MHRA AI Airlock Phase 2: Seven AIaMD Evidence Case Studies

MHRA AI Airlock Phase 2, the Medicines and Healthcare products Regulatory Agency (MHRA) sandbox programme, examined seven artificial intelligence (AI) technologies across three regulatory challenges: intended-purpose scope and validation, performance evaluation for AI-powered in vitro diagnostics (IVDs), and predetermined change control plans (PCCPs) with post-market surveillance (PMS). (^[1]) Selected from 51 applicants, the cases form a specialist learning portfolio, not a representative survey of AI medical-device performance. (^[2]) The programme publication was updated on 27 July 2026 and explicitly states that the report is not formal MHRA guidance. (^[3])

The useful output for developers is a product-to-evidence blueprint. Ambient documentation and conversational support raise scope and output-control questions; digital pathology raises comparator, specimen and laboratory questions; summarisation, rare-disease assessment and skin-image applications raise update and monitoring questions. Evidence strength must be labelled accurately. The candidate reports are innovator-authored perspectives, and a multi-environment allocation does not establish live clinical validation. (^[4]) Proposed validation packages should identify the claim, reference data, clinical metric, human review arrangement and release decision.

Later formal guidance changes how historical scope discussions should be interpreted. MHRA's 29 July 2026 ambient voice technology (AVT) guidance says unintended outputs and misuse do not inherently create new intended purposes. (^[5]) Scope control and qualification assessment should therefore remain distinct. Human oversight needs evaluation over time, rather than being assumed permanently effective. (^[6]) International good machine learning practice also evaluates the human-AI team within its intended environment. (^[7]) For pathology and other diagnostic systems, clinically meaningful evidence extends beyond an aggregate accuracy figure.

The policy position is also time-sensitive. At the report date, PCCPs were not formally embedded in the United Kingdom (UK) framework. (^[8]) On 6 October 2026, the government accepted 44 National Commission into the Regulation of AI in Healthcare recommendations, with draft PCCP guidance planned for December 2026; acceptance is not an enacted change-control route. (^[9]) For a team entering Great Britain, the immediate recommendation is to build bounded change protocols, subgroup and site monitoring, and traceability from risk to metric to action, while confirming current assessment expectations. The evidence package should make clear what has been measured, what remains uncertain and what decision each result supports.

MHRA AI Airlock Phase 2 is best read as a collection of evidence-design questions. Its publication was issued on 9 June 2026 and updated on 27 July 2026, including a revision to the engagement route in recommendation 20. It explicitly disclaims formal guidance status. (^[10])

This report examines what artificial intelligence as a medical device (AIaMD) developers entering Great Britain can take from the programme: how to specify intended purpose, evaluate clinical performance, document changes and maintain evidence after deployment. The official cohort divided its work among intended-purpose scope and validation, AI-powered in vitro diagnostics (IVDs), and post-market surveillance (PMS) with predetermined change control plans (PCCPs). (^[1])

The sources have different authority. MHRA's programme synthesis describes sandbox findings; the innovator reports describe candidate-led testing and perspectives. Neither should be presented as a certificate of product approval or an independently replicated comparison of the participants. (^[4]) (^[3])

There is also a timeline discrepancy. The publication describes April 2025 to May 2026; the programme executive summary describes April 2025 to March 2026. These labels should be retained transparently rather than silently reconciled. (^[11]) (^[12])

The practical audience spans founders, regulatory and clinical leaders, machine-learning (ML) teams, Approved Body readiness teams and National Health Service (NHS) deployment partners. The organising question is whether each proposed claim has a defined population, evidence source, acceptance rule and response when the evidence changes.

The implementation perspective is complementary to regulatory review. IntuitionLabs describes its information-layer work in terms of authoritative sources, permissions, retrieval and evaluation; here, that perspective informs evidence traceability rather than a competing medical-device offering. (^[13]) The proposed matrices and checklists below are this report's analytical recommendations. They should be adapted with the responsible clinical, statistical and regulatory professionals, rather than treated as an additional MHRA requirement.

