United States, Canada and United Kingdom (joint); adopted internationally by IMDRF · guidance
GMLP: what it requires, and the records to keep
Ten guiding principles issued by the FDA, Health Canada and the UK MHRA in October 2021 for developing safe, effective machine-learning medical devices across the total product lifecycle. IMDRF finalized a near-identical international version in January 2025, and FDA people reviewing it use the same concepts when assessing AI-enabled device submissions.
01 / What it requires
What GMLP requires
Manufacturers developing AI/machine-learning-enabled medical devices for the US, Canadian and UK markets, and the regulators reviewing them.
- 01Use multidisciplinary expertise throughout the total product lifecycle and follow good software engineering and security practices.
- 02Use clinical study participants and data sets representative of the intended patient population.
- 03Keep training data sets independent of test sets, and base reference datasets on best available methods.
- 04Tailor model design to the available data and intended use, and evaluate performance of the human-AI team.
- 05Test device performance under clinically relevant conditions and give users clear, essential information.
- 06Monitor deployed models for performance and manage retraining risks.
02 / AI work
Where it touches AI work
AI-specific. The principles were written for medical devices that use machine learning, including models that are retrained or updated after release.
03 / Dates
The dates that matter
FDA, Health Canada and MHRA publish 10 GMLP guiding principles
IMDRF publishes draft GMLP guiding principles for consultation
FDA issues draft guidance on AI-enabled device software functions
IMDRF finalizes GMLP guiding principles (N88)
FDA GMLP page last updated, pointing to IMDRF final document
04 / Enforcement
Who enforces it
None directly; the principles are not binding. FDA, Health Canada and MHRA apply related expectations through device premarket review and quality-system rules.
05 / Records
Records an organisation keeps
What an auditor or an inquiry usually asks to see. Your obligations depend on your role and your facts.
- 01Dataset documentation showing representativeness and train/test separation
- 02Reference standard (ground truth) method and rationale
- 03Clinical performance testing report under intended-use conditions
- 04Post-market performance monitoring plan and retraining change records
Optional evidence · where Planisphere fits
Keep a record anyone can check
When your team meets a duty, Planisphere can seal the event it reports as a receipt.
A disclosure shown, a review signed, a model change approved: the event your system reports.
The event becomes a sealed receipt, dated and attributed to whoever is signed in.
Paste the receipt into Verify. No account or key.
A record supports your compliance evidence process. It is not a legal finding or a certification. Systems that call Planisphere's gate API can also hold or refuse an action before it runs.
QUESTIONS
The questions that come next
What are the 10 Good Machine Learning Practice (GMLP) principles?+
The 10 principles, published by FDA, Health Canada and the UK MHRA in October 2021, are: multidisciplinary expertise across the product life cycle; good software engineering and security practices; clinical study participants and data sets representative of the intended patients; training data independent of test sets; reference datasets based on best available methods; model design tailored to the data and intended use; focus on human-AI team performance; testing under clinically relevant conditions; clear, essential information for users; and monitoring deployed models while managing retraining risks. They are principles, not a checklist. IMDRF issued a near-identical final version in January 2025. Read the full answer
SOURCES
Go back to the source
Medicines and Healthcare products Regulatory Agency (GOV.UK)
U.S. Food and Drug Administration
International Medical Device Regulators Forum
Regulatory Affairs Professionals Society
CHANGE LOG
What changed, and when
Rebuilt from primary sources; facts checked on this date.
Related: ISO/IEC 42001 · SLSA v1.0 · SCITT · ISO/IEC 42001 · Annex A