---
title: "A change programme · and a sandbox. · AI SaMD Playbook"
description: "The MHRA's Software and AI as a Medical Device Change Programme is rewriting the UK's framework in flight. Rather than ship one omnibus regulation, the agency…"
lang: en
json-ld: |
  [
    {
      "@context": "https://schema.org",
      "@graph": [
        {
          "@type": "WebSite",
          "@id": "https://ai-samd.com/#website",
          "url": "https://ai-samd.com/",
          "name": "AI SaMD Playbook",
          "description": "Working reference for regulating AI/ML Software as a Medical Device: FDA, EU AI Act, MHRA, Health Canada and NMPA guidance, model risks, and cybersecurity for RA/QA teams.",
          "inLanguage": "en"
        },
        {
          "@type": "Organization",
          "name": "Blue Goat Cyber",
          "url": "https://bluegoatcyber.com"
        }
      ]
    },
    [
      {
        "@context": "https://schema.org",
        "@type": "BreadcrumbList",
        "itemListElement": [
          {
            "@type": "ListItem",
            "position": 1,
            "name": "Home",
            "item": "https://ai-samd.lovable.app/"
          },
          {
            "@type": "ListItem",
            "position": 2,
            "name": "Crosswalk",
            "item": "https://ai-samd.lovable.app/crosswalk"
          },
          {
            "@type": "ListItem",
            "position": 3,
            "name": "A change programme · and a sandbox.",
            "item": "https://ai-samd.lovable.app/regulators/mhra"
          }
        ]
      },
      {
        "@context": "https://schema.org",
        "@type": "Article",
        "headline": "A change programme · and a sandbox.",
        "description": "The MHRA's Software and AI as a Medical Device Change Programme is rewriting the UK's framework in flight. Rather than ship one omnibus regulation, the agency is publishing targeted guidance, running the AI Airlock regulatory sandbox, and aligning with FDA, Health Canada, and IMDRF on shared principles.",
        "about": "United Kingdom · Medicines and Healthcare products Regulatory Agency",
        "mainEntityOfPage": "https://ai-samd.lovable.app/regulators/mhra",
        "publisher": {
          "@type": "Organization",
          "name": "Blue Goat Cyber",
          "url": "https://bluegoatcyber.com"
        }
      }
    ]
  ]
---

[AI SaMD Playbook ](/)

Sections[Crosswalk](/#crosswalk)Tools

Search Ctrl K[Talk to us →](https://go.bluegoatcyber.com/meetings/blue-goat-cyber/discovery-session)

[← Back to crosswalk](/#crosswalk)

MHRA

United Kingdom · Medicines and Healthcare products Regulatory Agency

# A change programme · and a sandbox.

The MHRA's Software and AI as a Medical Device Change Programme is rewriting the UK's framework in flight. Rather than ship one omnibus regulation, the agency is publishing targeted guidance, running the AI Airlock regulatory sandbox, and aligning with FDA, Health Canada, and IMDRF on shared principles.

Posture · Advanced · pragmatic, iterative, sandbox-first Last reviewed · April 2026 

Key facts

AI Airlock Phase 2 cohort

2025–26

Roadmap workstreams

11

Aligned with

FDA · HC · IMDRF

UKCA / CE acceptance

Until 2030

§01

## The Change Programme

The Programme runs eleven workstreams covering qualification, classification, premarket, post-market, cybersecurity, and AI-specific transparency. It is iterative · each workstream produces guidance that can be applied without waiting for the others to finish.

-   Qualification & classification · when software is a device, and how it lands in a class. 
-   Pre-market · clinical evaluation and best practice for AI-enabled SaMD. 
-   Post-market · vigilance, surveillance, and managing change for adaptive systems. 
-   Cybersecurity · aligned with NHS DTAC and broader UK cyber expectations. 

§02

## AI Airlock · the regulatory sandbox

The AI Airlock pairs the MHRA with manufacturers, approved bodies, and the NHS to test how novel AI medical devices can be safely regulated. The pilot ran Apr 2024–Mar 2025; the Pilot Programme Report was published 16 October 2025, and a Phase 2 cohort is now running through 2025–26. It is the closest thing in any major jurisdiction to a live conversation between developers and the regulator before product launch.

§03

## Transparency and the clinician

MHRA guidance on transparency centres on the user · what does a clinician need to know to use an AI output safely? The bar is rising for intended-use statements, performance by subgroup, known limitations, and the human oversight model.

§04

## Cybersecurity

The MHRA aligns with IMDRF principles on medical device cybersecurity and expects manufacturers to manage threat models, SBOMs, vulnerability disclosure, and post-market patching. Devices used inside the NHS additionally face DTAC and CE/UKCA evidence requirements.

Key takeaways

1.  01 Track the Programme workstreams individually; guidance lands on a rolling basis. 
2.  02 Consider AI Airlock for genuinely novel adaptive AI · feedback now beats deficiency later. 
3.  03 Treat NHS DTAC as a de facto deployment gate, not just procurement paperwork. 
4.  04 Lean into FDA/HC alignment · most of your evidence base will travel. 

References

-   [Software and AI as a Medical Device Change Programme ↗](https://www.gov.uk/government/publications/software-and-ai-as-a-medical-device-change-programme)
-   [AI Airlock collection (updated Oct 2025) ↗](https://www.gov.uk/government/collections/ai-airlock-the-regulatory-sandbox-for-aiamd)
-   [AI Airlock Sandbox Pilot Programme Report (Oct 2025) ↗](https://www.gov.uk/government/publications/ai-airlock-sandbox-pilot-programme-report)
-   [AI Airlock Phase 2 cohort ↗](https://www.gov.uk/government/publications/ai-airlock-phase-2-cohort/ai-airlock-phase-2-cohort)

[

← Previous

EU AI Act × MDR

](/regulators/eu-ai-act)[

Next →

Canada · Health Canada

](/regulators/health-canada)

© 2026 AI SaMD Playbook · Sponsored by Blue Goat Cyber

[Crosswalk](/crosswalk)[Colophon](/colophon)

Editorial reference only. Not legal or regulatory advice.