Intended-purpose interpretation now has a later formal source

The sandbox should be read alongside MHRA's formal ambient voice technology (AVT) qualification and classification guidance, published on 29 July 2026. Its administrative examples include reviewed transcription, summarisation and draft discharge documentation that do not derive new clinical recommendations. (^[14])

Crucially, the guidance says misuse and unintended outputs do not inherently introduce a new intended purpose. An unsupported generated statement therefore calls for risk control and scope review, not an automatic conclusion that the device has changed classification. Manufacturers should reassess the application of device regulations with each product change. (^[5]) (^[15])

This matters when interpreting historical discussions of documentation becoming decision support. The evidence question is what the manufacturer intends the system to do, what its functions and claims support, and how the system is kept within that boundary. A label alone cannot answer the product team's design questions.

Oversight becomes an evaluated lifecycle control

MHRA's official interpretation says human-in-the-loop interactions cannot be assumed static over the device lifecycle. (^[6]) The International Medical Device Regulators Forum (IMDRF) likewise places human-AI team performance within the intended use environment. (^[7])

The analytical consequence is to specify oversight as a workflow: who reviews, what information they see, what they can correct, and what happens when review is unavailable. The review step needs its own evidence, not merely a checkbox stating that a clinician remains responsible.

Performance and change thresholds need clinical meaning

MHRA distinguishes statistical significance from clinical importance. (^[16]) The shared Food and Drug Administration (FDA), Health Canada and MHRA PCCP principles call for scientifically and clinically justified performance methods and metrics. (^[17])

Accordingly, a monitoring plan should distinguish detection thresholds, clinical acceptance limits and release decisions. A detectable movement in an aggregate metric does not itself specify whether to retrain, investigate an unnamed process issue, change instructions or pause an update. Those actions require a prespecified rationale.

Existing obligations and proposed reforms remain separate

Strengthened Great Britain PMS requirements came into force on 16 June 2025. (^[18]) At the Phase 2 report date, PCCPs were not formally embedded in the UK regulatory framework. (^[8]) The later Commission still described further policy development as necessary to operationalise the approach. (^[19])

The implication is practical: develop a bounded change plan now, while confirming the applicable assessment and notification route. A useful engineering plan and a formally available regulatory mechanism are different deliverables.

The official cohort identified three multi-environment candidates and four simulation candidates. Candidate type describes programme allocation, not proof that every allocated environment produced live clinical evidence. (^[1]) The candidate-authored reports clarify the testing actually performed. (^[4])

Table 1 combines that allocation with concise product descriptions. Its evidence questions are proposed design priorities, not MHRA acceptance criteria.

Candidate and product	Purpose and challenge	Testing described by candidate	Proposed evidence question
TORTUS	Ambient clinical documentation; intended-purpose scope and validation. The developer distinguishes clinician assessment during development from production monitoring. ([20])	Multi-environment allocation; shadow-run research using real-world transcripts, without changing normal use. ([21])	Can supported transformations be distinguished from new clinical interpretation, across specialties and configurations?
Numan, Nu & Aegis	Weight-management wellbeing conversation and monitoring; intended-purpose scope. Numan documents a boundary excluding dosing advice. ([22])	Simulation-only qualitative scope exploration. ([21])	Which input, memory and personalisation changes alter the function being claimed?
Panakeia, PANProfiler Colorectal (MSI/MMR)	Pathology-based colorectal biomarker assessment; AI-IVD performance. The product description concerns microsatellite instability (MSI) and mismatch-repair (MMR) status. ([23])	Multi-environment allocation; virtual testing and simulation, with no real-world clinical or operational testing reported. ([21])	What reference standard, specimen distribution and laboratory variation support the biomarker claim?
Octopath	Digital pathology cell counting, classification and scoring; AI-IVD performance. Its current website labels the offering research use only. ([24]) ([25])	Simulation-only discussion of evidence and claim expansion. ([21])	What evidence transfers between tissues, and what requires tissue-specific evaluation?
NHS England FDP, Safe Summarisation	Summaries of hospital stays, including potential discharge-summary support; PMS and PCCPs. ([1])	Multi-environment allocation; synthetic notes in a virtual Federated Data Platform (FDP) environment plus simulation. ([21])	Can content quality, review behaviour and version changes be monitored together?
Eye2Gene	Ranked likely genes supporting inherited-retinal-disease assessment; PMS and PCCPs. ([26])	Simulation-only exploration of update and significant-change decisions. ([21])	How should new gene knowledge, imaging variation and delayed outcomes affect update eligibility?
DeepX AI	Skin-lesion image assessment and triage; PMS and PCCPs. Its website describes electronic health record (EHR) integration. ([27])	Simulation-only conceptual scenarios, without live deployment. ([21])	How should subgroup evidence and oversight arrangements govern a proposed change?

