Hi friend,

There are some similarities in how the US, the UK and Europe regulate mental health AI.

They start with the same question: is your AI product a medical device? When it comes to AI, they are all adapting existing medical device frameworks, rather than writing entirely new AI-specific ones.

But after that, the strategies start to diverge.

Europe is layering AI legislation on top of an already complex medical device regime. The UK is redesigning its framework around software and AI while positioning itself closer to some other regulators like the US FDA. 

These differences have strategic implications for leaders of AI mental health organisations considering these markets. The order in which you seek approval could materially affect cost, speed and market access. In Europe and the UK alike, understanding reimbursement pathways — whether Germany's DiGA programme or NICE's role in NHS adoption — is becoming as important as understanding the regulators themselves.

In this Hemingway Guide, we go deep into the regulatory regimes across the UK and Europe, how they’re changing and what that means for leaders navigating these regions.

Let’s get into it. 

To create this series, we’ve teamed up with May Lee, a regulatory professional of 12 years, with expertise in software and AI as medical devices. May has an engineering and legal background, as well as a deep understanding of the complex landscape of AI in healthcare and how it applies to mental health AI products specifically.

If you missed Part I, and want a 101 on medical device regulation and how it applies to mental health AI products in the US, you can read it here.

Become a Hemingway Pro Member

If you’re interested in this article, it’s probably because you want tactical information from experts (like May or myself) on how to navigate common challenges in mental health. If you’d like more of that, and to meet peers building similar businesses, consider becoming a Hemingway Pro member.

As a member, you’ll join over 500 other mental health leaders in our private Slack group and at our invite-only events. You will also get access to exclusive content and resources.

Europe

Key Takeaways for navigating mental health AI in Europe.
Short on time? Here’s what you need to know:

• Separate regulatory approval from commercial access. A CE mark is a license to sell into 30 countries across Europe, but reimbursement is negotiated country by country. If Europe is in your international growth plan, pick the country and payer route first, then work backwards to the regulatory requirement. 

• Expect two regulators, not one. Clinically meaningful mental health AI will usually fall under both the EU Medical Device Regulation (MDR) and the EU AI Act. For most products making therapeutic or diagnostic claims, Rule 11 places software into Class IIa or above, triggering both Notified Body involvement and the AI Act's high-risk obligations. You will likely need to build against the MDR and the AI Act simultaneously. Although those AI Act obligations do not begin to apply until 2 August 2028, the intervening time should not be seen as a relief period. The data governance and technical documentation requirements are difficult to retrofit because regulators are concerned about how you built and trained the product in the first place.  

• Your Notified Body will determine your timeline. It is crucial to identify and engage with your Notified Body earlier than what feels necessary. Ask directly whether they have experience with AI-enabled software, and what their current queue looks like. A Notified Body that cannot review your product on your timeline is a big problem. 

• Watch Rule 11 but do not bank on it. Rule 11 is the provision that pushes most clinically meaningful software into higher-risk classifications requiring a Notified Body. Proposed simplification reforms could materially lower the cost and timeline for lower-risk digital health products. But, most likely, the text will change, so plan against today’s rules and treat the potential revision as an upside. 

Now, let’s get into the details…

The European Regulatory Framework

The starting question in Europe is the same as in the US. Is your product a medical device? And in substance, the test is the same: does it have a medical purpose, i.e. diagnosis, prevention, monitoring, treatment or alleviation of a disease? What differs is nearly everything after. 

EU MDR

There is no European equivalent to the US FDA. Medical devices in the EU are governed by the EU Medical Device Regulation (EU MDR 2017/745), but there is no central agency that reviews and certifies the products. Instead, conformity assessments are carried out by Notified Bodies. These are private organisations designated and monitored by member states. You choose one of these Notified Bodies, you contract with them, and if you prove conformity to the regulations, you are certified as a “CE-marked” product. This CE mark is what lets you place the product on the market across the entire European Economic Area. 

