UK AI in Healthcare Report 44 Recommendations What British SMEs Need Next
Updated: 21 hours ago
44 Recommendations, and Still Nobody Owns the Liability
Author: Simon Rasalingham, 2026
The National Commission into the Regulation of AI in Healthcare has reported. I gave evidence to it in January. The result is 44 recommendations across 119 pages, and it is serious work.
Across those 119 pages:
Industrial strategy — no mentions. Reimbursement — no mentions. Sovereign AI — one mention, and that was about the risk of relying on foundation models owned outside the UK.
And the question that decides whether an autonomous AI product can be built in this country at all — who is accountable when a system acts without a clinician reading the output — does not get an answer.
That is the story. Not because the Commission did its job badly, but because it did its job well and its job stopped at the regulatory boundary. A regulator can make the UK a safe place to generate evidence. Nothing in these 44 recommendations makes the UK a rational place to build an autonomous product.
I know this because I have already run the experiment.
Credit first, because it is deserved
Lawrence Tallon, Henrietta Hughes and Alastair Denniston deserve warm congratulations for taking these steps, and the MHRA deserves credit for engaging with the hard technical questions rather than pretending AI looks like every device category that came before it.
Three recommendations stand out.
Post-market surveillance that can catch drift before harm. Surveillance is usually framed around incident reporting: something goes wrong, someone reports it, the regulator responds. That is not enough for AI. A system can degrade without producing a clean incident — accuracy falls in a subgroup, false positives creep up, a triage tool starts producing more borderline recommendations after a hospital changes its data feed. The report's emphasis on escalation when performance starts to degrade, absent any reported incident, is exactly right. It shifts suppliers from a complaint inbox to defined performance measures, deployment baselines, monitoring across patient groups, and a route to pause, roll back or retrain.
Change-control plans for adaptive and agentic systems. AI products change. Some through periodic updates, some by learning from new data, some because a third party updated the model underneath them. Agentic systems add another layer, selecting tools and chaining tasks across a workflow. A static approval model cannot handle that. The report pushes developers and regulators to define the boundaries in advance: what can change without re-approval, what requires notification, what creates a new intended purpose. For a small company this is commercial as much as clinical — if every meaningful update risks a full regulatory reset, you cannot improve a product after deployment.
Device-level traceability in the patient record. This sounds dry and is one of the most practical safeguards in the document. If an AI system contributed to a clinical decision, the record should show which system, which version, and when. Without it, surveillance weakens, incident review gets harder, and recalls get messy. It matters when the tool works, too — proving a product reduced workload depends on knowing where it was actually used.
This is not a shallow report. It engages with the right risks and gives regulators a route to act before avoidable harm occurs.
I am not speculating about what happens next
Between 2017 and 2024 I built an autonomous AI algorithm for chest X-ray reading — a system that ruled out normal studies without a radiologist reading them first — took it through full regulatory approval, and put it into live clinical use in the NHS.
It worked. At Calderdale and Huddersfield NHS Foundation Trust it cut the time to read a chest X-ray from seven days to seven seconds, reduced radiologist workload by 29%, and cut the wait for a diagnosis by 71%. We had three years of real-world performance data from live NHS sites. We won the Prix Galien UK. The Secretary of State for Science, Innovation and Technology cited the technology in the House of Commons.
It still did not win national deployment.
What decided it was who carried the liability when the algorithm made a mistake. And which competitors were better funded.
Liability is the tax on autonomy. The moment no clinician reads the study, someone has to own the consequence of a miss — and there was no framework telling a trust, a supplier or an insurer who that someone was. So the safe procurement decision was the tool with a human in the loop, from the vendor with the deeper balance sheet.
Regulation was never the binding constraint. Neither was evidence. We had both, and neither was sufficient, and no recommendation in this report would have changed the outcome.
That is why the absences matter more than the 44 presences.
What the absences actually decide
Autonomy and liability. The report handles adaptive models and agentic systems well as technical categories. It does not resolve the question underneath them: when a system acts without a human reading the output, who is accountable for the error? Until that has an answer in writing, autonomous AI in the NHS is not a regulatory problem or an evidence problem. It is an insurance problem, and no amount of post-market surveillance solves it. This is the gap that decides whether the UK gets autonomous healthcare AI from British companies, from overseas ones, or not at all.
