MHRA Strategy 2030: what it says about devices, what it does not, and what to do now
Regulatory briefing · 25 October 2026
UK MDR / MHRA
The MHRA Strategy 2030 sets direction, not rules. A week later the government confirmed indefinite CE recognition. Here is what to do before the 2026 regulations are made.
Jonathan Phillips, Lead Auditor. 25 October 2026.
The MHRA published its Strategy 2030 on 14 October 2026. It is a direction-of-travel document, not a rule change. It creates no new obligations and gives few dates.
On 21 October the government published its response to the CE recognition consultation. CE marked devices under EU MDR and IVDR will be recognised in Great Britain indefinitely.
In short: the strategy tells you how the MHRA intends to behave. The response tells you the main route to market is settled. The work is now UDI, AI change control, PMS speed and the UK Responsible Person contract.
At a glance
Strategy 2030 published 14 October 2026. Direction, not law.
CE recognition for EU MDR and IVDR devices confirmed 21 October 2026, subject to legislation before 30 June 2028.
MDD devices accepted until the end of the EU transition period, currently 31 December 2028.
International reliance route for US, Canada and Australia in the draft 2026 regulations. Not the EU.
UDI, or an equivalent, to be compulsory for most devices, subject to Parliament.
UK Responsible Person and MHRA registration stay in place for every route.
DORS annual fee due by 6 November 2026.
1. What was published, and what it is not
The MHRA published a press release, a 40-page strategy and an eight-page executive summary. The strategy runs to 2030 and covers medicines, devices and the agency's own operations. The device material sits mainly in two chapters, "MedTech and Artificial Intelligence" and "World-class safety".
It is not legislation and it is not guidance. The draft Medical Devices (Amendment) Regulations 2026, notified to the WTO in May, remain the document that will change your obligations. The strategy tells you how the MHRA intends to behave as a regulator while those regulations come in. Read it for intent, not for requirements.
Few device commitments are dated. An AI Medicines Development Action Plan is promised for 2027, and the MHRA aims for a globally leading approach to regulating AI as a medical device by 2030. The Centre for AI and Digital Health and the statutory sandbox reforms have no dates attached.
2. CE recognition, international reliance, and the UK Responsible Person
On 21 October 2026 the government published its response to the consultation on indefinite CE recognition, which ran from 16 February to 10 April 2026 and drew 1,056 responses. The strategy had already said the MHRA would pursue "continued recognition of CE-marked devices to help reduce regulatory burden". The response settles it.
MDR and IVDR: the government will "indefinitely recognise all CE marked medical devices certified under EU MDR and EU IVDR".
MDD: devices still on EU MDD certificates will be accepted "until the end of the EU transition period (currently, 31 December 2028)", in place of the present GB date of 30 June 2028.
Higher-risk route: the separate reliance route for devices classified higher in GB than in the EU is dropped.
UKCA: the UKCA mark "will remain available as a route to market access alongside continued recognition of CE marked devices".
Legislation: still to be made. "Subject to parliamentary approval, these legislative changes will be made prior to the end of the earliest relevant transition period, which is 30 June 2028."
Not covered: the response says nothing about AIMDD or IVDD devices, or about custom-made devices.
The strategy also commits to "expand reliance and recognition routes with trusted regulators", and both the strategy and the press release name the US FDA. This matches the draft 2026 regulations, which set out an International Reliance route for devices authorised in the US, Canada and Australia. Routes 2 and 3 need a Certificate of International Reliance from a UK Approved Body, and the device does not carry a UKCA marking. Route 1, for the lowest-risk devices, needs no certificate. The EU is not in that route; CE-marked devices come in through recognition instead. Law-firm reports expect the reliance pathway around mid-2028.
If you hold FDA clearance, plan your GB route on reliance, not on a UKCA assessment, and allow for the 2028 timing. If you hold a CE certificate under MDR or IVDR, plan on recognition. If your device is still under MDD, you have until the end of the EU transition period, and the EU date is the one to watch. Either way, do not commission UKCA conformity assessment work you may not need.
One thing neither the strategy nor the response changes. A manufacturer based outside the UK still needs a UK Responsible Person. The response lists the conditions that continue to apply to recognised devices: a UK Responsible Person for manufacturers outside the UK, MHRA registration by the manufacturer or the UKRP, the strengthened post-market surveillance requirements in force since June 2025, technical documentation and the certificate of conformity available in English, and compliance with MHRA notices under the Medicines and Medical Devices Act 2021. Recognition means the MHRA accepts the CE assessment. It does not remove the need for a UK legal presence. Nothing in the published summaries of the draft 2026 regulations suggests the role is going away.
3. AI as a medical device
The strategy says AI as a medical device "presents distinct regulatory challenges" and commits to a modern, adaptive framework for it. It will "introduce expanded Predetermined Change Control Plans" and "explore the use of Master Files for foundation models". A new Centre for AI and Digital Health will build the agency's expertise. Separately, the MHRA will "support proposed legislative reforms to create statutory mechanisms for regulatory sandboxes".
Note the verbs. PCCPs will be introduced. Master files will be explored. Sandbox reforms will be supported. None is in force. But the PCCP route is already in the draft 2026 regulations. FDA has also recently issued a warning letter to O.N. Diagnostics. It said a new machine-learning model, among other changes, went into a cleared device without a new 510(k). The direction on both sides of the Atlantic is the same. A model update is a design change unless you agreed in advance, with the regulator, what changes you may make and how you will verify them.
What to put in the technical file now: a change-control plan for the model that defines the permitted change envelope, the retraining data governance, the performance thresholds and the verification method for each release. If you have no such plan, every retrain is a new assessment.