The matrix supports a planning comparison, not a ranking. Workshop discussion can refine a protocol; virtual testing can characterize behaviour under controlled inputs; shadow-mode work can examine contextual fit. These evidence types should occupy different lines in the evidence register. NICE explicitly recognises silent-mode evaluation as a way to observe local inputs before outputs enter care decisions. (^[28])

MHRA describes TORTUS as providing automated clinical documentation integrated within electronic health records. (^[29]) Octopath's research-use-only statement should remain visible when discussing potential future medical claims. (^[25]) UCL's launch account also describes a research interface for digitised tissue specimens. (^[30])

The value of the cases is their diversity of evidence questions. None supplies a universal benchmark for all documentation tools, pathology models or retinal applications. The next step is to convert the relevant question into a product-specific protocol with a defined claim and auditable result.

Build a scope decision tree before a validation dataset

The current AVT guidance makes manufacturer-intended function central to qualification. (^[14]) For development teams, a proposed decision tree can begin with the following questions:

• Output function: Does the feature reproduce supplied information, structure it, or introduce a new clinical inference?
• Medical claim: What diagnosis, treatment, monitoring or other medical benefit is explicitly claimed?
• User and recipient: Is the output for clinician review, patient communication or an automated downstream process?
• Input boundary: Does the feature introduce laboratory results, longitudinal memory, another data source or a new population?
• Change consequence: Does the proposal alter intended purpose, workflow responsibility or the evidence supporting the claim?

The tree should end in a recorded decision: unchanged claim with justified verification, a new claim requiring an evidence plan, or a qualification question for regulatory engagement. It should not end in a generic assertion that all generative systems share the same classification.

Numan's simulation explored four staged scopes, illustrating how personalisation and clinical data can be discussed as separate product changes rather than bundled into an undefined conversational capability. (^[31]) Its current first-party description also documents an explicit dosing-advice boundary. (^[22]) These are useful inputs to a scope specification, not proof that a new personalised feature is clinically validated.

Test guardrails against the intended function

Large language models (LLMs) require evaluation methods matched to the output being assured. The programme report rejects LLM-as-a-judge evaluation as the sole assurance mechanism. (^[32]) NICE requests identifiable training and validation datasets, including source and version information. (^[33])

A proposed guardrail protocol should specify:

• Boundary prompts: Inputs that request functions outside the stated scope.
• Source fidelity: Whether clinically material statements remain supported by supplied information.
• Omission handling: Whether required information is preserved or an uncertainty is surfaced.
• Configuration coverage: Prompt, model, retrieval and interface versions evaluated together.
• Independent adjudication: A clinician-defined scoring rubric and a process for resolving disagreement.

These tests should generate reusable artefacts: input provenance, expected handling, generated output, adjudicator decision and the release rule. Preserve disagreements rather than forcing every example into a single binary label. The record should show whether a result is a model assessment, a guardrail assessment or a complete workflow assessment.

