Tag: health app regulation

Once upon a time there was a guy called Ethan, and he loved to write.
  • The UK’s Mental Health App Boom Has a Regulation Problem Nobody Is Talking About

    The UK’s Mental Health App Boom Has a Regulation Problem Nobody Is Talking About

    There are now thousands of mental health apps available to UK consumers. Calm, Wysa, Headspace, Kooth, Woebot, Silvercloud, the list keeps growing. The App Store and Google Play are flooded with products promising to reduce anxiety, improve sleep, treat depression, or help users manage their mood. Some of them are genuinely useful. Some of them are not. And the uncomfortable truth is that most UK consumers have no reliable way to tell the difference, because the framework governing mental health apps regulation UK-wide has serious gaps in it.

    I’ve spent time looking at what oversight actually exists here, and the picture is more fragmented than most people assume. This is not a case of regulators being asleep at the wheel, it is a structural problem built into the way digital health products are classified.

    Person using a mental health app on their smartphone, illustrating the mental health apps regulation UK debate
    Photo by cottonbro studio on Pexels

    What qualifies as a regulated medical device?

    The MHRA (Medicines and Healthcare products Regulatory Agency) oversees software as a medical device (SaMD) in the UK. Since Brexit, the UK has moved away from CE marking for medical devices towards its own UKCA marking, though the MHRA has repeatedly extended transition periods for software. The current framework uses a risk-based classification system: Class I devices are low risk, Class IIa and IIb are moderate risk, and Class III are the highest risk.

    A mental health app that makes a specific diagnostic or therapeutic claim, for example, one that says it is a clinically validated treatment for generalised anxiety disorder, should, in theory, qualify as a SaMD and require MHRA registration. But the classification hinges entirely on the claim the app makes. An app that describes itself as a “wellness tool” or a “mood journal” sits outside that definition, even if its actual functionality is nearly identical to something making clinical claims. Developers are well aware of this, which is why the language used in app store listings is often conspicuously careful.

    The MHRA published updated guidance on software as a medical device in 2023, and it is genuinely thorough. The problem is enforcement capacity and the sheer pace at which new products arrive. Registering a device is not the same as independently verifying the evidence behind it.

    What NICE does, and does not, cover

    The National Institute for Health and Care Excellence has a programme called the Evidence Standards Framework for Digital Health Technologies (DHT), developed in partnership with NHS England. It sets out what evidence digital health tools should provide at different tiers, from simple patient information tools through to products that claim to replace clinical interventions.

    The framework is sound in principle. Tier 3b products, those claiming to treat or diagnose, are expected to provide evidence from randomised controlled trials or equivalent. But participation in the framework is voluntary for commercial products not commissioned through the NHS. An app sold directly to consumers on the App Store has no obligation to submit to NICE review, publish its trial data, or demonstrate that its claimed outcomes hold up in a general UK population. The NHS App Library, which previously listed vetted apps, was quietly wound down. NICE now points users towards a curated but limited set of guidance pages, and the broader consumer market continues largely unvetted.

    Where the CQC fits in, and where it stops

    The Care Quality Commission regulates health and social care services in England, including some digital services. If a mental health app employs regulated professionals who provide clinical advice, a psychiatrist, a psychologist, a counsellor operating under a professional duty of care, the service may fall within CQC registration requirements. But an app that offers automated chatbot therapy, AI-driven cognitive behavioural therapy exercises, or algorithm-generated mood analysis does not automatically require CQC registration, because the service is not being delivered by a regulated professional in a traditional sense.

    This is the gap where a lot of the most popular mental health apps actually sit. The AI element is significant here. As I’ve written before when covering the MHRA’s evolving approach to AI medical devices, the regulatory question of when an algorithm becomes a medical device is genuinely contested. A chatbot that listens, reflects, and suggests breathing exercises exists in a grey zone that neither the MHRA, the CQC, nor any professional regulator definitively owns.

    The evidence problem in practice

    A 2019 review published in npj Digital Medicine analysed 73 depression and anxiety apps available to UK consumers and found that fewer than 4% had been tested in a randomised controlled trial. The situation has improved since, Wysa, for example, has published peer-reviewed studies, and Silvercloud (now Brightside Health) has a reasonable evidence base built from NHS-commissioned research. But the majority of apps in the mental health and wellbeing category make claims that rest on small, industry-funded pilot studies, or no published evidence at all.

    The user reading a five-star review and a vague reference to being “evidence-based” cannot assess the quality of that evidence. And this matters clinically. For someone with mild-to-moderate anxiety who cannot get a GP referral quickly, a reality explored in detail in what I’ve written about the NHS waiting list and the DIY health trap, an app might feel like a reasonable bridge. If the app is genuinely effective, that bridge holds. If it is not, the user may spend months investing time and hope in something that delays them seeking help through other routes.

