RCP's AI Healthcare Safety Framework Shapes MHRA Regulation

On 10 March 2026, the Royal College of Physicians (RCP) submitted a comprehensive response to the Medicines and Healthcare products Regulatory Agency (MHRA) consultation on artificial intelligence in healthcare. This submission marks a critical moment in UK AI governance, establishing clinical standards and risk frameworks that will directly influence how NHS trusts, private providers, and healthtech vendors implement AI across diagnosis, treatment planning, and patient monitoring.

The RCP's engagement reflects growing urgency in UK healthcare leadership circles. As AI adoption accelerates across radiology, pathology, primary care, and hospital operations, clinicians and CAIOs in health organisations face a regulatory vacuum. The MHRA consultation—the first formal attempt to establish binding AI governance for UK healthcare—arrives at a pivotal juncture: NHS digital transformation strategies demand agile AI deployment, yet patient safety and ethical accountability require robust standards.

This article examines the RCP's position, the regulatory landscape it shapes, and implications for chief technology leaders managing AI integration in UK health systems.

The MHRA Consultation: Context and Scope

The MHRA's consultation on AI in healthcare emerged from recommendations by the UK AI Safety Institute, established in 2023 to coordinate AI safety across sectors. Unlike the EU AI Act's sector-agnostic approach, the MHRA framework targets clinical AI specifically—algorithms used in diagnosis, prognosis, treatment selection, and patient monitoring where errors carry direct harm risk.

The consultation period ran through early March 2026, attracting responses from the RCP, British Medical Association (BMA), National Institute for Health and Care Research (NIHR), Royal College of Radiologists, NHS England digital teams, and major healthtech vendors including DeepMind Health, Kheiron Medical Technologies, and Hardian Health. The MHRA's stated intent is to publish draft guidance by Q3 2026, with binding regulatory pathways operational by 2027.

This timeline aligns with NHS England's AI Implementation Framework, which commits all integrated care boards to AI governance policies by end-2026. For CAIOs and health informatics leaders, the convergence of MHRA, NHS digital policy, and institutional risk frameworks creates both pressure and opportunity to embed safety-first AI cultures.

RCP's Core Position: Clinical Evidence and Transparency Standards

The RCP's response, developed by its AI in Healthcare Working Group and endorsed by council, centres on four key principles:

• Clinical Evidence Requirements: The RCP argues that AI tools used in NHS and private practice must meet evidence standards equivalent to pharmacological or surgical interventions. This means randomised controlled trials (RCTs) or prospective cohort studies demonstrating superior or non-inferior performance versus clinician baseline, with stratified analysis by patient demographics, comorbidities, and healthcare settings. The college specifically rejected industry-led validation studies without independent verification, citing failures in previous algorithmic systems that showed bias in deployment.
• Transparency and Explainability: Building on the Information Commissioner's Office (ICO) guidance on AI and the Alan Turing Institute's explainability frameworks, the RCP demands that AI systems deployed in clinical settings must provide clinicians with interpretable outputs. This isn't purely technical—it's clinical epistemology. Radiologists, pathologists, and GPs need to understand *why* an algorithm recommends a diagnosis or treatment, not just accept a confidence score. The RCP specifically flagged risks of "AI abdication," where clinicians over-rely on algorithmic recommendations without critical appraisal.
• Equity and Bias Auditing: The college highlighted documented disparities in AI performance across ethnic groups, age cohorts, and healthcare contexts. It called for mandatory bias audits before deployment and ongoing monitoring post-launch, with public reporting of performance metrics disaggregated by protected characteristics. This reflects broader UK AI governance trends—the UK AI Safety Institute's 2025 report on algorithmic bias in healthcare identified 47 deployed systems with unquantified performance gaps by ethnicity.
• Clinician-in-the-Loop Governance: Rather than centralised regulatory sign-off (MHRA model), the RCP advocates for institutional accountability. Each NHS trust, ICB, and private provider should establish clinical AI governance committees combining clinical leadership (including critical voices), medical directors, information security, and patient representatives. This committee should approve AI implementations, conduct quarterly audits, and have authority to withdraw tools from clinical use.

These positions matter operationally. They mean a healthcare CIO or chief digital officer implementing an AI diagnostic tool cannot simply purchase a vendor solution, integrate it into electronic health records, and expect compliance. Instead, they must commission or conduct validation studies, document performance across patient subgroups, design clinician training that emphasises critical appraisal (not automation bias), and establish governance committees with veto power over deployments.