IMDRF's good machine learning practice (GMLP) principles require appropriate independence between training and test datasets. (^[34]) An evidence team should therefore make patient, site and acquisition dependencies visible when allocating data, rather than relying on a random row split as its only separation argument.

Evaluate the reviewer as part of the system

The Developmental and Exploratory Clinical Investigations of Decision-support systems driven by Artificial Intelligence (DECIDE-AI) reporting guideline asks evaluators to consider patient and user variability. (^[35]) The Standard Protocol Items: Recommendations for Interventional Trials, Artificial Intelligence (SPIRIT-AI) protocol-reporting extension calls for instructions, required skills and human-AI interaction to be described. (^[36]) (^[37])

A proposed oversight protocol should record:

• Reviewer role: Training, permissions and expected responsibility.
• Review evidence: What source information is accessible alongside the generated output.
• Review behaviour: Corrections, escalations and task-specific review patterns.
• Workload context: Conditions under which the review process is evaluated.
• Fallback: The approved workflow when output or review is unavailable.

NICE identifies professional overrides as a monitoring signal. (^[38]) Interpretation still requires context: a low override rate could represent appropriate agreement, a workflow change or insufficient observation. Establish the clinical meaning through adjudicated samples and user evaluation.

Research and adoption governance must also be planned. HRA notes that relevant approval and patient-data requirements can apply whether the technology is a medical device or not. (^[39]) NHS Digital Technology Assessment Criteria (DTAC) operate alongside other approvals, while DCB0129 and DCB0160, clinical risk-management standards for digital systems, do not replace medical-device requirements. (^[40]) (^[41])

The pathology cases direct attention to the evidence underlying a diagnostic output. IMDRF's software-as-a-medical-device (SaMD) clinical-evaluation framework distinguishes clinical association, analytical validation and clinical validation, and treats evaluation as continuous. (^[42]) These components provide a useful organising vocabulary rather than a substitute for the applicable IVD framework.

Ground truth means the reference information against which the output is judged. It needs a justification that matches the claim. IMDRF's GMLP principles require fit-for-purpose reference standards. (^[43]) The Phase 2 report notes that agreement metrics can be more appropriate when the comparator is imperfect. (^[44])

For a biomarker inference, the proposed evidence package should distinguish what the software predicts from how the reference status was established. For a cell-scoring application, specify the scoring convention, annotator process and handling of ambiguous material. For a proposed additional tissue claim, explain what changes in the biological question, specimen preparation and clinical use.

A practical performance protocol should address:

• Reference provenance: Laboratory method, interpretation process and adjudication of discordance.
• Specimen coverage: Relevant tissue, preparation, image quality and exclusion categories.
• Site independence: Which laboratories contribute development and evaluation data.
• Threshold justification: Why a selected operating point is acceptable for the intended pathway.
• Clinical utility: What downstream decision the output is intended to support.

These are proposed protocol fields. They make the claim assessable and expose where further evidence is needed. They also prevent a familiar model metric from substituting for a clinical question.

NICE states that test accuracy alone does not demonstrate clinical utility. (^[45]) A laboratory-facing report should therefore describe the role of the result: replacing an existing measurement, triaging samples for another test, or contributing to a clinician's assessment. The evidence needed for those roles may differ even when the underlying algorithm remains unchanged.

Representativeness must be planned across the deployment chain. GMLP includes patient characteristics, settings and measurement inputs within training, testing and monitoring data. (^[46]) The programme report separately cautions that national benchmarking may not replace local validation. (^[47])

The analytical recommendation is to separate technical transfer from clinical transfer. Successful processing of images from another scanner answers an acquisition question. Evidence supporting a different specimen or decision pathway answers a clinical question. A combined protocol should state which claim each dataset actually supports.

This distinction is especially useful for modular pathology systems. A reusable architecture may support efficient evidence collection, but the technical possibility of reuse does not itself demonstrate clinical suitability for every additional claim. Maintain a claim-by-claim evidence register instead of an undifferentiated statement that the platform has been validated.

