Quality Assurance (QA) is essential for life sciences organizations of all sizes. As artificial intelligence (AI) and machine learning (ML) become increasingly integrated into medical device development, ensuring quality requires additional considerations around data, model development, performance, and ongoing monitoring.
The US Food and Drug Administration (FDA), Health Canada, and the UK's Medicines and Healthcare products Regulatory Agency (MHRA) recognized the need for a common approach and jointly developed Good Machine Learning Practice (GMLP). GMLP establishes ten guiding principles to support the development of safe, effective, and high-quality medical devices that use AI and ML. This article explores these ten principles and the regulatory thinking behind them.
What are the 10 GMLP guiding principles for machine learning in medical devices?
In January 2025, the International Medical Device Regulators Forum (IMDRF) published a final international version of the 10 GMLP guiding principles. The document calls on international standards organizations, regulators, and other collaborative bodies to support the continued development and adoption of GMLP.
Let's go through each guiding principle to understand the areas that are of concern to the US, Canada, and UK regulatory agencies and medical device manufacturers.
The table below summarizes the key expectations of each principle and highlights the areas manufacturers should consider when developing and maintaining AI/ML-enabled medical devices.
For a broader overview of the regulatory landscape, read our article on the FDA regulatory framework for AI/ML in medical devices.
1. Leverage multi-disciplinary expertise throughout product lifecycle
According to GMLP, multi-disciplinary expertise is needed across the total product life cycle to understand how the model fits into the clinical workflow, along with its intended benefits and associated patient risks. For example, the AI/ML engineer, cloud engineer, and other engineering experts involved in the process of medical device development may be new to various clinical concepts.
Therefore, they should leverage the expertise of life science researchers to understand the clinical benefits of the medical device and potential risks to patient safety. Similarly, life science researchers may be new to the concepts used in machine learning algorithms. So, in turn, they should leverage the expertise of the AI/ML engineer, cloud engineer, and other engineers to maximize the benefit to the patient's health and security.
2. Implement good software and engineering practice
For healthcare and life sciences applications, the ML environment's data integrity, security, and privacy are paramount. It is strongly recommended that you protect your environment against unauthorized access, privilege escalation, and data exfiltration. Where a cloud platform hosts the ML environment, control it as a supplier under your QMS. Qualify the vendor, define security and access requirements in a quality or service agreement, and verify that the selected architecture meets them.
In the context of data security and integrity, the GMLP expects medical device companies to implement:
- Good software engineering practices
- Data quality assurance
- Data management
- Robust cybersecurity practices
These practices include methodical risk management and design processes that can appropriately capture and communicate design, implementation, and risk management decisions and rationale, as well as ensure data authenticity and integrity. These practices may be binding or non-binding requirements.
- Binding requirements owing to legislation such as the EU MDR and IVDR (for software, Annex I GSPR 17.2 and 16.2 respectively), 21 CFR Part 820 (QMSR), 21 CFR Part 11, GDPR, etc.
- Non-binding requirements owing to guidance and voluntary consensus standards such as GMLP, EU GMP Annex 11, GAMP 5 second edition, ISO/TR 24291:2021, IEC 62304, ISO 14971:2019, etc.
In either case, implementation of these practices will protect the best interests of the manufacturer as well as the user.
3. Use clinical study participants and data sets as representatives of the intended patient population
Clinical study outcomes can vary across populations of different races, ethnicities, ages, and genders due to genetics and other differences. It’s important to use data sets with sufficient sample sizes and variability to accurately represent the intended patient population.
Sample variability and sample size should also be adequately assessed separately for the train data set and test data set to generalize the results for the population of interest. Applying sound statistical principles may be helpful in creating data sets that are representative of the intended patient population.
4. Ensure training data sets are independent of test sets
For an unbiased assessment of ML model performance, it is critical to ensure that train data and test data are independent of each other. To overcome this challenge, identify and address all potential sources of dependence such as the patient, the method of data acquisition, or the site of data acquisition.
5. Base selected reference data sets on best available methods
Correlation does not always imply causation. Therefore, there is a possibility that data with a strong correlation to a particular clinical outcome may not be clinically relevant. To avoid this, manufacturers should ensure that reference data sets contain well-characterized and clinically relevant data for the intended use of the medical device.
It is also important to understand the limitations of the reference data set. For example, if it contains clinical data from a specific age group, the limitations of extrapolating clinical outcomes to other age groups must be thoroughly understood. In this context, the GMLP guidelines emphasize the importance of promoting and demonstrating model robustness and generalizability across the intended patient population.