However, not every device needs to go through a Notified Body. Whether you do or not depends on the device's risk classification. Medical devices are divided into four classes: Class I, IIa, IIb and III. Class I devices are generally self-declared, while Class IIa, IIb and III devices require review by a Notified Body before they can be placed on the market.

At the highest level, the classes are intended to reflect the potential risk posed by the device:

• Class I – Low-risk devices. Generally non-invasive or presenting minimal risk to patients. Most are self-certified by the manufacturer.

• Class IIa – Medium-risk devices. Devices require a moderate level of regulatory oversight because they influence diagnosis or treatment or present a greater potential risk.

• Class IIb – Medium-high risk devices. Devices where incorrect performance could have serious consequences, requiring more extensive assessment.

• Class III – Highest-risk devices. Devices that support or sustain life, are implanted long-term, or otherwise present the greatest potential risk to patients.

When it comes to software, the classification rule that matters is Rule 11. Software that provides information used to make decisions for diagnosis or therapeutic purposes lands in Class IIa at a minimum, and higher where the decisions could cause death or serious deterioration. In practice, Rule 11 sweeps almost all clinically meaningful software into Class IIa or above. For a mental health AI product with any therapeutic claim, you can therefore assume that a Notified Body is involved. 

When it comes to the pathways to receive authorisation, there is one structural difference to the US. There is no equivalent of the FDA's De Novo pathway. Unlike the US, the EU never built its medical device regime around predicate devices, so it never needed a separate route for novel technologies.

This clinical evaluation process may sound easier, but often it is not. The binding constraint in Europe is not the absence of a pathway; it is Notified Body capacity. Average Notified Body certification review times run to 12 to 24 months, with actual timelines depending on the novelty, complexity, risk level and notified body capacity. The EU Commission’s own evaluation of the MDR concluded that the framework has produced unnecessary costs, administrative bottlenecks and delays in patient access. Securing a Notified Body that will take on a novel generative AI product, and then waiting in their queue, is what determines your timeline to market. 

EU AI Act

But, wait, there’s more. There is a second rulebook you need to be aware of. The EU AI Act entered into force in August 2024 and sits alongside the EU MDR. For medical device manufacturers, the key question is whether your product is classified as a high-risk AI system. That happens where the AI system:

• is itself a product, or a safety component of one;

• is regulated under legislation listed in the AI Act, including the EU MDR; and

• requires third-party conformity assessment before it can be placed on the market, such as review by a Notified Body.

Because Rule 11 places most clinically meaningful software into Class IIa or above, most mental health AI products making clinical claims will also be high-risk AI systems under the AI Act.

High-risk classification brings obligations that go beyond the MDR: data governance for training and test sets, technical documentation covering training methodology, human oversight design so a clinician can override the system, transparency in instructions for use, logging, robustness and post-market monitoring.

What’s changing

There are two important legislative changes to be aware of. 

In December 2025, the European Commission proposed that AI medical devices should largely fall outside the AI Act's substantive requirements, arguing that the EU MDR already regulates many of the same risks. The proposal was widely welcomed by industry. However, the co-legislators rejected that approach. Under the Digital Omnibus on AI (agreed in March 2026, adopted by Parliament in June and given final approval by the Council on 29 June 2026), AI medical devices remain within the full scope of the AI Act. 

The Omnibus did, however, give the Commission power to reduce duplication. Through future implementing acts, it may disapply specific AI Act requirements where the MDR already provides an equivalent level of protection. Until then, manufacturers should assume they must comply with both regimes.

The second change has not actually happened yet. On 16 December 2025, the European Commission published proposals to simplify the MDR and IVDR — the most significant overhaul since the MDR entered into force. The package aims to reduce administrative burdens by around 30% and save more than €3.3 billion annually.

For digital health, the headline proposal is a rewrite of Rule 11. Under today's rules, clinically meaningful software is typically classified as Class IIa or above, triggering review by a Notified Body. Under the proposal, software that provides a clinical benefit would instead default to Class I, with escalation to higher classes only where it is used in serious or critical clinical situations. If adopted as drafted, it would remove Notified Body involvement for a large population of digital health products. 

