Defense · GMLP

GMLP for defense AI workflows

GMLP in defense AI workflows: what compliance requires, who asks for evidence, and the records to keep.

Start free Open the Console

Legal forceNon-binding regulatory guiding principles

Applies from27 Oct 2021

SectorDefense

Checked21 Oct 2026

01 / The rule

What GMLP requires

Manufacturers developing AI/machine-learning-enabled medical devices for the US, Canadian and UK markets, and the regulators reviewing them.

01Use multidisciplinary expertise throughout the total product lifecycle and follow good software engineering and security practices.
02Use clinical study participants and data sets representative of the intended patient population.
03Keep training data sets independent of test sets, and base reference datasets on best available methods.
04Tailor model design to the available data and intended use, and evaluate performance of the human-AI team.
05Test device performance under clinically relevant conditions and give users clear, essential information.
06Monitor deployed models for performance and manage retraining risks.

02 / In this sector

In a defense AI workflow

AI-specific. The principles were written for medical devices that use machine learning, including models that are retrained or updated after release.

Usually asked by

Program office leads and ATO-package owners.

Named alongside

NIST AI RMF · DoW RAI · OMB M-25-21.

Sector pagePlanisphere for defense

03 / Records

Records to keep

01Dataset documentation showing representativeness and train/test separation
02Reference standard (ground truth) method and rationale
03Clinical performance testing report under intended-use conditions
04Post-market performance monitoring plan and retraining change records

Optional evidence · where Planisphere fits

Keep a record anyone can check

When your team meets a duty, Planisphere can seal the event it reports as a receipt.

01 · Your teamRecord the event

A disclosure shown, a review signed, a model change approved: the event your system reports.

02 · PlanisphereSeal it

The event becomes a sealed receipt, dated and attributed to whoever is signed in.

03 · AnyoneCheck it

Paste the receipt into Verify. No account or key.

A record supports your compliance evidence process. It is not a legal finding or a certification. Systems that call Planisphere's gate API can also hold or refuse an action before it runs.

SOURCES