Governance of AI-Enabled Digital Health Systems: Integrating Clinical Safety, Cybersecurity, Interoperability and Regulatory Compliance in the NHS

Abstract

Digital health technologies, including mobile applications, clinical decision-support systems, software-based medical technologies and artificial intelligence (AI)-enabled tools, are increasingly integrated into healthcare delivery. Within the UK National Health Service (NHS), these technologies offer opportunities to improve patient outcomes, operational efficiency and data-driven clinical decision-making. Their implementation, however, introduces complex challenges relating to medical device qualification and classification, clinical safety, cybersecurity, interoperability, data governance and regulatory compliance.

This study examines the regulatory and governance frameworks applicable to AI-enabled digital health and medical device systems within the NHS, with particular emphasis on the Clinical Risk Management Standards DCB0129 and DCB0160, the Digital Technology Assessment Criteria (DTAC), and relevant UK medical device regulatory requirements. A structured literature review was conducted using PubMed, covering publications between 2015 and 2025. Sixty studies were included and analysed using a narrative synthesis approach to identify recurring regulatory, technical and governance challenges associated with the implementation and lifecycle management of digital health technologies.

The findings indicate that existing NHS frameworks provide an important foundation for clinical safety, data protection, cybersecurity and organisational assurance. However, their application becomes increasingly complex for interconnected and adaptive AI-enabled systems. Key challenges include uncertainty in medical device qualification and regulatory classification, fragmentation across governance requirements, algorithmic bias and explainability, data integrity, cybersecurity vulnerabilities, interoperability, limitations in conventional evaluation approaches, and the need for continuous monitoring of system performance following implementation.

Drawing on these findings, this study proposes a Unified NHS AI Governance and Compliance Model that integrates medical device qualification and regulatory classification with clinical safety, data protection, cybersecurity, usability and accessibility, interoperability, and data and AI workflow governance. The model provides a structured lifecycle approach to support early determination of regulatory requirements, clearer allocation of organisational responsibilities, proportionate risk assessment, implementation assurance and post-deployment monitoring.

The study concludes that governance of AI-enabled digital health and medical device technologies should evolve towards a more integrated, adaptive and risk-based approach that aligns medical device regulation with wider digital-health assurance requirements. Although developed within the NHS context, the proposed framework may provide a transferable governance approach for healthcare organisations implementing complex, interoperable and AI-enabled digital technologies.