Industrial strategy. Healthcare AI is not one market. Imaging, triage, ambient documentation, clinical coding, remote monitoring, risk prediction and drug discovery face different evidence and adoption barriers. A strategy means choosing where the UK has an edge and aligning regulation, NHS adoption, research funding, data access, procurement and export support behind those choices. Without it, AI leadership is a speech.
Reimbursement. If a tool saves time, reduces avoidable admissions or supports safer decisions, there has to be a way to pay for it. Without that, the system gets stuck in pilot culture — and pilots become a problem the moment they substitute for adoption rather than answering a defined question. An SME needs to know what evidence supports payment, who decides, how long it takes, and whether adoption scales beyond a single local champion. None of that is currently knowable.
Sovereign AI. The report's single mention points at a real risk: dependency on foundation models owned and controlled elsewhere. That is not only a security question. It affects cost, data governance, clinical assurance, resilience and bargaining power. Sovereign capability does not mean building every model here. It means being clear about which capabilities are too important to leave entirely outside national influence — and supporting British firms that build clinically useful AI, rather than letting them prove products here and scale somewhere else.
In fairness, some of this sat outside the Commission's formal remit. But this was the largest commission on the subject. It had the platform, and it almost certainly had a view.
So who owns what happens next?
Recommendation 16 is where to push
Recommendation 16 commits to recognition and reliance pathways with trusted international regulators. It is the most commercially consequential line in the document.
For an SME, duplicated regulatory work is not an irritation. It consumes runway, delays hiring, postpones evidence generation, and can force a company to choose one market at the expense of another. A large multinational absorbs parallel submissions. A small company cannot.
Done well, recognition means trusting comparable work where appropriate and concentrating UK regulatory effort where it adds real value. The UK can be rigorous without being repetitive. Done badly, it becomes another cautious statement that changes nothing.
Specifically, it should produce clear routes for using UK evidence in international submissions, accepting trusted overseas decisions where suitable, aligning change-control expectations with major regulators, and giving predictable timelines for advice and reliance decisions.
Why I would still tell a British SME to go FDA first
This is the uncomfortable part, and I am not going to hedge it.
I want the UK to be the obvious place to build first. It is not, and I would tell a British SME to start with the FDA.
Not because the UK lacks clinical excellence — it has world-class clinicians, strong research networks, respected health data assets, and a regulator now doing genuine thinking on AI. But because the US pathway has a clearer line between regulatory clearance, reimbursement strategy, payer engagement and commercial growth. The US has its own cost and complexity, and no founder should underestimate it. It is still the shorter route from approval to revenue.
The UK offers something real but partial: a credible place to generate evidence, access to respected clinical partners, and real-world performance data from a national health system.
Evidence alone does not sustain a company.
The UK is where I will generate evidence and collect performance data. It is a trusted place to build proof. That is precisely why overseas AI providers are content to use taxpayer-supported infrastructure to build theirs — and then sell into markets where the money is.
A good regulatory report answers the question: how do we make AI in healthcare safer? This one answers it well.
A national strategy has to answer the next one: why should the best British healthcare AI companies build, launch and scale here first?
Until that has an answer, FDA-first remains rational.
What would change my advice
Not a pilot fund. Not another accelerator. One specific thing:
A published reimbursement route for an autonomous AI device — one that issues a clinical result without a clinician reading it first — with a named decision-maker, a defined timeline from evidence submission to payment, and an explicit answer to who carries the liability when it is wrong.
That is truly scalable AI out of UK that resonates glbally
Autonomous, because a decision-support tool that a radiologist checks is a different commercial proposition and a different allocation of risk. Named decision-maker, because the system has never bought anything. Defined timeline, because runway is finite. And liability, because that is the term on which this actually turns.
I proposed autonomous classification pathways with clear liability in my evidence to the Commission in January. Across 44 recommendations, that question does not get an answer. It is the single most consequential unanswered question in UK healthcare AI, and it decides whether a British company can build an autonomous product here at all.
That route does not exist today. When it does, I will say so here and change my recommendation.
The report opens the door. The question is whether the UK walks through it with a full plan, or settles for being the world's best place to run someone else's evidence study.
Update, October 2026: the government has now responded and accepted all 44 recommendations. I have written separately on recommendation 16 and what it means for British SMEs. Author: Simon Rasalingham, 2026 How to Build a Start-up: the full series
More on British SMEs and regulation
Comments