    There is also a data angle worth taking seriously. Mental health apps collect sensitive personal data at scale: mood logs, sleep patterns, journal entries, sometimes audio. ICO guidance on special category data under UK GDPR applies, and several apps have faced criticism for opaque privacy policies and data sharing arrangements. The ICO and the MHRA technically have overlapping but distinct jurisdictions here, and there is no single point where all of this gets checked together.

    What would actually help

    The honest answer is not more regulation for its own sake. A blanket requirement for every mindfulness app to run a phase three clinical trial would kill useful low-risk tools and drive developers offshore. The more practical solution is clearer labelling and a functional public registry.

    Some version of a tiered trust mark, one that consumers can actually look up and verify, backed by the MHRA or NHS England, would give the market a credibility signal that is currently absent. NHS Digital, before it was folded into NHS England, attempted something like this with the App Library. The logic was right; the execution and resourcing were not.

    For now, my practical advice to anyone considering a mental health app is this: look for published peer-reviewed trials, check whether the app is listed in current NHS England pathways, and treat any app claiming to “treat” a named condition with the same scepticism you would apply to any other unverified therapeutic claim. Apps that are upfront about being wellness tools rather than clinical interventions are being more honest, not less useful.

    The mental health apps regulation UK landscape is not broken in an obvious, dramatic way. It is just porous in ways that are invisible to most users, and that invisibility is the actual problem.

    Frequently Asked Questions

    Are mental health apps regulated in the UK?

    Some are. Apps that make specific clinical or diagnostic claims may need to register with the MHRA as software as a medical device. However, apps marketed as wellness tools fall outside this requirement, which means a large portion of the market operates without formal regulatory oversight of their claimed benefits.

    What does UKCA marking mean for a health app?

    UKCA marking is the post-Brexit UK conformity assessment mark that replaces CE marking for medical devices sold in Britain. For a mental health app, it would signal the product has been assessed against MHRA standards as a software medical device. In practice, transition periods have been extended repeatedly and the mark is rare on consumer-facing apps.

    Does NICE endorse specific mental health apps?

    NICE has an Evidence Standards Framework for Digital Health Technologies, which sets out what evidence apps should provide. However, commercial apps sold directly to consumers are not required to go through this process. Only apps commissioned by the NHS through formal procurement pathways face meaningful scrutiny against NICE standards.

    What data do mental health apps collect and who regulates that?

    Mental health apps typically collect sensitive personal data including mood logs, journal entries, and behavioural patterns. This falls under special category data rules in UK GDPR, regulated by the ICO. However, the ICO and MHRA operate separately, so there is no single point of oversight that covers both clinical claims and data handling together.

    How can I tell if a mental health app is actually evidence-based?

    Look for published peer-reviewed studies in indexed journals rather than vague references to being ‘clinically validated’. Check whether the app appears in NHS England clinical pathways or has been reviewed under the NICE DHT framework. Treat industry-funded pilot studies with caution, and prefer apps that are transparent about the limits of what they can and cannot do.

  • The MHRA’s New Approach to AI Medical Devices: What It Means for the Apps Diagnosing and Monitoring You

    The MHRA’s New Approach to AI Medical Devices: What It Means for the Apps Diagnosing and Monitoring You

    If you have ever used an app to log symptoms, interpret a blood glucose reading, or get a personalised health recommendation, there is a real chance you have interacted with something that the MHRA considers a medical device. Most people have no idea that category exists, let alone what it requires of the companies building these tools. The MHRA AI medical device regulation UK framework is one of the most consequential and least-discussed shifts in British healthcare right now, and it is worth understanding in plain terms.

    NHS clinician reviewing a health app on a tablet, relevant to MHRA AI medical device regulation UK
    Photo by Tima Miroshnichenko on Pexels

    What the MHRA actually classifies as a medical device in software

    The MHRA’s Software and AI as a Medical Device (SaMD) framework draws a clear line: if a piece of software is intended to be used for a medical purpose, it falls under regulatory oversight. That includes diagnosing a condition, predicting deterioration, monitoring a chronic illness, or informing a treatment decision. General wellness apps, step counters, and sleep trackers that make no medical claims sit outside this definition. The moment an app says it can detect an arrhythmia, flag early signs of diabetic retinopathy, or suggest a medication adjustment, it crosses the line.

    The MHRA uses a risk-based classification system, running from Class I (lowest risk) up to Class III (highest risk). Most AI-driven diagnostic tools land in Class IIa or IIb, which requires a Conformity Assessment carried out by a UK Approved Body. Developers must maintain a technical file that includes clinical evidence, details of the algorithm’s training data, and a post-market surveillance plan. For Class IIb and above, that plan must be proactive, not reactive. The MHRA’s published guidance on AI as a medical device lays out the current framework in detail, including the 2024 roadmap updates that are now being implemented.