Regulatory Implications: MHRA Framework and NHS Compliance Pathways

The MHRA's emerging framework, informed by the RCP and other stakeholders, is likely to establish a tiered regulatory model:

Tier 1: High-Risk Tools (Regulatory Approval) — Algorithms directly supporting clinical diagnosis or treatment decisions in critical conditions (oncology, cardiology, acute medicine) would require MHRA pre-market review similar to medical device approval. This means dossier submission, risk analysis, clinical data, and post-approval surveillance. Estimated timeline: 6–12 months for MHRA assessment. Cost: £200,000–£500,000 per submission.

Tier 2: Moderate-Risk Tools (NHS Digital Governance) — Algorithms supporting clinician workflows or patient monitoring in non-critical contexts (primary care decision support, administrative triage) would be approved at NHS trust/ICB level, subject to MHRA-issued guidance on validation standards, bias auditing, and clinician training. This allows faster deployment while maintaining accountability. Estimated timeline: 2–4 months via institutional committees. Cost: £20,000–£100,000 internal governance investment.

Tier 3: Low-Risk Tools (Institutional Discretion) — Administrative, operational, or research-phase algorithms would remain institutional decisions, though vendors would be expected to publish performance data publicly.

The RCP's response directly shapes Tier 1 and 2 criteria. Its emphasis on clinical evidence equivalence and explainability will likely become mandatory MHRA requirements, raising barriers to entry for vendors without robust validation datasets. For NHS CAIOs, this creates strategic clarity: algorithms deployed in critical care pathways require substantial upfront validation investment and rigorous governance before clinical use.

NHS Digital Transformation and AI Integration Strategy

The RCP consultation response arrives amid accelerating AI adoption in the NHS. Current deployments include:

• Breast cancer screening AI (Kheiron's mamma AI, deployed in 150+ screening centres)
• Pathology image analysis (Hardian Health's colorectal cancer histology tool, piloted in 15 NHS trusts)
• Radiology reporting support (various vendors in major teaching hospitals)
• Primary care administrative AI (appointment scheduling, notes summarisation)
• Hospital operations (bed management, predictive analytics for admissions)

However, deployment remains fragmented. NHS England's 2025 survey found that only 42% of trusts had formal AI governance policies, and only 28% had conducted bias audits on deployed systems. The lack of clear regulatory frameworks has created a patchwork: some trusts demand rigorous validation, others pilot tools with minimal evidence.

The MHRA-RCP framework will consolidate this. NHS England's digital teams are already preparing Department for Science, Innovation and Technology (DSIT) guidance aligning MHRA requirements with integrated care board (ICB) procurement standards. From 2027, any AI tool procured by NHS organisations for clinical use will face standardised evidence and governance requirements.

For healthcare technology leaders, the implications are profound:

• Validation Investment: Building or acquiring AI tools requires clinical validation studies, not just technical performance metrics. Healthcare vendors must budget 18–24 months and £500,000–£2 million for RCT-quality evidence on clinical tools.
• Explainability Design: "Black box" algorithms will face deployment barriers. Design for clinician interpretability from inception, not as a compliance afterthought.
• Bias Auditing Infrastructure: Establish processes to measure algorithm performance across patient demographics before and after deployment. This requires diverse validation datasets and ongoing monitoring frameworks.
• Governance Committees: Create or strengthen clinical AI governance structures at trust/ICB level. Ensure these committees include clinical sceptics, not just AI enthusiasts.
• Procurement Standards: Align vendor selection with MHRA-RCP frameworks. Demand evidence dossiers, bias audit reports, and explainability documentation as procurement prerequisites.

RCP Risk Framework: Clinical, Ethical, and Operational Dimensions

The RCP's consultation response identifies specific risks requiring regulatory and institutional controls:

Clinical Safety Risks: Algorithms trained on historical NHS data may perpetuate clinical biases (e.g., cardiovascular disease underdiagnosis in women, reflective of historical underrepresentation in training datasets). The RCP calls for mandatory comparison studies demonstrating algorithm performance in populations historically underserved. It also flags risks of algorithm failure modes in edge cases—rare presentations, atypical comorbidities, medication interactions—that may not appear in training data but occur regularly in clinical practice. Regulatory requirement: pre-market analysis of failure modes and clinician protocols for recognising and managing them.

