, a specialist executive search firm for Healthcare AI and Life Sciences AI, with offices in New York, London and Berlin. He has spent more than 25 years in talent acquisition, including as a founding team member at SThree / Real Staffing and as founder of Upstream, where he has built Data Science & AI teams and AI leaders for start-ups, scale-ups and global enterprises.