A hospital starts using AI to help read scans. Months later, the software has been updated or is being used with a different mix of patients. If it misses a diagnosis, the hospital may face a legal claim, even though it did not build the tool.
On 6 October, the UK government accepted all 44 recommendations from the National Commission into the Regulation of AI in Healthcare. The government wants more checks after AI tools are approved, rather than relying mainly on assessments before launch. But the response does not settle who is legally responsible when medical AI fails.
Responsibility without control
NHS Resolution says negligence claims are more likely to be brought against the NHS organisation providing care than against an AI developer. Healthcare professionals still owe patients a duty of care, while manufacturers may be legally responsible for faulty products. Courts have yet to clarify what reasonable care looks like when AI is involved.
Dr Sarah Townley, deputy medical director at Medical Protection, warns that clinicians could become a “liability sink” for software failures. She argues that “responsibility should sit with those best able to control or mitigate the risks” and criticises the commission for not recommending changes to product-liability law.
NHS Resolution advises hospitals to keep supplier contracts, records of which software version was used and notes on whether staff followed AI advice. These records may explain what went wrong, but cannot settle every dispute over who is responsible.
Changes after approval
In Great Britain, medical-device makers already have to monitor their products after approval. Those rules were strengthened in June 2025. AI adds a challenge: performance can vary between hospitals, and software updates may change the results.
The Medicines and Healthcare products Regulatory Agency (MHRA) plans to issue draft guidance by December 2026 on ‘predetermined change control plans’. These plans would set limits on software updates and require developers to manage the risks. The regulator has also opened applications for the third phase of its AI Airlock testing programme.
A 2026 study of four deployed clinical AI systems at one healthcare organisation found that their performance changed over time, even without deliberate updates. Changes in how staff worked and when data became available were linked to poorer performance.
Jennifer Dixon, chief executive of the Health Foundation, says public support depends on “a high bar for safety over speed.” Safety checks cannot stop once an AI tool is approved.
The risk beyond hospitals
Other businesses face a similar challenge. An October survey by the Bank of England and Financial Conduct Authority found that 81% relied on supplier assurances and contracts to understand higher-impact third-party AI systems. Across the survey, only about half reported ongoing monitoring.
The FCA highlights checks of real-world outcomes and audit trails as good practice. The rules differ, but firms still need to check systems they do not fully control.
The MHRA expects to publish draft guidance in December 2026, ahead of the government’s implementation roadmap in spring 2027. Better records may explain how AI failed. A patient seeking compensation could still face a dispute over whether the hospital or software maker should pay.
A hospital starts using AI to help read scans. Months later, the software has been updated or is being used with a different mix of patients. If it misses a diagnosis, the hospital may face a legal claim, even though it did not build the tool.
On 6 October, the UK government accepted all 44 recommendations from the National Commission into the Regulation of AI in Healthcare. The government wants more checks after AI tools are approved, rather than relying mainly on assessments before launch. But the response does not settle who is legally responsible when medical AI fails.
