Regulated AI and software as a medical device

A medical device is any instrument, apparatus, appliance, software, implant, reagent, material or other article intended by the manufacturer to be used, alone or in combination, for human beings. For the purposes of UKCA marking, it is the UK Medical Device Regulations 2002 that must be followed for compliance. However, the UK does accept CE marked medical devices from the EU which are compliant with the EU MDR 2017/745.

“Where there is a medical purpose, check for the UKCA mark and if it is recommended by NICE for use.”

The Medical and Healthcare Products Regulatory Agency (MHRA) are responsible for classification and certification of medical devices in the UK. This includes Software as a Medial Device (SaMD) and AI as a Medical Device (AIaMD), both of which are subject to some secondary legislation that will adapt and expand the existing protocols for classification.

You can also access the MHRA Software flowchart.

The statutory instruments to solidify this are still in process, expected to be finalised in early 2026.

As this progresses, the MHRA have been busy testing how it will all work in collaboration with other key players. They are working with the Artificial Intelligence/Machine Learning-enabled, International Medical Device Regulators Forum.^xxxix Trying to remain as agile as possible, the MHRA have also produced policy principles on treating AI-powered products as medical devices under the existing framework.^xl

Further, they have launched the AI Airlock^xli which is an initiative working with industry and healthcare providers on pilots that sense test how regulation could and should work for various products that are likely to come to widespread use. Further, Innovate UK, in partnership with the MHRA, Office for Life Sciences and the Medical Research Council (MRC), have announced seven Centres of Excellence for Regulatory Science and Innovation (CERSIs).^xlii They have also been aligning more with NICE on their Evidence standards framework (ESF) for digital health technologies to ensure swift and trustworthy adoption of products into the NHS.

CE marks and classifications are important to understand if you are to trust a product with advanced algorithmic software or AI/Deep learning products. Firstly, you have to understand if the product in front of you meets the criteria for a medical device. To illustrate why this is important, there are many apps available that are medical adjacent, but are not making any key decisions for patient treatment, diagnosis or clinical advice.

Apps that monitor a condition and recommend when to take medication, or lay user “symptom checkers” can also be a grey area.

When a tool or product does qualify as a medical device there are established categories based on risk. To illustrate the general levels of risk applied to each category we have outlined these below with examples:

Class 1 Lowest risk eg BioAge (Toku Eyes) estimates biological age from retinal images - but doesn’t diagnose or inform treatment decisions.

Class 2a Medium risk eg iCare RETCAD analyses retinal images and highlights where it thinks there are abnormalities.

Class 2b Higher risk eg Medios AI (Remidio) provides offline screening of referable diabetic retinopathy. The autonomous decision making around referral places it in the higher category.

Class 3 Highest risk - no existing optometry/ophthalmology examples. This classification is reserved for where there is a risk to life or irreversible deterioration, for example an AI driven decision on whether to instigate emergency treatment.

A further pertinent consideration for optometrists is the group of “Compensation” devices where the manufacturer claims that symptoms of an injury or handicap can be mitigated. Crucially, the MHRA classification doesn’t include products that are intended for general use but can be used to compensate for specific injury or disability. With the key takeaway being that apps and software intended to magnify text for people with visual impairment should be MHRA registered.

In short, the classification of software and AI tools will follow the same fundamental structure as the general medical device regulations that a device's potential for harm to patients being the guiding principle.