A notified body performs specified independent conformity assessment; a clinical safety officer supports clinical-risk management; a regulatory consultant advises on requirements and evidence. They do not provide interchangeable approvals. A manufacturer launching clinical AI needs to know who owns the product, who advises it, who independently assesses it and who authorises its actual deployment.
This role map uses regulatory and NHS sources checked on 13 October 2026. European notified-body arrangements, Great Britain approved-body arrangements and English NHS clinical-risk standards are related parts of the discussion, not one unified approval scheme.
Begin with the manufacturer, not the adviser
Imagine a fictional start-up, Northfield Clinical Software, developing a tool that prepares specialist follow-up recommendations for clinician review. The company has a technical team and an external clinical adviser. It is considering a certification body and an NHS pilot site.
The first organisational question is who is the legal manufacturer and who has authority to approve its claims, evidence and releases. Hiring expertise does not remove the need for that answer. The manufacturer must have a coherent account of the intended purpose and the system for which it takes responsibility.
The MHRA's intended-purpose guidance provides a useful foundation: the function, users, population and circumstances should be explicit. A consultant can help clarify that statement. The company still needs to ensure its actual product and promotional claims are consistent with it.
Regulators and assessment bodies have different jobs
The European Commission describes notified bodies as designated organisations carrying out conformity-assessment activities within their scope. Great Britain uses UK approved bodies for the relevant UKCA routes, with the MHRA publishing the current list.
Those bodies are not simply additional consultants hired to make a submission more persuasive. Their assessment must remain independent. Nor does an assessor become the regulator by conducting the review. The MHRA's account of approved-body designation and monitoring illustrates the separate oversight relationship.
A founder should therefore distinguish asking which evidence is required from asking someone to produce that evidence, and distinguish both from asking an independent body to assess it. Blurring these tasks can create unrealistic expectations about what a commercial engagement actually buys.
A clinical safety officer is not a substitute notified body
The NHS clinical-risk management standards distinguish manufacture under DCB0129 from deployment and use under DCB0160 in the applicable English NHS context. Clinical safety work examines hazards, controls, residual risks and the argument for safe use within defined conditions.
That work is not identical to medical-device conformity assessment. The two can use related information, but a safety-case report is not automatically a product certificate, and a certificate does not automatically establish every local workflow control.
For Northfield's fictional pilot, supplier-side clinical safety work might identify the risk of an inappropriate recommendation being accepted because uncertainty is hidden. Adopter-side work would ask whether the local review screen exposes that uncertainty, whether reviewers have the necessary information and what happens when the service is short-staffed.
The clinical safety officer helps make those questions and their evidence explicit. The organisation still needs named decision-makers with the authority to resource controls, restrict use and address unresolved risk.
A practical responsibility map
The table is an illustrative ownership map, not a statutory allocation of every duty. Contracts, organisational structures and the applicable route must be examined for the real project.
| Work item | Principal owner to identify | Contribution from other participants |
|---|---|---|
| Intended purpose and product claims | Manufacturer | Clinical and regulatory advisers challenge clarity and evidence fit |
| Product evaluation and technical evidence | Manufacturer | Researchers, clinicians and technical specialists conduct or review work |
| Independent conformity assessment | Appropriately authorised assessment body | Manufacturer supplies evidence and responds to findings |
| Supplier clinical safety argument | Manufacturer and its clinical safety function | Engineering and clinical teams substantiate controls |
| Local workflow and deployment assessment | Deploying organisation | Supplier communicates assumptions; local teams test implementation |
| Release and change decisions | Relevant supplier and adopter decision-makers | Assessors participate where the applicable route requires it |
| Incident investigation and correction | Named organisations according to their roles | Clinical, technical, governance and assessment participants cooperate |
A blank cell in the real project is not resolved by placing an adviser on a steering-group invitation. The owner needs an actual responsibility, access to the necessary evidence and authority to act.
Follow the handover rather than only the organisation chart
Suppose Northfield changes how its fictional tool prioritises recommendations. Engineering has completed software tests. The clinical team has reviewed selected cases. The regulatory adviser believes the change needs further consideration under the applicable assessment arrangements.
The release should not proceed merely because each team has completed an isolated task. Someone must integrate the findings, establish which decisions remain outstanding and ensure that the pilot site receives the information needed for its local assessment.
The joint change-control principles emphasise planned, bounded modifications and evidence across the lifecycle. They support asking who reviews a change and what would trigger further assessment, rather than treating any earlier approval as indefinite permission to expand behaviour.
The same handover discipline applies after an incident. A local concern may reveal a supplier defect, an implementation mismatch or both. The response needs cooperation without an assumption that one participant can simply pass the whole problem to another.
Check the boundaries of an advisory engagement
A useful consultancy specification identifies deliverables and exclusions. For example, an adviser might support the hazard analysis, review the evidence register and help prepare a safety-case report. That should not be described as guaranteeing certification or accepting all responsibility for future product use.
The client should also establish what information it must provide. An adviser cannot meaningfully assess an undisclosed function or verify a test that has not been performed. A polished report cannot compensate for an inaccessible architecture, missing evaluation or a release process that ignores the findings.
As stated on its Insights page, checked on 13 October 2026, iatroX offers clinical safety officer services and regulatory-readiness support. This article is published by iatroX, so readers should recognise that advisory interest while keeping the role separate from the independent certification functions discussed here.
Choose the next person according to the unresolved decision
A team uncertain about its intended purpose may need clinical and regulatory advice before seeking a formal assessment quotation. A team with evidence ready needs an appropriately designated body, where its route requires one. A hospital with a product ready to install needs local deployment expertise and accountable implementation owners.
Those are scenario-specific needs, not a ranking of professions. A capable project uses the participants together while preserving the independence of assessment and the responsibilities of the manufacturer and adopter. The useful question is not who can supply an impressive document, but who must establish and act on each part of the safety argument.
Frequently asked questions
Can a regulatory consultant certify my medical device?
Advice and independent conformity assessment are different services. Certification requiring a designated body must follow the applicable route with an appropriately authorised organisation.
Does appointing a clinical safety officer remove the manufacturer's responsibilities?
No. Clinical safety expertise supports the organisation's risk-management work, but does not transfer every product or deployment responsibility to one individual.
Can the same evidence support certification and NHS clinical safety work?
Relevant evidence may support both activities, but their questions and responsibilities are not identical. The product assessment must be connected to the local workflow rather than treated as a replacement for it.