4. Traceability and post-market surveillance
The strategy says that, subject to the parliamentary process, new pre-market regulations will "make unique device identifiers (UDI) – or an equivalent – compulsory" for all devices except non-implantable custom-made devices and non-implantable investigational devices. It also commits to "upgrade or replace key systems for registration, reporting and public access". It describes the Yellow Card scheme as "a vital part of the UK's safety system" and promises to make it more accessible. The executive summary says the agency will move to continuous, real-time safety assurance using data, analytics and AI.
The auditor's point is this. Once the regulator has real-time data on your device, your PMS system has to be at least as fast. A PMS report written once a year from complaint logs will not stand up when the MHRA can see signals you have not yet reported. Check that your PMS plan, trend analysis and vigilance procedures can produce a position on a signal in days, not months.
UDI is the other practical job. If you have implemented UDI for the EU, the GB work is a mapping exercise. If you have not, start now; it touches labelling, the QMS, the technical documentation and the registration record.
5. Enforcement, and holding the UKRP and EU AR roles in one organisation
The strategy says: "We will substantially increase our criminal enforcement capacity" to tackle illegally supplied products. The tone is new. In August the MHRA told healthcare organisations to stop using and supplying six devices that had no valid UKCA or CE conformity markings, and to quarantine stock (DSI/2026/007). It found no defect or safety signal. The ground was missing conformity assessment. The strategy turns that kind of action into stated policy.
For non-UK manufacturers the UK Responsible Person is the named UK contact and the registration holder. The UKRP is the first door the MHRA knocks on. UKRPs should check that their contracts give them the right to verify conformity documentation, the right to refuse to register a device that does not have it, and clear obligations on the manufacturer to notify changes and incidents. A UKRP cannot carry liability for a manufacturer it cannot see.
Most manufacturers in this position sell in both markets, so they need two roles: an EU Authorised Representative for the EU and for Northern Ireland, and a UK Responsible Person for Great Britain. These can be two unrelated firms or one organisation. An Authorised Representative established in Northern Ireland can act for the EU market as well as for Northern Ireland. The MHRA's guidance on regulating medical devices in the UK says: "If you are a manufacturer based in Great Britain or another country outside the EU you must appoint an authorised representative based in the EU or Northern Ireland if you wish to supply devices to the EU market." The basis is the Windsor Framework, under which the EU MDR and IVDR apply in Northern Ireland.
The case for one organisation is practical. The same technical file, the same PMS data and the same incident reach both regulators. Two representatives review the file separately, hold separate contracts, and will each say something different about the same change. One sees the whole picture and can tell the manufacturer once, before the problem reaches the MHRA or an EU competent authority. Since 28 May 2026 most Northern Ireland devices must be registered in EUDAMED, not with the MHRA. Custom-made devices are the exception and stay on MHRA registration. GB devices are registered in DORS. The records have to be kept in step. That is easier from one desk.
6. Checklist for a GB submission in 2027 to 2028
Route: CE recognition (confirmed 21 October), international reliance, or UKCA. Do not pay for UKCA work until you have checked which applies to you.
UKRP: non-UK manufacturers, confirm your UK Responsible Person appointment. If you also sell in the EU or Northern Ireland, confirm your EU Authorised Representative, and decide whether one organisation should hold both roles.
Software and AI: write the change-control plan for the model now, with the change envelope, data governance and verification method.
UDI: implement it, or map your EU UDI onto the GB requirement.
PMS: test it. How fast can you go from signal to documented position?
Contract: UKRP verification rights, refusal rights, notification obligations.
Registration: the 2026/2027 annual fee in DORS must be paid by 6 November 2026 or the account is suspended. UKRPs and Northern Ireland Authorised Representatives pay for the manufacturers they represent.
The strategy is not the law. Law-firm reports expect the draft 2026 regulations to be made around December 2026 and to come into force around mid-2027. Everything above is work you would need to do under those regulations anyway. The strategy tells you the MHRA means it.
What is opinion, and what is not verified
Opinion: these are my views, not findings: that the enforcement tone is new; that the UKRP is the first door the MHRA knocks on; that separate representatives will each say something different about the same change; that one organisation is easier; that PMS responses should take days, not months; and that you should not commission UKCA work you may not need.
Not verified: I relied on law-firm and trade summaries for the draft 2026 regulations (route details, certificates, timing) and for the FDA warning letter. I did not confirm the exact WTO notification date. The CE recognition points are taken from the government response itself.
Disclosure
I act as UK Responsible Person for non-UK manufacturers through BS Partnership Ltd, Cardiff, and as EU Authorised Representative through its Northern Ireland subsidiary, EU-UK Authorised Representative Ltd, Belfast. The case for holding both roles in one organisation in section 5 is therefore one I have an interest in. It is also one I have watched go wrong when the roles are split. If you would like help with any of the points above, please contact us.
This briefing is for general information and is not legal advice.
Sources
MHRA Strategy 2030, full text, press release and executive summary, 14 October 2026.
Government response to the targeted consultation on indefinite recognition of CE marked medical devices, 21 October 2026, and the MHRA press release of the same date.
Device Safety Information DSI/2026/007, MHRA, 10 August 2026.
Regulating medical devices in the UK, MHRA, updated 20 February 2026. Regulation of devices in Northern Ireland, MHRA, updated 11 June 2026. Register medical devices to place on the market, MHRA, updated 16 October 2026.
Draft Medical Devices (Amendment) Regulations 2026: Latham & Watkins, Hogan Lovells, Casus Consulting and BHTA summaries.
FDA warning letter to O.N. Diagnostics: Orrick and MD+DI, October 2026.