6. Tailor model design to available data and ensure it reflects the intended use of the device
The selected model design should be appropriate for analyzing the available data while actively mitigating known risks, such as overfitting, performance degradation, and security vulnerabilities. Manufacturers should also make sure that the clinical benefits and risks associated with the device are well understood and that the model supports clinically meaningful performance testing. Ultimately, model performance should demonstrate that the device can safely and effectively achieve its intended use.
The model design should be robust to include the impact of both global and local performance and uncertainty/variability in:
- The device inputs
- Outputs
- Intended patient populations
- Clinical use conditions
7. Focus on the performance of the human-AI team
When a human is involved in interpreting or acting on model outputs, manufacturers should also account for potential variability in human interpretation and its impact on the overall performance of the human-AI team. The model performance should be assessed collectively for the human and AI as a team rather than assessing in isolation only for the AI model.
8. Use testing to demonstrate device performance during clinically relevant conditions
Testing should demonstrate that the device performs safely and effectively under the conditions in which it is intended to be used. This means going beyond evaluating model performance in controlled settings and considering the variability that may arise in real-world clinical environments.
GMLP sets out the following expectations for testing.
- The test plans should be developed and executed on the basis of sound statistical concepts
- The testing should assess the model's performance in terms of clinical relevance
- The testing should be independent of the training data
- The test performance should be evaluated for intended variability in measurement inputs such as patient population, important subgroups, clinical environment, etc., and potential confounding factors such as use by the Human-AI as a team.
9. Provide users with clear, essential information
Clear and contextually relevant user information should be provided to the intended user (such as health care providers or patients). The information may include the following details:
- The product's intended use and indications for use
- Performance of the model for appropriate subgroups
- Characteristics of the data used to train and test the model
- Acceptable inputs
- Known limitations
- User interface interpretation
- Clinical workflow integration of the model
In addition to the above aspects, it is also important to make users aware of device modifications, model updates from real-world performance monitoring, the basis for decision-making when available, and a means to communicate product concerns to the developer.
10. Monitor deployed models for performance and manage re-training risks
Once a machine learning model is deployed, its performance should be monitored continuously in real-world use or periodically to ensure it remains safe, effective, and reliable. Monitoring also helps identify changes in model performance over time and determine when improvements or updates may be needed.
When models are periodically or continually retrained after deployment, manufacturers should have appropriate controls in place to manage risks such as overfitting, unintended bias, and model degradation (for example, due to dataset drift). These risks should be assessed in terms of their potential impact on both model performance and the overall safety and effectiveness of the human-AI team.
What are the transparency guiding principles for machine learning-enabled medical devices?
In June 2024, the FDA, Health Canada, and MHRA published Transparency for Machine Learning-Enabled Medical Devices: Guiding Principles, which build on GMLP principles 7 and 9. They describe transparency as how clearly appropriate information about a device, including its intended use, development, performance, and logic when available, reaches the people who need it. The principles are organized around six questions.
The regulators note that transparency is a good practice for all medical devices, including those that do not use machine learning.
How does the EU AI Act apply to machine learning for medical devices?
GMLP comes from US, Canadian, and UK regulators, so manufacturers placing AI/ML medical devices on the EU market also need to plan for the EU AI Act (Regulation (EU) 2024/1689), which applies alongside the MDR and IVDR.
- High-risk classification: under Article 6(1) and Annex I, an AI system is high-risk when it is a medical device, or a safety component of one, that requires notified body conformity assessment under the MDR or IVDR.
- Deadline: the Digital Omnibus on AI (Regulation (EU) 2026/1744) moved these obligations from August 2, 2027 to August 2, 2028.
- Overlap with GMLP: the Act’s requirements on data governance, transparency, human oversight, and post-market monitoring cover much of the same ground as the 10 principles.
For risk tiers and compliance steps, read our practical guide to the EU AI Act in life sciences. And, to compare EU and US rules, see upcoming AI regulation for pharma and medical devices.
Final thoughts
Applied together, the guiding principles help medical device manufacturers identify risks to the safety and effectiveness of a model early and control them across the total product life cycle, from design and data selection to monitoring after deployment.
GMLP also notes that the principles can be used to adopt good practices proven in other sectors, tailor them for medical technology and healthcare, and create new practices specific to the sector.
Ultimately, GMLP reinforces that safe and effective machine learning depends not only on the technology itself, but on the quality controls, human oversight, and accountability maintained throughout the device's lifecycle.
