Is Your Dental AI a Medical Device? A Principal’s Guide to UKCA

A rep sits in your staff room with a laptop. Bitewings come up on screen, boxes appear over two molars, and a number appears next to each box: 0.87, 0.61. “It’s not diagnosing,” they say. “It’s decision support. The dentist always decides.”

That sentence is doing an enormous amount of work, and in Great Britain it is usually wrong.

Here is the test that matters, and it takes one line to apply. If the tool tells you something is present in a patient, it is a medical device. Not “helps you look.” Not “supports your workflow.” If the output of the software is a statement about that patient’s pathology, physiology or clinical risk, it falls inside the Medical Devices Regulations 2002 (SI 2002/618, as amended), it needs a UKCA mark or an accepted CE mark, and it needs to be registered with the MHRA before anyone sells it to you. Everything else in this article is detail.

What the law actually keys off

The regulations define a medical device by intended purpose, and intended purpose is set by the manufacturer. Crucially, it is set by everything the manufacturer says: the website, the brochure, the conference stand, the demo your practice manager sat through. A disclaimer in clause 14.3 of the terms of service saying “for informational purposes only, not intended for diagnosis” does not undo a homepage that says “detects caries with 94% sensitivity.” Regulators read both. So should you.

Run three real product categories through it.

That last row is where a lot of front-desk and note-taking AI is quietly drifting. A scribe that transcribes is admin. A scribe that infers is a device. Ask to see the actual drafted note, not the marketing version of it, and read what the software wrote in the findings field.

The named tools, and what they actually hold

Some concrete grounding, because the market is small enough to name. Pearl’s Second Opinion has FDA 510(k) clearance, granted in March 2022, covering detection of multiple conditions on adult bitewing and periapical radiographs. Overjet holds FDA clearances spanning caries detection and radiographic bone-level measurement. VideaHealth came out of MIT with FDA-cleared detection of its own. Diagnocat carries a CE mark for its 2D and CBCT analysis.

None of those sentences contains the word UKCA, and that is the point. FDA clearance has no legal standing in Great Britain whatsoever. It is a US regulatory decision made against US rules, and a vendor who leads with it in a UK sales meeting is either confused or hoping you are. A CE mark, on the other hand, is currently fine: the MHRA accepts CE-marked general medical devices on the GB market until 30 June 2028 for legacy MDD certificates and 30 June 2030 for EU MDR ones. Northern Ireland runs on EU rules under the Windsor Framework, so a practice in Belfast is asking a slightly different question from one in Bolton.

So the real dividing line for you is not UKCA versus CE. It is regulated versus unregistered. A tool with valid CE marking and MHRA registration is legitimate today. A tool with neither, making diagnostic claims, is being placed on the GB market unlawfully, and you are the one putting it in front of patients.

The Class I trap in UKCA marking for dental software

Now the part almost nobody in practice knows. GB still runs on rules derived from the old Medical Devices Directive, and under that classification scheme, software that analyses an already-captured radiograph usually does not supply energy, image radiopharmaceuticals or monitor vital physiological processes. It therefore drops through Rule 10 and lands on Rule 12: Class I.

Class I means self-declaration. No UK Approved Body reviews the clinical evidence. The manufacturer writes its own technical file, signs its own declaration, registers with the MHRA and applies the UKCA mark itself. The same product sold in Dublin would be Class IIa under EU MDR Rule 11, with a notified body reviewing the clinical evaluation and auditing the quality system annually.

Read that again, because it changes what a UKCA mark tells you. A UKCA mark on dental software is not, by itself, evidence that anyone independent checked whether the caries detection works. It is evidence that a legal entity took responsibility and can be held to account. That is worth a great deal, and it is not the same thing. When you see “UKCA, Class I, self-declared,” your next question is: show me the clinical evaluation report and the sensitivity and specificity on a dataset that wasn’t yours.