That would be a significant shift, but it’s important to call out that this proposal is not yet law. The proposal remains at an early stage; its practical effect is already disputed, and the text is likely to change substantially during negotiations. Adoption is not expected before the second quarter of 2027. Until then, manufacturers should plan against the current MDR, not the proposed one.

How EU Regulators Are Approaching Mental Health AI

There is no dedicated European guidance on mental health AI. Instead, regulators are applying the existing medical device and AI frameworks to mental health products. That should not be mistaken for regulatory inaction, however. Rather than publishing mental health-specific guidance, the EU has chosen to regulate through horizontally applicable legislation.

The AI Act illustrates this approach. Although it contains no provisions aimed specifically at mental health, several of its rules are directly relevant to mental health AI. The Act prohibits AI systems that deploy manipulative or deceptive techniques materially distorting behaviour in ways that cause significant harm, and systems that exploit vulnerabilities arising from age, disability, or a specific social or economic situation. A product designed to maximise engagement among people experiencing depression sits in uncertain territory against that language. The high-risk obligations around human oversight and transparency also map closely onto what the US FDA has been discussing as human-in-the-loop and escalation expectations.

From Authorisation to Reimbursement

Obtaining a CE mark is an important milestone, but of course, it is only a regulatory one. It gives you the right to place a product on the market across the European Economic Area, but it does not determine whether anyone will pay for it. This reimbursement is decided nationally, not at EU level.

Germany’s DiGA programme is the most mature reimbursement pathway for digital health in Europe and the closest thing the continent has to a scaled route from regulatory approval to widespread patient access. Since 2020, BfArM (Bundesinstitut für Arzneimittel und Medizinprodukte, or Federal Institute for Drugs and Medical Devices) has operated a fast-track process under which complete applications must be assessed within three months. Successful products can be prescribed by physicians and psychotherapists and reimbursed through Germany's statutory health insurance system, which covers around 88% of the population. Mental health is actually the largest DiGA category.

The current catalogue offers a helpful lens onto where the market stands today. Most reimbursed mental health products are structured, deterministic CBT-style programmes rather than generative AI systems. As in the United States, no generative AI mental health product has yet been authorised and reimbursed through a mainstream European pathway.

Questions to ask yourself and your team:

• Which single European market are we entering first, and why that one?

• Have we spoken to a Notified Body, and do we know their timelines?

• Is our clinical evidence comparative, or single-arm? DiGA and Notified Bodies will both ask about the clinical strategy.

• Who owns the AI Act readiness internally, and have they read the data governance obligations?

The UK

Key Takeaways for navigating mental health AI in the UK.
Short on time? Here’s what you need to know:

• Do the DMHT qualification assessment properly, and document it. The MHRA is the only major regulator to publish dedicated guidance on digital mental health technologies, including a structured qualification framework with worked examples. Run your product through it, document the reasoning, and keep that assessment. If you conclude you are not a medical device, it becomes part of your regulatory defence. If you conclude you are, you have already started building your technical file. 

• Assume generative AI will be “high functionality”. The MHRA's guidance is explicit that adaptive chatbots and AI-driven assessments are high functionality, making it difficult to argue they sit outside medical device regulation on that basis alone. Teams hoping positioning alone will keep them on the wellness side of the line should test that assumption against the guidance, not their marketing.

• Sequence your markets deliberately. From 2028, an FDA authorisation may open a streamlined route into the UK. An EU CE mark may not. If you’re planning EU first and UK second on the assumption that they are adjacent markets, that assumption no longer holds. US first, UK second may now be the cheaper sequence. 

• Engage with the MHRA early. Through the DMHT guidance, the AI Airlock and the National Commission, the MHRA is actively inviting industry input on questions it acknowledges are still evolving. Companies participating now will gain insight into the regulator's thinking — and may help shape it.