Design the plan without overstating the current UK route

A PCCP describes bounded planned changes and how they will be assessed. The shared regulator principles identify five organising principles: focused and bounded, risk-based, evidence-based, transparent, and a total-product-lifecycle perspective. (^[48])

The FDA's final August 2025 guidance describes planned modifications, the methodology for developing, validating and implementing them, and impact assessment. Under its US mechanism, modifications within an authorised plan need not each trigger another marketing submission. (^[49]) (^[50]) That US consequence should not be attributed automatically to Great Britain.

IMDRF's August 2026 PCCP document provides international content principles, while expressly stating that it does not replace jurisdictional laws. (^[51]) (^[52]) For a UK submission, establish the current legal route and the assessing body's expectations before describing a change as pre-authorised.

Table 2 translates the bounded-plan concept into proposed evidence controls. It is an engineering and regulatory-discussion template.

Proposed modification	Protocol and boundary	Acceptance evidence	Action when boundary is not met
Retraining for the existing claim	Define eligible data, pipeline and fixed purpose. Shared principles bound changes by intended use. ([53])	Claim-specific performance and justified subgroup criteria.	Hold release; document the assessment route for the proposed change.
Prompt or retrieval update	Test the complete configuration against the output specification.	Source fidelity, required-content coverage and adjudicated workflow results.	Restore the supported configuration; revise the protocol.
Acquisition or site extension	Document input compatibility and deployment context.	Independent site evidence and fit-for-purpose reference assessment. ([43])	Restrict the supported configuration pending additional evidence.
Oversight modification	Treat reviewer role and autonomy as explicit design variables.	Human-AI team evaluation in the intended environment. ([7])	Retain the established review arrangement.
Proposed claim expansion	Record new population, tissue, clinical role or purpose.	Evidence specifically supporting the additional claim.	Seek the applicable qualification and conformity assessment decision.

The table separates a change description from permission to implement it. Shared PCCP principles envisage mechanisms to detect and stop or revert changes that miss prespecified criteria. (^[54]) The September Commission similarly warns that significance cannot be judged from the technical modification alone. (^[55])

For internal review, ask whether the proposal changes purpose, population, setting, autonomy, oversight, benefit-risk assumptions or cumulative behaviour. Record the reasoning even when the model architecture is unchanged. A configuration diff is useful evidence, but it is not the complete clinical assessment.

Build monitoring around decisions

The programme report recommends linking monitored thresholds to whether changes proceed, pause or terminate. (^[56]) WHO's regulatory-considerations overview also addresses performance evaluation and monitoring, while expressly presenting itself as an overview rather than policy or a regulatory framework. (^[57]) (^[58])

For operational planning, define a monitoring matrix across:

• Population: Clinically relevant demographic and disease subgroups.
• Site: Laboratory, trust, acquisition platform and deployment configuration.
• Behaviour: Output characteristics, clinician corrections and workflow use.
• Outcome: Available reference labels, clinical results and label-delay patterns.
• Version: Model, prompt, retrieval corpus and associated release documentation.

These dimensions are proposed controls, not a requirement to collect every possible variable. Select them from the intended purpose and risk analysis, with a clear purpose for each item.

NICE calls for processes to detect declining performance within groups over time. (^[59]) For skin-image systems, a proposed subgroup plan should explicitly examine relevant skin-tone representation and acquisition conditions. For rare-disease applications, it should address sparse outcomes and evolving reference knowledge. These are design recommendations, not reported subgroup-effect estimates from the sandbox.

Eye2Gene's website describes activity logging and role-based access, which can support an auditable feedback process. (^[60]) TORTUS describes production observation separately from development-time clinician assessment. (^[61]) Both are first-party capability statements; neither establishes that every deployment has the same monitoring coverage.

What the available denominators support

Phase 2 selected seven technologies from 51 applicants. (^[2]) The simple ratio, 7 ÷ 51 = 13.7%, describes cohort selection, not device success, clinical effectiveness or the prevalence of regulatory challenges. (^[2]) Application portfolios are purposive evidence sources.

