There are now thousands of mental health apps available to UK consumers. Calm, Wysa, Headspace, Kooth, Woebot, Silvercloud, the list keeps growing. The App Store and Google Play are flooded with products promising to reduce anxiety, improve sleep, treat depression, or help users manage their mood. Some of them are genuinely useful. Some of them are not. And the uncomfortable truth is that most UK consumers have no reliable way to tell the difference, because the framework governing mental health apps regulation UK-wide has serious gaps in it.
I’ve spent time looking at what oversight actually exists here, and the picture is more fragmented than most people assume. This is not a case of regulators being asleep at the wheel, it is a structural problem built into the way digital health products are classified.
What qualifies as a regulated medical device?
The MHRA (Medicines and Healthcare products Regulatory Agency) oversees software as a medical device (SaMD) in the UK. Since Brexit, the UK has moved away from CE marking for medical devices towards its own UKCA marking, though the MHRA has repeatedly extended transition periods for software. The current framework uses a risk-based classification system: Class I devices are low risk, Class IIa and IIb are moderate risk, and Class III are the highest risk.
A mental health app that makes a specific diagnostic or therapeutic claim, for example, one that says it is a clinically validated treatment for generalised anxiety disorder, should, in theory, qualify as a SaMD and require MHRA registration. But the classification hinges entirely on the claim the app makes. An app that describes itself as a “wellness tool” or a “mood journal” sits outside that definition, even if its actual functionality is nearly identical to something making clinical claims. Developers are well aware of this, which is why the language used in app store listings is often conspicuously careful.
The MHRA published updated guidance on software as a medical device in 2023, and it is genuinely thorough. The problem is enforcement capacity and the sheer pace at which new products arrive. Registering a device is not the same as independently verifying the evidence behind it.
What NICE does, and does not, cover
The National Institute for Health and Care Excellence has a programme called the Evidence Standards Framework for Digital Health Technologies (DHT), developed in partnership with NHS England. It sets out what evidence digital health tools should provide at different tiers, from simple patient information tools through to products that claim to replace clinical interventions.
The framework is sound in principle. Tier 3b products, those claiming to treat or diagnose, are expected to provide evidence from randomised controlled trials or equivalent. But participation in the framework is voluntary for commercial products not commissioned through the NHS. An app sold directly to consumers on the App Store has no obligation to submit to NICE review, publish its trial data, or demonstrate that its claimed outcomes hold up in a general UK population. The NHS App Library, which previously listed vetted apps, was quietly wound down. NICE now points users towards a curated but limited set of guidance pages, and the broader consumer market continues largely unvetted.
Where the CQC fits in, and where it stops
The Care Quality Commission regulates health and social care services in England, including some digital services. If a mental health app employs regulated professionals who provide clinical advice, a psychiatrist, a psychologist, a counsellor operating under a professional duty of care, the service may fall within CQC registration requirements. But an app that offers automated chatbot therapy, AI-driven cognitive behavioural therapy exercises, or algorithm-generated mood analysis does not automatically require CQC registration, because the service is not being delivered by a regulated professional in a traditional sense.
This is the gap where a lot of the most popular mental health apps actually sit. The AI element is significant here. As I’ve written before when covering the MHRA’s evolving approach to AI medical devices, the regulatory question of when an algorithm becomes a medical device is genuinely contested. A chatbot that listens, reflects, and suggests breathing exercises exists in a grey zone that neither the MHRA, the CQC, nor any professional regulator definitively owns.
The evidence problem in practice
A 2019 review published in npj Digital Medicine analysed 73 depression and anxiety apps available to UK consumers and found that fewer than 4% had been tested in a randomised controlled trial. The situation has improved since, Wysa, for example, has published peer-reviewed studies, and Silvercloud (now Brightside Health) has a reasonable evidence base built from NHS-commissioned research. But the majority of apps in the mental health and wellbeing category make claims that rest on small, industry-funded pilot studies, or no published evidence at all.
The user reading a five-star review and a vague reference to being “evidence-based” cannot assess the quality of that evidence. And this matters clinically. For someone with mild-to-moderate anxiety who cannot get a GP referral quickly, a reality explored in detail in what I’ve written about the NHS waiting list and the DIY health trap, an app might feel like a reasonable bridge. If the app is genuinely effective, that bridge holds. If it is not, the user may spend months investing time and hope in something that delays them seeking help through other routes.
There is also a data angle worth taking seriously. Mental health apps collect sensitive personal data at scale: mood logs, sleep patterns, journal entries, sometimes audio. ICO guidance on special category data under UK GDPR applies, and several apps have faced criticism for opaque privacy policies and data sharing arrangements. The ICO and the MHRA technically have overlapping but distinct jurisdictions here, and there is no single point where all of this gets checked together.
What would actually help
The honest answer is not more regulation for its own sake. A blanket requirement for every mindfulness app to run a phase three clinical trial would kill useful low-risk tools and drive developers offshore. The more practical solution is clearer labelling and a functional public registry.
Some version of a tiered trust mark, one that consumers can actually look up and verify, backed by the MHRA or NHS England, would give the market a credibility signal that is currently absent. NHS Digital, before it was folded into NHS England, attempted something like this with the App Library. The logic was right; the execution and resourcing were not.
For now, my practical advice to anyone considering a mental health app is this: look for published peer-reviewed trials, check whether the app is listed in current NHS England pathways, and treat any app claiming to “treat” a named condition with the same scepticism you would apply to any other unverified therapeutic claim. Apps that are upfront about being wellness tools rather than clinical interventions are being more honest, not less useful.
The mental health apps regulation UK landscape is not broken in an obvious, dramatic way. It is just porous in ways that are invisible to most users, and that invisibility is the actual problem.
Frequently Asked Questions
Are mental health apps regulated in the UK?
Some are. Apps that make specific clinical or diagnostic claims may need to register with the MHRA as software as a medical device. However, apps marketed as wellness tools fall outside this requirement, which means a large portion of the market operates without formal regulatory oversight of their claimed benefits.
What does UKCA marking mean for a health app?
UKCA marking is the post-Brexit UK conformity assessment mark that replaces CE marking for medical devices sold in Britain. For a mental health app, it would signal the product has been assessed against MHRA standards as a software medical device. In practice, transition periods have been extended repeatedly and the mark is rare on consumer-facing apps.
Does NICE endorse specific mental health apps?
NICE has an Evidence Standards Framework for Digital Health Technologies, which sets out what evidence apps should provide. However, commercial apps sold directly to consumers are not required to go through this process. Only apps commissioned by the NHS through formal procurement pathways face meaningful scrutiny against NICE standards.
What data do mental health apps collect and who regulates that?
Mental health apps typically collect sensitive personal data including mood logs, journal entries, and behavioural patterns. This falls under special category data rules in UK GDPR, regulated by the ICO. However, the ICO and MHRA operate separately, so there is no single point of oversight that covers both clinical claims and data handling together.
How can I tell if a mental health app is actually evidence-based?
Look for published peer-reviewed studies in indexed journals rather than vague references to being ‘clinically validated’. Check whether the app appears in NHS England clinical pathways or has been reviewed under the NICE DHT framework. Treat industry-funded pilot studies with caution, and prefer apps that are transparent about the limits of what they can and cannot do.