• Plan for NICE as well as the MHRA. Regulatory approval and NHS adoption are separate decisions. Build your evidence strategy with both organisations in mind from the outset. Companies that treat NICE as a downstream consequence of MHRA approval often discover too late that it requires different evidence, different timelines and a different audience.

Now let’s get into the details:

The UK Regulatory Framework

The UK regulator is the Medicines and Healthcare products Regulatory Agency (MHRA). Medical devices are currently regulated under the UK Medical Devices Regulations 2002 (SI 2002/618). Following Brexit, those regulations largely preserve three EU medical device directives from the 1990s. The UK MDR is now widely regarded as outdated. Replacing the UK MDR is MHRA’s central project for the next two years. 

Devices are classified by risk class: Class I, IIa, IIb, and III. Higher classes require assessment by a UK Approved Body. The conformity mark is a UKCA mark. Northern Ireland is separate, however: under the Windsor Framework, it follows EU rules, so CE marking is required there, and UKCA is not recognised.

What’s changing?

The UK's regulatory framework is in transition. 

For now, CE-marked devices remain valid in Great Britain, but only under transitional arrangements. Devices certified under the former EU Directives are recognised until 30 June 2028, while devices certified under the EU MDR or IVDR are recognised until 30 June 2030. Earlier this year, the MHRA consulted on whether CE-marked devices should be recognised indefinitely. It has since confirmed that those proposals will not be taken forward as part of the forthcoming pre-market legislation. Manufacturers should therefore continue to plan on the basis that CE recognition will eventually end.

The replacement framework is now taking shape. On 8 May 2026, the MHRA published the draft Medical Devices (Amendment) Regulations 2026. Adoption is anticipated in December 2026, with the first provisions expected to come into force in June 2027. For mental health AI companies, three proposed reforms stand out.

International reliance. The draft creates a dedicated route to market for devices already authorised by trusted overseas regulators. Lower-risk devices can enter through self-declaration and registration, while higher-risk devices require a Certificate of International Reliance from a UK Approved Body. The recognised jurisdictions are Australia, Canada and the United States. Notably, the European Union is absent from the list, reflecting the UK's decision to treat CE recognition as a separate policy question. The reliance pathway is expected to become available in mid-2028.

Predetermined Change Control Plans (PCCPs). The draft regulations build in predetermined change control for software, alongside new cybersecurity requirements, bringing the UK broadly into line with the FDA. We'll explore PCCPs in more detail in Part III of this series.

Tighter rules on product claims. The draft strengthens restrictions on misleading or unsubstantiated promotional claims. Combined with the qualification approach described below, this narrows the space for careful marketing copy to do regulatory work. 

It should be noted that one important reform has already taken effect; new post-market surveillance requirements came into force in June 2025 and already apply to manufacturers.

How UK Regulators Are Approaching Mental Health AI

The MHRA is the only major regulator in the world to have published dedicated guidance on digital mental health technologies. It came out of a three-year project launched in 2023, funded by Wellcome and run by the MHRA in partnership with NICE, with input from NHS experts, clinicians, researchers, and people with lived experience. 

The DMHT guidance and the functionality test. “Digital mental health technology: qualification and classification” was published in February 2025 and updated in July 2025. It does three things: helps you define intended purpose and functionality, sets out which DMHTs qualify as SaMD, and explains how qualifying products are classified by risk. 

The MHRA assesses both intended purpose and functionality. A product can have a medical purpose and still fall outside medical device regulation if its functionality is low, meaning if it does not provide a clinical effect or influence patient care decisions. 

The guidance provides several illustrative examples. A tool that calculates a PHQ-9 score is considered low functionality. By contrast, systems that adapt to user input — such as a generative AI chatbot or software that dynamically tailors questions before estimating the likelihood of a mental health condition — are classified as high functionality.

If you are building generative AI for mental health, the MHRA has effectively told you in advance which side of the line you are on. Adaptive conversational systems and AI-driven assessments are treated as high functionality, making it difficult to argue that they sit outside the medical device framework on that basis alone.