Automation Bias and Deskilling: Clinicians may over-trust algorithmic recommendations, reducing critical appraisal. The RCP emphasises training that positions algorithms as decision support, not decision makers. It also flags deskilling risks: junior clinicians trained entirely with AI assistance may lack foundational diagnostic reasoning. Regulatory requirement: institutional policies mandating clinician review of all algorithmic recommendations and training standards preventing excessive reliance.

Data Governance and Patient Privacy: AI tools require large datasets for validation and training. The RCP endorses federated learning approaches (training algorithms across decentralised NHS datasets without centralising patient data) and calls for patient consent frameworks and transparent data use policies. This aligns with ICO UK GDPR guidance on AI and NHS digital data governance frameworks.

Equity and Access: AI tools optimised for tertiary care environments may perform poorly in primary care or resource-constrained settings. The RCP calls for equity impact assessments before deployment and tailored training for diverse healthcare contexts. This is critical for NHS inclusivity—ensuring AI benefits reach all patient populations, not just those in well-resourced teaching hospitals.

Regulatory Accountability: Currently, responsibility for AI outcomes is ambiguous. Is it the vendor, the NHS trust, the clinician, or a combination? The RCP's response clarifies this: vendors bear responsibility for pre-market validation and safety documentation; NHS trusts and clinicians bear responsibility for appropriate deployment, clinician training, and governance oversight. The MHRA provides the regulatory framework, but enforcement falls on NHS trusts and professional bodies.

Sector-Specific Implementation: Radiology, Pathology, and Primary Care

The RCP's framework applies across clinical domains, but implementation varies:

Diagnostic Imaging (Radiology and Pathology): These specialties have strongest evidence for AI tools. Algorithms trained on thousands of imaging studies and pathology slides show performance metrics comparable to experienced clinicians. Here, the regulatory focus is on transparency (explaining which image features drive algorithmic recommendations), bias auditing (ensuring performance consistency across imaging modalities, patient populations, and equipment types), and integration workflows (ensuring radiologists and pathologists critically review algorithmic outputs, not merely confirm them). The Royal College of Radiologists' parallel consultation response emphasises that AI tools should enhance radiologist productivity and diagnostic confidence, not replace radiological expertise. Regulatory model: Tier 1 for screening algorithms (high-volume, high-stakes); Tier 2 for diagnostic support in tertiary care.

Primary Care and General Practice: Here, AI applications are broader—appointment scheduling, notes summarisation, risk stratification for chronic disease management, symptom triage. Clinical evidence is weaker; many tools lack RCT validation. The RCP emphasises that primary care governance must be robust but pragmatic. GP practices often lack dedicated IT governance teams, so the framework relies on ICB support for validation, bias auditing, and clinician training. Regulatory model: Mostly Tier 2, with Tier 1 only for high-risk applications (e.g., antibiotic prescribing recommendations). Governance burden on ICBs, not individual practices.

Acute Medicine and Hospital Operations: AI tools for bed management, predicted patient deterioration, and treatment recommendations require rigorous validation but face faster pathway to deployment if evidence is strong. The RCP emphasises that hospital medicine differs from imaging—algorithms operate in higher-stakes, more heterogeneous environments where patient comorbidities and acute presentations vary widely. Regulatory model: Tier 1 for treatment recommendation algorithms; Tier 2 for operational optimisation.

Forward-Looking Analysis: MHRA Implementation and Strategic Priorities

The MHRA is expected to publish draft guidance by July 2026, with final regulatory pathways operational by early 2027. Based on the RCP's submission and broader UK AI governance trends, several developments are likely:

Regulatory Alignment with EU AI Act: Although the UK is not bound by the EU AI Act, MHRA requirements will likely converge on high-risk classification criteria and conformity assessment processes. This allows vendors and healthcare systems to meet both frameworks simultaneously, reducing compliance fragmentation. For international healthtech companies, this is commercially important—designing single validation and governance processes that satisfy MHRA, MDCG (Medical Device Coordination Group), and EU frameworks.

Mandatory Post-Market Surveillance: The RCP's response supports ongoing monitoring of deployed algorithms for performance drift, bias emergence, and clinical safety signals. The MHRA is likely to mandate vendor-led surveillance registries and NHS trust reporting of adverse events or performance concerns. This creates new compliance infrastructure: healthcare systems must establish internal data pipelines to monitor algorithm performance, trigger retraining or withdrawal if issues emerge, and report to MHRA. Cost implication: ongoing investment in monitoring infrastructure, not one-time validation.