The eleven-minute due diligence

You do not need a regulatory consultant for the first pass. You need a browser and a demo licence.

Search the MHRA Public Access Registration Database for the manufacturer and the product name. GB registration is mandatory for every class, including Class I. If the product makes a diagnostic claim and does not appear, stop there.

Find the mark inside the software. For software devices, the UKCA or CE mark and the manufacturer details sit in the electronic labelling: Help, then About, or an information icon on the splash screen. If a sales engineer cannot find it in their own product in under two minutes, that is your answer.

Ask for the Declaration of Conformity as a PDF. It should contain, at minimum:

DECLARATION OF CONFORMITY
Manufacturer:           <legal entity + registered address>
UK Responsible Person:  <name + GB address>    required if manufacturer is outside the UK
Product:                <trade name + software VERSION, e.g. 2.4.1>
Risk class:             Class I / IIa / IIb   (UK MDR 2002, Annex IX)
Conformity route:       self-declaration  OR  <UK Approved Body name + number>
Intended purpose:       <the sentence that decides everything>
MHRA registration no.:  <number>
Legislation:            Medical Devices Regulations 2002 (SI 2002/618), as amended

Two fields deserve particular attention. Version number, because a mark covers a specific release and AI vendors push model updates continuously; ask what their change-control process is when the model is retrained. Intended purpose, because if it reads “image enhancement” while the product is boxing carious lesions on your screen, the device is being used outside its stated purpose and the manufacturer’s liability evaporates.

Why this lands on you and not the vendor

Three things happen when the tool is unregistered and a lesion is missed.

First, the product liability route closes. A properly registered device has a manufacturer with post-market surveillance duties, a vigilance system and reporting deadlines: since the post-market surveillance regulations came into force on 16 June 2025, serious incidents must be reported to the MHRA within 15 days, tightening to 10 days for death or serious deterioration and 2 days for a serious public health threat. No registration means no such chain exists. The expert’s report has only one professional in it: you.

Second, the record works against you. IR(ME)R 2017 requires a clinical evaluation of the outcome of every exposure to be recorded. If your notes show an AI overlay and no independent evaluation, you have documented delegation of a duty that regulations place on the practitioner. The GDC’s Standards for the Dental Team, principle 7, requires you to work within your knowledge and skills; “the software flagged it green” is not a defence anyone has won on.

Third, NHS contracting expects governance you may not have. DTAC is the assessment framework commissioners use, and it references DCB0129 for manufacturers and DCB0160 for the deploying organisation. DCB0160 is yours: a named Clinical Safety Officer and a clinical safety case file for the tool as used in your practice. Add a DPIA, which the ICO treats as mandatory for AI processing special category health data at any scale worth the name. Our wider guide to regulation, data and governance walks through how these stack for a mixed NHS and private practice.

The trap you can walk into by yourself

Building rather than buying does not escape the regime. If your practice wires a general-purpose language model into a triage form so patients describe symptoms and receive an urgency rating, your practice has become the manufacturer of a medical device. The in-house exemption is narrow and it carries its own documentation obligations; it is not a free pass. A practice manager who spent a weekend automating the emergency line with a chatbot has, in regulatory terms, done something considerably braver than they realise.

So send this before you sign anything:

1. Is <product> registered with the MHRA as a medical device? Registration number?
2. UKCA or CE, which, class, and which UK Approved Body if any?
3. Please attach the Declaration of Conformity and the stated intended purpose verbatim.
4. Which software version does the mark cover, and what happens when the model is retrained?
5. Sensitivity and specificity for each detection, on what dataset, against what reference standard?
6. Do you supply a DCB0129 clinical safety case and hazard log for our DCB0160 file?
7. Who is your UK Responsible Person?

Seven questions, one email. Any vendor selling legitimately answers them in a day and is usually glad to; the answers are already sitting in their regulatory folder. The ones who send back a paragraph about being decision support and not diagnosis have told you exactly what you needed to know.