Updated 21 October 2026.
A CE mark can establish an important part of a medical device's route to market. It cannot establish that the device fits a particular clinic's workflow, connects safely to its systems or produces benefits that justify its total cost. The gap between those propositions is where many clinical AI projects succeed or fail.
Britain's planned indefinite recognition of qualifying CE routes makes that distinction more important, not less. With one source of future market-access uncertainty reduced, attention should move towards the actual conditions of deployment.
Begin with the exact workflow
"Deploy clinical AI" is not a sufficiently specific project. Recording a consultation, drafting a referral, suggesting a code and answering a clinical question involve different inputs, outputs and consequences. A shared interface does not turn them into one undifferentiated use case.
A practical specification should identify where information originates, who reviews the output, where it goes and what happens if it is wrong or unavailable. It should also identify which functions are deliberately excluded from the first deployment.
For example, a service might initially permit draft note generation but not activate an additional recommendation function. That is not an argument that documentation is risk-free. It is a way to keep the evaluated workflow aligned with the work actually being introduced.
Verify regulatory scope without over-reading it
The supplier should provide product-specific conformity information and explain the intended purpose. The buyer should establish that the proposed function and version fit that scope. MHRA registration and the relevant domestic obligations should be checked separately.
An enterprise sales presentation may describe a company's whole portfolio, while the certificate or declaration concerns a narrower product. A procurement team should resolve that mismatch before clinical use, not after a concerning output reveals it.
Classification also requires context. A Class IIa label does not mean every feature is covered, and a lower class is not automatically evidence of poor quality. The issue is whether the applicable route and classification are appropriate to the function being purchased.
Local clinical safety is not outsourced to the supplier
NHS clinical risk management standards distinguish the manufacturer's responsibilities from those of the organisation deploying and using health IT. The scope of application should be assessed using the official applicability guidance.
In practical terms, the organisation needs to understand risks created by its own environment. A product may behave differently when used with local templates, record systems or staffing patterns. Training and escalation arrangements can alter whether a technically detectable error is actually detected.
A useful local safety assessment should therefore examine realistic failure paths. What happens when the wrong record is open, the connection drops or a clinician signs off without seeing a relevant omission? A statement that "the user checks everything" is not a substitute for understanding whether that check is feasible.
Information governance needs a real data map
A buyer should know which data is collected, where it is processed, who can access it, how long it is retained and whether any secondary use is proposed. The description should cover logs and support access as well as the main clinical record.
DTAC provides a framework for examining digital health products, but completing a questionnaire is not the same as understanding the deployed configuration. The organisation should involve the appropriate information-governance and data-protection teams and document the relevant arrangements.
Avoid reducing the issue to a single hosting location or consent checkbox. Data residency is one property of a service. Lawful processing, transparency, access control and contractual responsibilities need their own analysis. A supplier's global privacy statement may not answer the questions raised by a specific NHS implementation.
Integration should be demonstrated end to end
A connection described as an "integration" might simply place text in a field, or it might exchange structured information with clear error handling. Those capabilities are not interchangeable. The buyer needs to see the exact sequence in the intended environment.
NHS API assurance guidance illustrates why technical access and organisational assurance belong together. A successful demonstration should include failure handling, correction and recovery, not just the ideal path from input to completed note.
Where a supplier such as Tandem lists integrations, ask which functions work through the relevant connection and which require separate actions. Do not assume that access to one module means another module is available through the same channel.
Evidence should reflect the work being purchased
A documentation-time study cannot establish diagnostic benefit. A question-answering benchmark cannot establish a reliable record-transfer process. Match each important claim to evidence about that function and setting.
The NICE evidence standards framework is useful when considering what evidence a digital product should provide. Locally, define a small number of meaningful measures before the pilot begins: completion time, review burden, important corrections, staff experience and relevant service outcomes.
The comparator also matters. Compare the new workflow with the real previous workflow, not an artificially inefficient version. Include the people who receive downstream outputs. A referral that is quicker to draft but harder to interpret can move rather than remove work.
Plan for updates, outages and exit
Clinical AI is not a one-time installation. Ask what changes the supplier can make, how the organisation is notified and what evidence supports a significant update. Identify whether local settings can alter the evaluated behaviour.
The service also needs an ordinary fallback. Clinicians should know how to continue when the tool is unavailable, how to report an incident and how to preserve relevant information for investigation. Dependence becomes manageable when recovery is designed, not merely hoped for.
Finally, consider exit while the relationship is good. Define exports, retention, deletion, configuration transfer and transition support. A useful product should not need unnecessary switching barriers to maintain its customers.
Where independent reference and learning tools belong
A hospital's documentation platform does not necessarily satisfy every clinician's reference or educational need. Ask-iatroX, Tutor and simulations address different tasks, and should be assessed accordingly.
That does not mean organisational rules cease to apply when a service is independently accessible. Clinicians should use tools within their intended scope and their organisation's information-governance requirements. General or fictional learning questions should not be confused with an approved patient-data workflow.
The right conclusion is not that CE marking matters little. It matters precisely for what it establishes. NHS readiness requires the additional evidence and operational work that turns a lawful product into a dependable local service.
Frequently asked questions
Does a CE-marked device still need a local clinical safety assessment?
Organisations must address the applicable deployment responsibilities. Product conformity does not replace assessment of risks arising from the local workflow, configuration and users.
Is a DTAC submission the same as NHS endorsement?
No. DTAC is an assurance framework for buyers and suppliers. A submission should be assessed in context and is not a universal endorsement of clinical effectiveness.
What is the most useful thing to test in an AI pilot?
The complete proposed workflow, including review, correction, transfer and failure handling. Measure meaningful outcomes against the existing process rather than testing only whether the AI can generate impressive text.
Choose software by the job it must complete
Explore iatroX's tools guide to distinguish documentation, clinical reference and structured learning needs.