The candidate-authored Panakeia case study describes 791 patients from St James's University Hospital, Leeds. (^[62]) It reports 97.86% sensitivity, 93.82% specificity and 99.65% negative predictive value (NPV). (^[63]) These figures belong to that evaluation, not a pooled Phase 2 benchmark. Their interpretation requires the comparator, disease distribution, exclusions and intended clinical role; the headline percentages should not be transferred to another laboratory or use case.

A separate published Eye2Gene study used an external test dataset of 39,596 retinal scans from 836 patients, with external validation across five clinical centres. (^[64]) (^[65]) This is published research evidence, not the sandbox's simulation result. The distinction between image count and patient count is material when planning independence and precision.

Reporting tools also have defined scopes. DECIDE-AI includes 17 AI-specific and ten generic reporting items for early-stage evaluation, while Transparent Reporting of a multivariable prediction model for Individual Prognosis Or Diagnosis, Artificial Intelligence (TRIPOD+AI) provides a 27-item reporting checklist. (^[66]) (^[67]) Consolidated Standards of Reporting Trials, Artificial Intelligence (CONSORT-AI) concerns reporting trials evaluating interventions with an AI component. (^[68]) Checklist completion makes evidence easier to inspect; it does not establish regulatory conformity.

Sample-size planning requires project inputs

There is no monitoring sample-size recommendation in this report. A statistical plan should begin with user-supplied inputs:

• Endpoint: The particular binary proportion or other outcome being monitored.
• Expected rate: A justified planning value, not an assumed universal performance level.
• Precision or detectable change: The uncertainty or movement the study must address.
• Confidence and power: Prespecified statistical error limits where relevant.
• Strata and dependencies: Site, subgroup, patient and repeated-measure structure.

For approximate precision planning of an independent binomial proportion, the familiar expression is n ≈ z²p(1 − p)/e², where the user supplies the expected proportion p, half-width e and confidence quantile z. The National Institute of Standards and Technology (NIST) presents this normal-approximation approach with explicit assumptions. (^[69]) It should be calculated separately where a stratified design requires stratum-specific precision. (^[70])

Precision estimation differs from powered detection of a prespecified change. NIST's change-detection calculation takes the baseline and target proportions, significance and power into account. (^[71]) Rare outcomes, small samples and proportions near the boundary need particular care: NIST cautions that symmetric normal-approximation intervals can be inaccurate with small event counts or sample sizes. (^[72])

The proposed planning rule is to commission the statistical design before treating a monitoring window as adequate. Record the unit of analysis, missing-label strategy, clustering, repeated looks and subgroup uncertainty. Otherwise, a dashboard may display stable percentages without demonstrating that the planned clinical change could be detected.

Trace risks through to accountable action

Table 3 proposes a traceability structure connecting the intended-purpose statement to evidence, alerts and corrective and preventive action (CAPA). It is a design template, not a record of any participant's operational results.

Risk or evidence question	Metric and evaluation unit	Proposed alert rule	Action and retained record
Unsupported clinical content	Clinician-adjudicated source fidelity by reviewed encounter.	Prespecified clinical acceptance limit, with uncertainty reported.	Review affected configuration; retain source, output and adjudication.
Subgroup uncertainty	Claim-specific performance and reference coverage by relevant subgroup.	Insufficient evidence or breached subgroup criterion.	Expand evidence collection or restrict supported use; retain rationale.
Site transfer	Performance by acquisition and deployment configuration.	Local acceptance criterion not met.	Hold the extension; retain site verification and decision.
Oversight adequacy	Review and correction behaviour linked to adjudicated samples.	Clinically justified change in oversight effectiveness.	Reassess interface, training or review arrangements.
Planned update eligibility	Prespecified performance and scope checks by release version.	Any release condition outside the bounded plan.	Stop the update; document change assessment and any restoration.

