---
title: "The Regulation of AI in Healthcare: Device provenance is covered. Data provenance is the missing piece of the puzzle"
description: "The Regulation of AI in Healthcare: Device provenance is covered. Data provenance is the missing piece of the puzzle"
image: https://metadataworks.ai/hubfs/tanja-tepavac-cWMhxNmQVq0-unsplash.jpg
---

[Skip to content](https://metadataworks.ai/blog/the-regulation-of-ai-in-healthcare-device-provenance-is-covered.-data-provenance-is-the-missing-piece-of-the-puzzle#main-content)

[![](https://metadataworks.ai/hubfs/header-logo.svg)](https://metadataworks.ai/)

- [About Us](https://metadataworks.ai/about-us)
- [Our Solution](https://metadataworks.ai/solutions)
- [Our Clients](https://metadataworks.ai/case-studies)
- [Contact](https://metadataworks.ai/contact)
- [Insights](https://metadataworks.ai/insights)

Open main navigation

Close main navigation

- [About Us](https://metadataworks.ai/about-us)
- [Our Solution](https://metadataworks.ai/solutions)
- [Our Clients](https://metadataworks.ai/case-studies)
- [Contact](https://metadataworks.ai/contact)
- [Insights](https://metadataworks.ai/insights)
- [Book a Demo](https://metadataworks.ai/demo)

[Book a Demo](https://metadataworks.ai/demo)

[All posts](https://metadataworks.ai/blog/all)

 October 13, 2026

# The Regulation of AI in Healthcare: Device provenance is covered. Data provenance is the missing piece of the puzzle

![Picture of Adam](https://metadataworks.ai/hs-fs/hubfs/adam.jpeg?width=50&name=adam.jpeg) By  [Adam](https://metadataworks.ai/blog/author/adam)  ·   3 minute read

Last week the Government accepted all 44 recommendations of the National Commission into the Regulation of AI in Healthcare. In full, rather than in principle — which is rarer than it sounds. The Commission was led by NHS doctors, chaired by Professor Alastair Denniston with Professor Henrietta Hughes OBE as deputy chair, and the Government's response was published on 6 October.

I wrote a short post about it on Linked In on the day the decision was announced, but I’ve been thinking more about it since so here we are with a follow up.

The Shift

The headline is a change in how AI-enabled medical devices get judged. In the Government's own words, they "should be assessed and monitored throughout their working life", rather than "over-relying on one-time assessments."

That seems right to me. A one-time assessment was always an odd fit for a product that keeps changing after it ships. The Commission put it well back in September: these products "may iterate rapidly, perform differently in different settings" and "depend on the data, workflows, people and organisations around them."

Keep that last clause in mind because it does a lot of work later.

Where the machinery sits

The interesting part isn't in the announcement. It's in the response document underneath it, and two recommendations carry most of the weight.

Recommendation 8 covers devices built on top of general-purpose models. It asks the Medicines and Healthcare products Regulatory Agency (MHRA), the Department of Health and Social Care and the devolved health departments to "consider how to obtain the necessary information" where a product has "an underlying dependency on a general-purpose model." The Government's response is more specific than the recommendation it answers — the MHRA will give guidance on what manufacturers must supply, "including provenance, nature, dependencies, related risks and their controls."

Recommendation 20 asks for mechanisms to identify devices once they're deployed, "including appropriate version control", so there's traceability across a device's life — with traceability information "routinely recorded as part of the patient record." The Government has committed the MHRA to guidance on mandatory unique device identifiers.

Put those together and you get something genuinely useful: which device, which version, authorised when, recorded against the patient who was treated. That's the difference between knowing AI was involved in someone's care and being able to go back and audit what actually happened. Without it, monitoring across a working life would be close to impossible.

Both commitments carry the same timeline — further detail by Spring 2027.

The part that isn't covered

Here's what I keep coming back to.

We are going to track a device's provenance with real care. Version, identifier, dependency, authorisation date, all the way into the patient record. Meanwhile the data that device was tuned on, runs on, and was evaluated against gets nothing equivalent.

That matters because data is where a lot of the drift comes from. A model that performed well at validation can perform differently a year later without a line of its code changing, because the data flowing into it has moved — new coding practice, a different case mix, an upstream system that started populating a field it used to leave blank. If you can trace the device perfectly but can't characterise the data, you can see that performance changed without being able to say why.

I should be fair about what the response does say. Recommendation 13 is the closest it comes: the Government commits to guidance addressing "expectations for representative data", alongside evaluation across relevant groups and ongoing monitoring. That's a real commitment and I don't want to wave it away.

But representativeness and provenance are different questions. Representativeness asks whether a dataset covers the population fairly — an equity question, and an important one. Provenance asks where this data came from, what was done to it, under what definitions, and whether it still means the same thing it meant last year. You can have a perfectly representative dataset that nobody can account for. And recommendation 13's answer is future guidance rather than a documented standard.

Beyond that, and beyond a summary on a model card, there isn't a requirement for data to carry any kind of quality stamp.

What I'm not asking for

Not open training data from the frontier labs. That's a big ask, probably an unrealistic one, and arguing for it would get this nowhere.

