Scarlet's funding and the UK's recent AI-regulation recommendations point towards a more sustained approach to assurance, but they do not establish a new universal approval pathway. The practical question is how evidence, monitoring and authority to intervene remain connected after a clinical AI product enters use.
Two separate developments provide the context. Scarlet announced new funding on 12 October 2026. The National Commission into the Regulation of AI in Healthcare published its recommendations on 10 September 2026. One is a financing event; the other proposes changes to regulatory policy. Neither should be reported as permission for a particular supplier or NHS organisation to bypass existing requirements.
What the September recommendations actually propose
The Commission's report describes staged authorisation for suitable devices, supported by defined risk controls and further evidence generation. It also addresses proportionate post-market assurance and clearer information for users and the public. These are proposals about how the system could work, not a finding that all clinical AI should receive early access.
In particular, the staged-authorisation discussion connects expansion with specified evidence thresholds. The report also emphasises the readiness of participating healthcare providers. The intended relationship is therefore conditional: permission, scope, evidence and operating capability would need to fit together.
As reviewed on 13 October 2026, the cited report and accompanying government announcement describe recommendations. They do not themselves enact a general route or authorise an individual deployment. Implementation must be established from the relevant subsequent instruments and decisions, not inferred from supportive language in a press release.
Continuous assurance should not mean permanent experimentation
There is a defensible reason to collect evidence during use: some questions concern how a product behaves in actual services over time. That does not imply that missing pre-deployment evidence can always be deferred until patients are exposed.
An editorial test is to ask which uncertainties are acceptable to investigate under defined conditions, which controls make that investigation defensible, and which uncertainties must be resolved before the proposed use begins. A plan that labels everything post-market learning has not answered those questions.
The distinction also protects against a permanent provisional state. A staged pathway should have an intelligible route to the next decision, not an endlessly renewed claim that evidence is still coming. The Commission's discussion explicitly contemplates progression from staged to full authorisation rather than indefinite ambiguity.
What would need to exist in practice?
The following table is an implementation analysis, not a statement that the listed arrangements have already been mandated nationally.
| Policy direction | Implementation question | Evidence needed for a credible answer |
|---|---|---|
| Bounded initial authorisation | Which population, function and setting are permitted? | An explicit scope that can be enforced in the product and service |
| Expansion linked to evidence | What changes the decision to widen use? | Predefined outcomes, thresholds and a documented review |
| Ongoing monitoring | Who detects and investigates changing performance? | Reliable denominators, version records and named response owners |
| Accessible safety information | Can users understand the current limits? | Tested communication that reaches patients and staff |
| Proportionate oversight | Is scrutiny matched to risk and uncertainty? | A reasoned assessment rather than a uniform reporting burden |
A dashboard alone is insufficient. A signal becomes useful only when someone can interpret it, determine whether it requires action and implement that action without leaving patients or staff unsupported.
Monitoring is not a wholly new idea
It would be misleading to imply that medical-device assurance previously ended at the first certificate. Existing development and assessment approaches already address lifecycle responsibilities. The good machine learning practice principles include monitoring deployed models and managing retraining risks, while predetermined change-control principles address evidence and controls for specified modifications.
The newer policy discussion concerns how to make oversight more proportionate and responsive to software and AI, not the invention of all post-release responsibility. That distinction matters when interpreting a commercial claim to offer continuous assurance: ask what is genuinely additional, what already forms part of the applicable framework and how each activity is performed.
Likewise, more frequent reporting is not automatically better. Collecting a metric that nobody can act upon can add workload without improving the decision. The objective should be useful evidence linked to proportionate intervention.
A fictional pathway shows the operational challenge
Imagine a fictional clinical-support tool initially used by a specialist team with close review of every output. The developer proposes expanding to a broader workforce. The software itself has not changed, but the information users recognise, their review time and their access to senior advice may differ.
A continuous-assurance approach would not simply carry forward the original headline score. It would establish the new operating conditions, decide what additional evidence is needed and define a restricted transition if appropriate. It would also ask whether the previous level of monitoring can be sustained.
Now suppose the developer changes the model during that expansion. The evidence needs to distinguish a population change from a product change. Without configuration records and clear timing, a deterioration could be difficult to attribute or correct. These are hypothetical design problems, not reports of an incident in a Scarlet-assessed product.
The supplier and NHS organisation need a shared interface
Under the applicable English NHS clinical-risk standards, manufacturers and deploying organisations have distinct responsibilities. A more continuous regulatory approach would still need a workable interface between them.
Our proposed operating agreement would specify what the supplier reports, what the adopter monitors, how changes are communicated and who can impose restrictions. It would identify how a concern travels from a clinician to the organisation and supplier, rather than assuming that a general support inbox provides sufficient safety governance.
The agreement should also address continuity. Pausing an AI function may be necessary, but unfinished work and affected outputs remain. Someone must reconcile them and explain any resulting changes to care.
Where investment might help, and where it cannot substitute
Scarlet's October announcement offers one signal of commercial interest in assessment capacity. Our interpretation is that specialist expertise could become more valuable if evidence must be assessed repeatedly as products and uses change. That is a hypothesis about demand, not a measured market forecast or proof that one company will fulfil it.
The limiting resource could instead be local implementation capacity, access to representative outcomes or the authority to coordinate changes across organisations. More certification capacity would not automatically solve those problems.
As described on 13 October 2026, Insights by iatroX offers clinical safety and readiness support. Its relevant contribution is advisory: helping connect claims, hazards, evidence and responsibilities. It is not a claim to implement the Commission's proposed pathway or to replace independent conformity assessment.
Frequently asked questions
Are the September 2026 recommendations already a universal AI approval pathway?
No such pathway is established by the cited recommendations themselves. A supplier must identify the actual applicable requirements and any product-specific permission rather than rely on the announcement.
Does continuous assurance mean certification no longer matters?
No. Initial assessment, change management and monitoring answer connected questions across the product's life, rather than competing for a single role.
What should NHS organisations do while policy develops?
Apply current obligations and make product scope, evidence, monitoring and escalation responsibilities explicit. Preparing those foundations is useful without pretending a proposed regulatory route is already available.