MHRA AI Airlock
official ↗Regulatory sandbox for AI-as-a-Medical-Device. Pre-market pathway with the UK Medicines & Healthcare products Regulatory Agency to road-test novel AI medical devices.
Ship AI medical devices in the UK. Pass MHRA. Pass the next audit.
HAARF — Healthcare AI Agents Regulatory Framework — is one of 24 frameworks in the open @regunav/frameworks registry. Purpose-built for agentic and assistive AI in healthcare: MHRA AI Airlock submissions, SaMD/AIaMD change-management, 2025 UK Post-Market Surveillance regulations, and clinical-safety evidence for DCB0129/DCB0160 deployment.
Clauses
12
Controls
21
Audit questions
21
UK regulator anchors
Every HAARF control is anchored to a named UK regulator artefact. If MHRA updates the AI Airlock guidance or the 2025 PMS regulations change, the framework registry gets the bump and every dependent control on your platform inherits it.
MHRA SaMD / AIaMD Change Programme
official ↗MHRA's roadmap for Software-as-a-Medical-Device + AI-as-a-Medical-Device — change-management for adaptive AI, transparency, real-world performance.
2025 UK PMS Regulations
official ↗The Medical Devices (Post-market Surveillance Requirements) Regulations 2024 — in force 16 June 2025. Vigilance, trends, periodic safety updates, FSCA.
EU MDR · Annex I + IX
official ↗EU 2017/745 — essential safety + performance reqs for software-as-medical-device, including post-market clinical follow-up and incident reporting.
BS 30440 · Validation of AI in healthcare
official ↗UK standard (BSI 30440:2023) for validation framework of AI in healthcare — transparency, robustness, post-deployment monitoring across the AI lifecycle.
DCB0129 + DCB0160 (NHS clinical safety)
official ↗NHS-mandated clinical-safety standards for any IT system used in patient care. DCB0129 for manufacturer, DCB0160 for the deployment organisation.
The eight HAARF clauses
Each clause maps to a named regulator + at least one peer-framework crosswalk (EU AI Act, ISO 42001, HIPAA, GDPR). Crosswalk = map a HAARF control once, ReguNav propagates it.
| Clause | Title | Primary anchor |
|---|---|---|
| C1 | Agent identification + scope | MHRA SaMD/AIaMD intended-purpose + scope-of-deployment |
| C2 | Clinical safety + risk | DCB0129/0160 + EU MDR Annex I §17.2 |
| C3 | Data governance + provenance | GDPR Art. 9 special category + UK DPA 2018 Sch. 1 |
| C4 | Human oversight + override | EU AI Act Art. 14 + MHRA AI Airlock principles |
| C5 | Post-market monitoring | 2025 UK PMS Regs · vigilance + periodic safety updates |
| C6 | Transparency + explainability | MHRA SaMD/AIaMD transparency reqs + AI Airlock evidence file |
| C7 | SaMD / AIaMD change management | MHRA Change Programme · adaptive-AI pathway |
| C8 | Agent decision replay + audit | EU AI Act Art. 12 log-keeping + MDR §10.4 documentation |
Evidence you walk into MHRA with
- AI Airlock submission file — generated from your declared agent inventory, risk-classified, with intended-purpose + scope, training-data provenance, and post-market plan.
- SaMD/AIaMD change-management plan — every model version, every prompt revision, every fine-tune declared at submission, gated by your change-control policy.
- 2025 PMS evidence pack — vigilance log, trend report template, periodic safety update narrative, FSCA workflow with regulator-ready timeline.
- Agent decision replay — byte-for-byte replayable output for any flagged clinical decision. EU AI Act Art. 12 + MDR §10.4 documentation duty satisfied with the same artefact.
- DCB0129 / DCB0160 hazard log — clinical-safety case ready for NHS Digital review, generated from the same control library.
Healthcare AI vendor or NHS supplier? Talk to us.
We work with MHRA AI Airlock participants, NHS England digital suppliers, and EU MDR notified-body-supervised software vendors. HAARF + crosswalks to EU AI Act + ISO 42001 + HIPAA come out of the box.
Book a 15-min walkthrough →HAARF is published under Apache-2.0 in @regunav/frameworks/src/haarf.ts. ReguNav is not a notified body and does not provide regulatory affairs consulting; we provide the platform that makes evidence collection, change management, and post-market reporting tractable.