Functionality, however, is only half of the assessment. The MHRA also asks whether the product has a medical purpose. It applies a two-stage test: first, does the software perform a clinical task falling within the medical device definition; and second, is that task directed at a clinical condition or symptom? Notably, the MHRA interprets "diagnosis" broadly to include risk assessment, profiling, triage and clinical decision support.

Clever marketing copy won't save you. If the MHRA believes your product may be a medical device, manufacturers can be asked to complete a Device Characterisation Form. The regulator looks well beyond headline claims, examining websites, screenshots, labelling, instructions for use, promotional materials and technical documentation to determine a product's intended purpose. This is the same totality-of-evidence approach that we described in the FDA context in Part I. 

UK and EU divergence on medical device classification. The functionality assessment has no clear equivalent under the EU MDR. Many commentators expect the MHRA to apply these principles beyond digital mental health technologies to software as a medical device more broadly. If that happens, the UK and EU would diverge on the threshold question of what counts as a medical device at all. 

The AI Airlock shows a different regulatory philosophy. Launched in 2024, the MHRA's AI Airlock is a regulatory sandbox for AI medical devices. Crucially, it is not an approval pathway. Because no authorisation decision is at stake, companies and regulators can explore difficult questions openly before products reach the market. The pilot ran with 4 companies. Phase 2 brought in 7, including large language models and conversational tools, and tackled predetermined change control plans and the problem of AI devices whose scope quietly expands beyond their intended use. In April 2026, the Department of Health and Social Care committed to £1.2 million per year through 2029, moving it past pilot status. 

Naughty or NICE

Regulatory approval is only the first gate to market access in the UK. MHRA approval does not mean NHS adoption. That decision sits with NICE, which evaluates digital health technologies through programmes such as Early Value Assessment. Under the Government's 10 Year Health Plan, NICE's technology appraisal programme is expanding to cover medical devices, diagnostics and digital health technologies for the first time. For companies targeting the NHS, MHRA approval determines whether you can enter the market; NICE increasingly determines whether the market will adopt you. NICE is similar but different to Germany's DiGA programme. Whereas DiGA is a structured reimbursement pathway, NICE evaluates the clinical and economic value of technologies to inform NHS adoption.

Questions to ask yourself and your team:

• Have we completed and documented a DMHT qualification assessment against the MHRA framework?

• Would our product be characterised as high or low functionality and can we evidence that?

• If the MHRA requested a Device Characterisation Form tomorrow, what would our website and promotional materials tell them?

• Are we in the Airlock conversation, or watching it from the outside?

• Have we deliberately chosen our first regulatory market, and does that sequencing maximise the benefits of international reliance?

• Are we building an evidence strategy for NICE as well as the MHRA?

Final Word

The UK and EU regulatory regimes are similar in many ways but also diverging. The UK is aligning itself with the IMDRF framework and building reliance routes to the US, Canada and Australia while leaving the EU off this list. It is applying a functionality test to qualification that the EU does not use.

The EU, meanwhile, is running its own simplification program on a different timetable and has confirmed that AI-enabled devices stay within the full scope of the EU AI Act. If your market access strategy assumes these UK and EU regulatory requirements are similar or converging, it needs revisiting.

Together, the UK and Europe represent one of the world's largest markets for regulated digital health. Companies that understand both the regulatory and reimbursement pathways will be best placed to build durable competitive advantages.

That’s all for this edition of The Hemingway Report. Many thanks to May Lee for her expert contributions to this piece. In Part III, we will dive deeper into how we should regulate generative AI. We’ll explore Predetermined Change Control Plans, where they can help, their limitations and whether they place undue strain on generative systems.

Finally, if you found this valuable and want more practical guides to building a successful mental health organisation, consider becoming a Hemingway Pro Member. As a member, you will get access to exclusive content and be invited to join our community of mental health innovators.

Keep fighting the good fight!

Steve

Founder of Hemingway