United Kingdom
Device law, data privacy, and hosting tier for United Kingdom, on one page.
Device law
Full sectionPost-Brexit Great Britain runs its own regime but keeps the same intended-purpose logic and is aligning with EU MDR and IMDRF. The MHRA's Software and AI as a Medical Device Change Programme is one of the most active in the world. Post-market surveillance regulations are already in force. The draft Medical Devices (Amendment) Regulations 2026, published 11 May 2026, introduce risk-proportionate classification, Predetermined Change Control Plans for SaMD and AI, an International Reliance Pathway, and Regulation 19D prohibiting misleading or unsubstantiated promotional claims. A dedicated AI framework is expected during 2026.
Same green zone as the EU and Australia: non-clinical education, intake, qualification, routing.
Symptom interpretation classifies as a device. Reg 19D adds separate exposure on co-branded efficacy claims.
The International Reliance Pathway means a future EU CE or US clearance would ease entry. Watch Reg 19D for any co-branded clinic content with implied efficacy.
Data privacy
Full sectionMirrors the EU framework with UK-specific machinery. Health data remains special-category, processing terms and DPIAs apply, and the Information Commissioner's Office is the regulator. International transfers use the UK addendum or the International Data Transfer Agreement. The Data (Use and Access) Act 2025 reformed some areas, including recognised legitimate interests and automated-decision rules, but the substantive protections for health data are intact.
Same posture as the EU. UK-region processing or a valid transfer mechanism, plus ICO-aligned consent and a processing agreement.
Hosting tier
Full sectionAccountability or transfer-gated. Australia, EU, UK
External APIs are usable only if data stays in-region through a regional endpoint, or is covered by a transfer mechanism (SCCs, the UK IDTA) plus consent. The cleanest path is in-region managed inference, Vertex in australia-southeast1 for Australia, an EU region for the EU and UK, or self-hosting. Australia's APP 8 specifically rewards keeping data onshore.