Clinical Evidence Standards Publication: The MHRA will likely publish specific guidance on RCT design for AI clinical validation, bias audit methodologies, and explainability assessment frameworks. This standardisation will accelerate vendor investment in validation infrastructure and reduce variation in approval timelines.

Procurement and NHS Contracting Evolution: NHS England's procurement framework will align with MHRA guidance. By 2027, trusts will be contractually required to procure AI tools only from vendors who meet MHRA evidence standards. This creates market consolidation: vendors without validation infrastructure or evidence dossiers will struggle to win NHS contracts. Established vendors (Kheiron, Hardian, DeepMind Health) have institutional validation capabilities; smaller innovators will need to partner with research institutions or secure venture capital for validation investment.

Professional Development and Clinician Training: The RCP's emphasis on clinician-in-the-loop governance will drive professional education. Medical schools, postgraduate training programmes, and continuing professional development (CPD) will increasingly cover AI literacy, critical appraisal of algorithmic outputs, and governance responsibilities. This is not yet standardised; expect evolution of competency frameworks over 2026–2027.

Patient Engagement and Transparency: Currently, patient perspectives on AI in healthcare are underrepresented in regulatory discussions. The RCP's governance framework emphasises patient involvement in institutional AI committees. Expect growing patient advocacy campaigns demanding transparency about AI use in their care and rights to opt out or request clinician-only evaluation.

Strategic Priorities for Health Technology Leaders

For CAIOs, chief digital officers, and health informatics leaders, the RCP-MHRA framework creates immediate strategic imperatives:

1. Audit Current AI Implementations: Review all deployed algorithms against emerging MHRA-RCP criteria. Identify gaps in clinical validation, bias auditing, clinician training, and governance oversight. Plan remediation timelines aligned with 2027 regulatory deadlines.
2. Establish Clinical AI Governance Committees: If not already in place, create multidisciplinary committees with clinical leadership, medical directors, information security, patient representatives, and at least one designated clinical sceptic. Meet quarterly to review new AI implementations and monitor deployed systems.
3. Commission Validation Studies: For high-priority algorithms (diagnostic support, treatment recommendations), commission independent validation studies or partner with research institutions. Budget 18–24 months and £500,000–£2 million for rigorous evidence generation.
4. Design for Explainability: Establish requirements for algorithm interpretability in vendor selection and system design. Prioritise tools that can explain key decision factors to clinicians, not just provide predictions.
5. Implement Bias Monitoring Infrastructure: Build data pipelines to assess algorithm performance across patient demographics, treatment settings, and clinical contexts. Establish thresholds for performance variation that trigger investigation or algorithm retraining.
6. Align Procurement Standards: Update vendor selection criteria to require MHRA-compliant evidence dossiers, bias audit reports, explainability documentation, and post-market surveillance plans. Expect contracts to include performance guarantees and adverse event reporting obligations.
7. Invest in Clinician Training: Develop training programmes that position AI as decision support, emphasise critical appraisal, and establish protocols for recognising algorithm failures or edge cases. This is not IT training; it's clinical competency development.

Conclusion: A Critical Moment for UK Healthcare AI Governance

The RCP's response to the MHRA consultation represents a watershed moment for UK healthcare AI governance. By articulating clinical evidence standards, transparency requirements, and institutional accountability frameworks, the RCP has effectively shaped regulatory direction and set expectations for healthcare technology leaders across the NHS and private sector.

The emerging regulatory landscape—tiered by risk, grounded in clinical epistemology, and enforced through institutional governance—reflects a maturation of UK AI safety thinking. It moves beyond generic algorithmic governance (EU AI Act) toward clinical specificity, recognising that healthcare AI operates in high-stakes environments where evidence standards, bias auditing, and clinician autonomy directly affect patient safety.

For healthcare CAIOs and digital leaders, this creates both challenge and opportunity. The challenge: validating, auditing, and governing AI tools to MHRA-RCP standards requires substantial investment in evidence generation, governance infrastructure, and clinician engagement. The opportunity: organisations that embrace these standards early will build clinical credibility, reduce deployment risks, and position themselves to rapidly scale evidence-backed AI applications once regulatory pathways are finalised in 2027.

The months ahead—Q2–Q3 2026—will be critical for aligning internal AI governance, validation practices, and procurement standards with emerging MHRA guidance. Healthcare organisations acting now will be well positioned for compliance. Those delaying will face regulatory pressure and procurement constraints by late 2026.

The RCP has set a high bar. The MHRA will likely codify it. The question for healthcare leaders now is: are your organisations ready?