Regulators clarify medical device status and governance expectations for NHS AI scribes

The Medicines and Healthcare products Regulatory Agency (MHRA) has published new guidance to clarify how existing medical device law applies to ambient voice technology (AVT) products used in health and care settings in Great Britain, setting a regulatory line between tools that merely transcribe and summarise clinical conversations and those that go further into diagnosis or automated action.

The guidance, developed in close partnership with NHS England, was published on 29 July 2026 at the same time as an updated version of NHS England's own adoption guidance for ambient scribing products, revised to align with the MHRA guidance and setting out detailed governance, data protection and safety expectations for organisations deploying the tools.

AVT products, often referred to as AI scribes, are increasingly used across the NHS to record and summarise conversations between clinicians and patients, reducing time spent on administrative tasks and supporting clinical documentation.

The MHRA guidance confirms that AVT products fall outside medical device regulation where they are intended solely for:

- transcription of clinical conversations
- summarising of clinical conversations
- drafting letters
- suggesting clinical codes for a clinician to review.

By contrast, AVT products intended to support diagnosis, treatment or prevention, or that take automated action such as placing orders without clinician review, are regulated as medical devices and must meet the relevant safety and performance requirements.

The guidance sets out how the MHRA applies the existing framework under the UK Medical Devices Regulations 2002 to the technology, with qualification turning on the product's intended purpose as defined by the manufacturer in their Instructions for Use, labelling and promotional materials. The MHRA guidance has been developed with input from NHS clinicians, technologists and patient safety advocates and reflects the direction of the National Commission into the Regulation of AI in Healthcare, which is working with the MHRA, NHS England and other partners on the future regulatory framework for AI in health.

Lawrence Tallon, Chief Executive Officer of the MHRA, said that NHS organisations, suppliers and clinicians had been asking for clarity on where the regulatory line sits for this high-growth and high-potential technology, and that setting out which functions are deemed medical devices would "help to unlock faster uptake of lower risk tools that significantly reduce the burden of administrative work, such as transcribing or summarising conversations, in turn, giving clinicians more quality time focusing on patients." He added that where a product supports diagnosis or treatment, regulatory protections will still apply.

Falling outside medical device regulation does not mean that AVT products sit outside governance requirements, however. NHS England's updated guidance, aimed at Chief Information Officers and Chief Clinical Information Officers leading AI adoption in health settings, directs adopting organisations to complete DCB0160 clinical safety documentation and a Data Protection Impact Assessment, to assign a Clinical Safety Officer, and to engage with information governance and cybersecurity support early to ensure legal and regulatory requirements are factored into procurement and implementation.

On data protection specifically, the NHSE guidance requires organisations to ensure the product complies with UK GDPR and relevant healthcare regulations, outlining data handling, access, and third-party involvement, and to be transparent with patients about the use of the tools. It adds that transparency can involve updating privacy notices and explaining how patients' information will be used before the processing takes place, giving them the chance to object, with information covering what is being recorded, what the output will be, and who will use that output and how it will be stored.

The guidance also flags the right under UK GDPR Article 22 not to be subject to automated decision making where the outcome produces a legal or similarly significant effect, and points adopters to Information Commissioner's Office guidance on AI and data protection and on generative AI that processes personal data.

The NHSE document additionally requires that organisations and their suppliers comply with the Data Security and Protection Toolkit and Cyber Essentials certification, and warns of AI-specific security risks, including that indirect prompt injection attacks can be used to extract a user's personal data from large language models. A separate, more detailed information governance guidance document, including a template DPIA, is available for organisations adopting the products.

The guidance sits alongside the NHS England Ambient Voice Technology Supplier Registry, a national self-certified registry for ambient scribing product suppliers that provides an accepted list of suppliers, along with a repository of supporting evidence, to support and accelerate local procurement and assurance activities, including completion of the Digital Technology Assessment Criteria assessment and registration with the MHRA as applicable.

NHS boards and executive teams are asked to assure themselves that AVT deployment is supported by appropriate clinical oversight, local governance, staff training and procurement processes, and that any change in a product's functionality that may alter its regulatory status is identified and reviewed. The NHSE guidance underlines the point, warning that products using generative AI and large language models may introduce new functions unintentionally or through user-provided instructions, and that a user might be able to provide instructions to get the product to generate an output that goes beyond the product's intended purpose such as suggesting a diagnosis, which would engage medical device regulation.

The guidance is unchanged on the position that clinicians remain responsible for reviewing and verifying AI generated transcripts, summaries and other outputs before they are used in patient care.

Rob Thompson, Chief Digital, Data and Technology Officer at NHS England, said AI notetaking tools were "already showing real promise in reducing the administrative burden on frontline staff and freeing up more time for patient care, but the technology must be adopted with the right safeguards in place."

Thompson said NHS England would now begin rolling out the technology across the NHS "safely, consistently and at scale".

The MHRA will continue to work with NHS England and other partners to develop further guidance as the technology and the needs of the health system evolve, while NHS England has indicated that further templates and tools - including for risk assessments, hazard logs and safety cases - will be published as part of the series.