Over the past number of months, two developments have significantly advanced the picture for those advising in the healthcare AI space.

The MHRA National Commission has published its final recommendations on the regulation of AI in healthcare, and the UK Jurisdiction Taskforce (UKJT), chaired by the Master of the Rolls, has issued its final Legal Statement on Liability for AI Harms. The Commission’s report and the UKJT serve distinct purposes. The Commission is concerned with preventing harm by regulating which systems can be used. The UKJT statement sets out how redress for harm could be secured under current English law. Or, more simply, they deal with prevention and cure respectively.

We have previously written about both the "damned if you do, damned if you don't" challenge facing clinicians and the live questions around standard of care, informed consent, and policy silence. Those questions now have clearer answers.

What the MHRA Commission has confirmed

The Commission's final recommendations, drawing on more than 760 responses from patients, clinicians, providers, and industry, confirm that a regulatory framework designed for static medical devices needs meaningful reform to accommodate adaptive AI systems. The key themes will be familiar: lifecycle-based regulation, post market surveillance, meaningful human oversight, transparency in procurement and patient communications, and improved and better coordinated incident reporting.

These recommendations have been developed alongside the MHRA 2030 Strategy, published on 14 October, and the 10-Year Health Plan for England. The 2030 Strategy provides headline commitments on steps to become a global leader in MedTech regulation, while the Commission sets out the detailed recommendations which will support that goal. As we have observed in our commentary on the 2030 Strategy, regulatory agility is a prerequisite for patient benefit, not a concession to industry. But reform at the MHRA level alone will count for little if we still have fragmented procurement pathways and poor oversight by those deploying AI.

What the UKJT has confirmed

The UKJT's central conclusion is that existing English law principles are sufficient to address AI harms – no bespoke framework is required. But the detail matters. Its application to the NHS is clear as the health service is used as the basis for a number of the examples given.  

AI has no legal personality

It cannot be held liable in its own right. Liability attaches to providers, deploying organisations, or developers.

Contract first, negligence second

Where a contractual framework exists, it will be the primary basis for allocating liability within an AI supply chain. Where it does not, negligence is the dominant route. Strict liability under the Consumer Protection Act 1987 is very unlikely to apply to AI supplied as software or a service as only 'goods' fall within the scope of the 1987 Act. 

Non delegable duties

This is perhaps the most noteworthy stance taken by the UKJT’s authors.  They express the view that an organisation such as an NHS Trust cannot escape liability for harm caused by a defective AI diagnostic tool simply by pointing to the developer's fault. The duty to provide competent care is non delegable. However, a Trust found liable on that basis may seek a contribution from the developer under the Civil Liability (Contribution) Act 1978.

Professional negligence cuts both ways

AI does not lower the standard of care. Clinicians remain liable for failing to exercise appropriate oversight of AI outputs, failing to understand the tool's limitations, and failing to be transparent with patients about AI involvement in their care. But, as we have previously highlighted, the UKJT confirms that a clinician could be liable for failing to use AI where a competent practitioner would have done so. The radiologist who does not use an effective AI tumour detection tool available at reasonable cost is the UKJT's own example. As AI adoption grows, that threshold will rise.

Causation remains the hardest question

The 'but for' test applies in principle, but AI's opacity can create real evidential difficulty. Expert evidence, including simulation of AI outputs under different conditions, will be central. Where the 'but for' test cannot be satisfied, the material contribution to damage doctrine remains available and the UKJT sees no reason in principle why it cannot apply to AI caused harm. The UKJT also considers it possible that the Fairchild material increase in risk principle could provide claimants with an alternative route where the autonomous nature of AI makes it scientifically impossible to establish the conventional counterfactual.

What this means in practice

For NHS Trusts and other healthcare providers

Review contracts to be used for the procurement of AI now, with particular attention to indemnity and contribution provisions. Non delegable duty exposure means primary liability rests with the deploying organisation regardless of where fault lies in the supply chain. Clinical governance frameworks must address AI oversight and incident reporting. Staff should be briefed on both their obligations when using AI and the risk of liability for not using it. The deployment of AI should be seen as a single continuous integrated exercise covering all those elements described above.

For businesses in the healthcare AI supply chain

The supply chain is often long and complex, encompassing suppliers of training data and infrastructure, AI model developers and healthcare IT integration specialists. Contracts will be the means of attributing responsibility. All participants should aim to be part of a chain of interlocking agreements, failing which a harmed party may not have an effective remedy, or a defendant may not have a good contribution claim against the party truly responsible. 

For insurers and indemnifiers

The fault-based negligence framework confirmed by the UKJT means coverage analysis will turn on familiar concepts but applied to new facts. The contribution mechanism creates subrogation opportunities against AI developers that should be reflected in claims handling. Policy silence on AI remains an exposure.

The direction of travel

The UKJT's Legal Statement is not legally binding, but it will shape judicial thinking as AI disputes reach the courts. Read alongside the MHRA Commission's final recommendations and the 2030 Strategy, the direction is clear: greater accountability, greater transparency, and a more demanding standard for everyone involved in deploying AI in healthcare.

The legal principles are not new. Their application to AI will be. Those who prepare now will be best placed to respond when real cases come before the Courts.

This article is part of a series on AI in healthcare by Naiomh O'Reilly, Associate, and David Hill, Partner, at Browne Jacobson. See previous editions of Insurance insights: Medical malpractice matters for further background.