    How the UK framework differs from what came before

    Prior to the UK leaving the EU’s regulatory orbit, software developers could rely on CE marking under the EU MDR. Since then, the MHRA has been building its own regime, and the UK Conformity Assessed (UKCA) mark is now the requirement for Great Britain. The MHRA published its “Software and AI as a Medical Device Change Programme” in stages from 2022 onwards, and the 2026 position is that manufacturers must demonstrate what the regulator calls “safe and effective performance” throughout the entire product lifecycle, not just at launch.

    What makes this genuinely different for AI tools is the acknowledgement of continuous learning. An algorithm that updates itself based on new patient data is not the same product it was six months ago. The MHRA’s framework addresses this with the concept of predetermined change control plans, meaning developers must specify in advance what kinds of changes they anticipate the model making and get those parameters approved. That is a meaningful shift from how software regulation has historically worked, where a product was reviewed once and then largely left alone.

    What developers are required to demonstrate

    In practical terms, a company seeking approval for an AI-driven diagnostic app needs to show several things. Clinical validation is the big one. The algorithm must be tested against the population it will actually serve, not just the dataset it was trained on. This matters enormously because training data bias is a real and documented problem. An ECG algorithm trained predominantly on data from white men in their forties will perform differently on South Asian women in their sixties, and the MHRA expects developers to account for that explicitly.

    Beyond clinical evidence, developers must provide transparency about how the algorithm reaches its outputs. That does not necessarily mean publishing the model weights, but it does mean producing documentation that allows a clinician to understand the basis for a recommendation. There is also a usability requirement: the interface must be tested with real users to ensure the information is presented in a way that supports safe decision-making rather than creating confusion or misplaced confidence.

    Post-market surveillance is where many smaller developers struggle. They are required to collect real-world performance data after launch, track adverse events, and submit periodic safety update reports. For a well-funded medtech company this is manageable. For a startup with a lean team, the administrative burden is substantial, and I would argue that is partly why so many health apps quietly drop medical claims from their marketing to avoid classification altogether.

    Where the gaps still are

    The framework is improving, but several gaps remain. Enforcement is the most obvious. The MHRA does not have the resource to proactively audit every app marketed to UK users. In practice, most enforcement is complaint-driven, which means a poorly validated tool can operate for months or years before anyone formally challenges it. This is particularly concerning given how many AI-driven health apps are marketed directly to consumers via app stores, where the App Store and Google Play review processes have no meaningful medical device checkpoint.

    International products are another complexity. An app developed in the US, Canada, or elsewhere, marketed to UK users, technically requires UKCA marking if it makes medical claims. In reality, many do not have it, and the MHRA’s ability to pursue overseas developers is limited. Given the rapid growth of AI wearables and monitoring platforms, this is not a small edge case.

    There is also a definitional grey area around generative AI tools used in health contexts. A large language model that answers questions about symptoms is almost certainly providing information, not diagnosis, and therefore sits outside SaMD classification. But that line is blurring. If a tool consistently recommends specific courses of action based on symptom inputs, at what point does it become a diagnostic aid? The MHRA has signalled it is watching this space closely, but firm guidance is still in progress.

    What this means if you use health apps

    As a consumer, you have limited visibility into whether a given app has gone through proper regulatory review. A few practical checks help. If an app makes medical claims, look for a UKCA mark or CE mark in the product documentation (many legitimate medical device apps display this in their terms or in app store listings). Check whether the company publishes a clinical evidence summary. If they do not, ask yourself why. Apps that have genuinely validated their algorithms tend to say so clearly because it is a genuine competitive advantage.

    The MHRA maintains a register of certified medical devices, though navigating it is not exactly user-friendly. It is worth knowing that the NHS App and NHS-commissioned digital tools are held to a higher standard, going through NHS England’s Digital Technology Assessment Criteria (DTAC) as well as MHRA requirements. That dual-layer review gives NHS-approved tools more credibility than consumer apps operating solely on the basis of self-declaration.

    The regulatory picture for AI in health is improving, but slowly. The gap between what technology can claim and what it has rigorously demonstrated is still wide in places. For anyone relying on an app to inform decisions about their health, that gap is worth keeping front of mind.

    If you are thinking about how digital health tools intersect with NHS systems and patient data, the questions raised about NHS diagnostic pathways and patient experience are closely connected. And the broader question of how UK adults manage their health with limited NHS access is part of why so many people turn to consumer apps in the first place. Understanding what those apps are, and are not, legally required to prove is a reasonable starting point for anyone trying to make informed choices.

The Latest