The narrower ask is more defensible: where a model has been tuned on data, runs on data, or was evaluated against data, that data should carry something. Not a 200-page dossier. A stamp — what it is, where it came from, what's been done to it, which definitions it uses, when it was last checked, and who vouches for it. The data is the input and it should be quality assured. The model is the processing and it should be quality controlled. Right now the second has a regulatory home and the first doesn't.

None of that requires moving data anywhere, incidentally. It requires describing it well, consistently, where it already sits — which is a metadata problem and a standards problem rather than an infrastructure one.

Spring 2027

That's when the MHRA has promised more detail on provenance. From where I'm sitting, that's the moment to decide whether provenance stops at the device or extends to what the device was fed.

The Commission already said these products depend on the data around them. The regulation just needs to catch up with its own sentence.

Share: [facebook-f icon](http://www.facebook.com/share.php?u=https://metadataworks.ai/blog/the-regulation-of-ai-in-healthcare-device-provenance-is-covered.-data-provenance-is-the-missing-piece-of-the-puzzle) [linkedin-in icon](http://www.linkedin.com/shareArticle?mini=true&url=https://metadataworks.ai/blog/the-regulation-of-ai-in-healthcare-device-provenance-is-covered.-data-provenance-is-the-missing-piece-of-the-puzzle) [twitter icon](https://twitter.com/intent/tweet?url=https://metadataworks.ai/blog/the-regulation-of-ai-in-healthcare-device-provenance-is-covered.-data-provenance-is-the-missing-piece-of-the-puzzle) [pinterest-p icon](http://pinterest.com/pin/create/link/?url=https://metadataworks.ai/blog/the-regulation-of-ai-in-healthcare-device-provenance-is-covered.-data-provenance-is-the-missing-piece-of-the-puzzle) [envelope icon](mailto:?body=https://metadataworks.ai/blog/the-regulation-of-ai-in-healthcare-device-provenance-is-covered.-data-provenance-is-the-missing-piece-of-the-puzzle)

[![header-logo](https://metadataworks.ai/hubfs/header-logo.svg)](https://metadataworks.ai/home)

Amplify data impact

[![linkedin-round-icon](https://metadataworks.ai/hs-fs/hubfs/linkedin-round-icon-2048x2048-jufaif8u.png?width=40&height=40&name=linkedin-round-icon-2048x2048-jufaif8u.png)](https://www.linkedin.com/company/35531176/admin/dashboard/)[![x-twitter-logo-on-black-circle-5694247](https://metadataworks.ai/hs-fs/hubfs/x-twitter-logo-on-black-circle-5694247.png?width=40&height=40&name=x-twitter-logo-on-black-circle-5694247.png)](https://x.com/MetadataW)<https://www.linkedin.com/company/35531176/admin/dashboard/>

 

**COMPANY**

 

[Home](https://metadataworks.ai/home)

[Contact](https://metadataworks.ai/contact)

[Careers](mailto:hello@metadataworks.co.uk)

**PLATFORM**

[Solutions](https://metadataworks.ai/solutions)

[Case Studies](https://metadataworks.ai/case-studies)

[Demo](mailto:hello@metadataworks.co.uk)

**LEGAL**

[Privacy Policy](https://metadataworks.ai/privacy-policy)

[Accessibility Statement](https://metadataworks.ai/accessibility-statement)

[Cookies](https://metadataworks.ai/cookies)

Copyright © 2026, Metadataworks

```json
{
  "@context" : "https://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Adam",
    "url" : "https://metadataworks.ai/blog/author/adam"
  },
  "dateModified" : "2026-10-13T17:28:44.921Z",
  "datePublished" : "2026-10-13T17:28:44.000Z",
  "headline" : "The Regulation of AI in Healthcare: Device provenance is covered. Data provenance is the missing piece of the puzzle",
  "image" : [ "https://metadataworks.ai/hubfs/tanja-tepavac-cWMhxNmQVq0-unsplash.jpg" ],
  "mainEntityOfPage" : {
    "@id" : "https://metadataworks.ai/blog/the-regulation-of-ai-in-healthcare-device-provenance-is-covered.-data-provenance-is-the-missing-piece-of-the-puzzle",
    "@type" : "WebPage"
  },
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "url" : "https://metadataworks.ai/hubfs/header-logo.svg"
    }
  }
}
```

```json
{
  "@context" : "http://schema.org",
  "@type" : "Article",
  "author" : {
    "@type" : "Person",
    "name" : [ "Adam" ],
    "url" : "https://metadataworks.ai/blog/author/adam"
  },
  "datePublished" : "2026-10-13T17:28:44+0000",
  "description" : "The Regulation of AI in Healthcare: Device provenance is covered. Data provenance is the missing piece of the puzzle",
  "headline" : "The Regulation of AI in Healthcare: Device provenance is covered. Data provenance is the missing piece of the puzzle",
  "image" : "https://25578497.fs1.hubspotusercontent-eu1.net/hubfs/25578497/tanja-tepavac-cWMhxNmQVq0-unsplash.jpg",
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "url" : "https://25578497.fs1.hubspotusercontent-eu1.net/hubfs/25578497/header-logo.svg"
    },
    "name" : "Metadataworks"
  },
  "url" : "https://metadataworks.ai/blog/the-regulation-of-ai-in-healthcare-device-provenance-is-covered.-data-provenance-is-the-missing-piece-of-the-puzzle"
}
```