The interpretive point is ownership. Every alert needs a decision-maker, timeframe and closure record. Clinical evaluation is an iterative part of quality management, according to IMDRF. (^[42]) DTAC remains an additional deployment assessment rather than a replacement for device approvals. (^[40])

Engage with a concrete evidence package

For a near-boundary product, the revised programme recommendation suggests engaging MHRA through [email protected] before deployment. (^[73]) The package should include representative outputs and a user journey, not only a technology description.

The Commission describes the current Great Britain approach for medium and high-risk devices as conformity assessment by MHRA-designated Approved Bodies, rather than direct conformity assessment by MHRA itself. (^[74])

For an assessing-body discussion, distinguish the study design from its reporting format. DECIDE-AI does not prescribe a fixed study design. (^[75]) SPIRIT-AI asks for the instructions and skills needed to use the intervention. (^[36]) Performance criteria should have scientific and clinical justification, (^[17]) while development and evaluation data need appropriate independence. (^[34])

Proposed engagement questions are:

• Qualification: Which example outputs and user journeys resolve the boundary question?
• Validation: Which comparator, sites and populations must the evidence cover?
• Change: Which proposed modifications require a new assessment or notification?
• Oversight: What demonstrates that the reviewer arrangement works in context?
• Surveillance: Which metrics and subgroup evidence support continued conformity?

A proposed pre-submission checklist is:

• Purpose: Intended users, population, clinical role and excluded functions.
• Claims: A mapping from each claim to its supporting evidence.
• Data: Provenance, reference standards and separation of development from evaluation.
• Oversight: Reviewer instructions, workflow evidence and fallback.
• Change: Proposed modifications, acceptance criteria and regulatory decision route.
• Monitoring: Subgroups, sites, labels, triggers, actions and accountable owners.
• Deployment: Research governance, local assurance and budget impact.

HRA distinguishes research from service evaluation under its policy definitions, so the actual activity should determine the approval question. (^[76]) NICE's user guide also asks for budget-impact analysis; clinical evidence and adoption economics should therefore be planned together. (^[77])

As of 13 October 2026, Phase 3 applications are open following the 6 October update. (^[78]) The government accepted 44 Commission recommendations and committed to draft PCCP guidance for public comment by December 2026, with an implementation roadmap by Spring 2027. (^[9]) The promised change framework is intended to define allowable-change boundaries, but its future details remain to be consulted on. (^[79])

For an adjacent implementation advisor, the durable priority is an operable evidence process. IntuitionLabs' own measurement description includes quality, risk signals, reliability and support burden. (^[80]) Those operational measures can complement the product's clinical evidence without replacing the manufacturer's responsibilities or the relevant assessment.

The practical answer to MHRA AI Airlock Phase 2 evidence requirements is a product-to-evidence plan, with careful separation between formal requirements, sandbox observations and proposed implementation controls. The programme report remains explicitly non-guidance. (^[3]) Its cases help teams frame questions; they do not establish a shared regulatory outcome for every product using a similar model.

Start with the intended function and clinical role. Identify what the output changes in the workflow, which population and setting the claim covers, and how that claim will be assessed. Then specify the reference standard, independent evaluation data, reviewer arrangement and evidence needed for local adoption. Preserve the distinction between a discussion workshop, a controlled evaluation and evidence from actual use.

For evolving systems, connect the change proposal to the existing claim and to release conditions. A PCCP-inspired plan can make development more disciplined, while the applicable jurisdictional route still needs confirmation. International principles expressly retain that jurisdictional distinction. (^[52])

For post-market evidence, prefer an accountable decision process over a collection of dashboard metrics. Define the relevant subgroup and site questions, label availability, statistical uncertainty and actions that follow a breached condition. Evaluate whether human oversight continues to serve its intended function.

The recommended readiness test is whether an assessor or NHS partner can trace a claim from purpose to data, metric, threshold, action and retained decision. That trace is the useful deliverable: evidence that can be inspected, updated and acted on as the product and its deployment context evolve.