Mounsif Tamani, founder of TamRx and an assessor of medical AI for Innovate UK, writes that how quickly software reading your scans is allowed to improve has nothing to do with the technology.

Here is a number I keep coming back to: 31 days.

That is the median time it took the FDA to clear an update to an AI tool that helps spot polyps during a colonoscopy. Not to approve it from scratch. To clear a change to a device already on the market.

Now here is another: 153 days. That is the same figure for AI tools that read mammograms.

Same regulator. Same year. Same type of decision. Five months versus one.

I assess medical AI for Innovate UK, and when I pulled these numbers out of the FDA’s own public database, I assumed I had made an error. I had not. And the explanation says something uncomfortable about how we are governing the software now reading our scans.

Why an update is a regulatory event

Start with the thing most people outside my field find surprising.

When a medical AI model changes, it is not treated as a software patch. In law, the model is the device. Retrain it, and you have, in regulatory terms, made a new device. That means a new decision from the regulator before it can reach a single patient.

And these models must keep changing. Deploy one in a new hospital, with different scanners and a different population, and its accuracy quietly falls. This is not a malfunction. It is what these systems do when the world around them shifts, which the world always does.

So a company can improve its model in a fortnight and then wait months for permission to use it.

Here is where it gets interesting, because the regulator has already thought about this.

There is a shorter route, called a Special 510(k), designed precisely for manufacturers changing their own device where the purpose and the underlying technology stay the same. It exists to stop routine improvements queueing behind first-time approvals.

Almost nobody in mammography uses it.

I looked at every AI clearance in the breast imaging category. Thirty-six clearances, thirteen companies. Six used the short route. One company filed six times over six years and used it not once. Another filed five times and used it twice.

Then I looked at endoscopy AI. Seven out of ten of those clearances took the short route. Their median wait was thirty-one days.

I want to be careful here, because there is an obvious objection and it is a fair one. Perhaps mammography changes are genuinely more substantial. Perhaps a tool reading a screening mammogram warrants more scrutiny than one flagging a polyp mid-procedure. I cannot see inside those filings, and I am not going to pretend otherwise.

But the variation within a single category is harder to explain away. Companies making very similar products, filing in the same years, under identical rules, are choosing opposite routes. Some appear to treat the short path as standard practice. Others behave as though it does not exist.

What that costs, in the room

Translate five months into clinical terms.

A mammography AI is deployed. It performs well. Over the following year, the hospital replaces a scanner, or the screening population shifts, and performance drifts down. The company notices, retrains, and fixes it.

For the next several months, the radiologist is working alongside a version everyone involved knows is worse than the one sitting on a server. Nobody tells her which version she is using or when it was last assessed. She may not know the newer one exists.

Then, when she says she is not sure she trusts the AI, we write articles about clinician resistance to technology.

I do not think that is resistance. I think it is an accurate reading of the situation.

I want to be clear, because the easy conclusion is that regulators are the problem, and that is lazy and wrong. Nobody should want diagnostic algorithms changing silently. The scrutiny is the point, and the fact that it applies to updates and not just launches is correct.

The difficulty is that the guidance on which route applies is spread across dense documents that a small company with no regulatory department will struggle to operationalise. So they do the rational thing. They take the long route, because it is the one they are confident they can defend, and they absorb the delay.

That is a solvable problem. It requires making the existing rules usable rather than writing new ones.

Because the striking thing about those two numbers is not that one is large. It is that both came from the same regulator, applying the same framework, in the same year. The difference was never really about the technology.

It was about knowing which door to walk through.