GMLP, or good machine learning practice, is a set of 10 guiding principles for developing AI and machine learning medical devices. FDA, Health Canada and the UK's MHRA published them in October 2021, and IMDRF issued a final version in January 2025. They are not binding rules, but FDA reviews the kind of evidence they describe.
Key takeaways
- The 10 principles cover the whole product life cycle, from team expertise and data quality to testing, user information and monitoring after launch.
- GMLP is not a regulation or a guidance document. FDA calls them principles that "can inform the development of" good machine learning practice.
- Only 9 of the 329 AI-enabled devices cleared through a 510(k) in 2025 named GMLP in their public documents. Far more showed the evidence behind it: 141 (43%) mentioned subgroup or stratified results.
- Two later principle sets build on GMLP: predetermined change control plans (PCCPs) in October 2023 and transparency in June 2024.
This guide is part of our SaMD & AI Track. Start with what counts as SaMD if you are not sure your software is a device.
What is GMLP?
GMLP is a shared set of 10 principles for building safe, effective and high-quality medical devices that use AI and machine learning (ML) [1]. FDA, Health Canada and the UK's Medicines and Healthcare products Regulatory Agency (MHRA) published them together in October 2021 [1].
The regulators wrote them to address what makes ML devices different: they are complex, data-driven and built in many iterations [1]. The 2021 document named areas where the International Medical Device Regulators Forum (IMDRF), standards bodies and others could work to advance GMLP [1].
IMDRF did so. In January 2025 it released a final document with 10 guiding principles for GMLP, which builds on the 2021 version [1]. Our IMDRF guide covers that document and IMDRF's other AI work.
| Document | Published by | Date |
|---|---|---|
| Good Machine Learning Practice for Medical Device Development: Guiding Principles | FDA, Health Canada, MHRA | October 2021 [1] |
| Predetermined Change Control Plans for Machine Learning-Enabled Medical Devices: Guiding Principles | FDA, Health Canada, MHRA | October 2023 [3] |
| Transparency for Machine Learning-Enabled Medical Devices: Guiding Principles | FDA, Health Canada, MHRA | June 2024 [2] |
| GMLP final document (N88) | IMDRF | January 2025 [1] |
What are the 10 GMLP principles?
The 10 principles run from how you staff the project to how you watch the device after launch [1]. These are the titles from the October 2021 document, with what each one asks for in plain English [1]:
| # | Principle | What it means in practice |
|---|---|---|
| 1 | Multi-disciplinary expertise is leveraged throughout the total product life cycle | Understand how the model fits clinical workflow, its benefits and its patient risks, over the device's whole life cycle |
| 2 | Good software engineering and security practices are implemented | Apply software engineering, data quality, data management, cybersecurity and risk management, and record the decisions |
| 3 | Clinical study participants and data sets are representative of the intended patient population | Cover age, sex, race, ethnicity, use and inputs in samples large enough to generalize and to find where the model underperforms |
| 4 | Training data sets are independent of test sets | Keep training and test data apart, including by patient, data acquisition and site |
| 5 | Selected reference datasets are based upon best available methods | Build the reference standard with accepted methods and know its limits |
| 6 | Model design is tailored to the available data and reflects the intended use of the device | Fit the model to the data, reduce risks such as overfitting, and set clinically meaningful performance goals |
| 7 | Focus is placed on the performance of the human-AI team | Where a human is in the loop, test the human and the model together, not the model alone |
| 8 | Testing demonstrates device performance during clinically relevant conditions | Use statistically sound test plans, independent of training data, covering important subgroups and the real clinical setting |
| 9 | Users are provided clear, essential information | Tell users the intended use, subgroup performance, training and test data, inputs, limits and updates |
| 10 | Deployed models are monitored for performance and re-training risks are managed | Monitor real-world performance, and control overfitting, bias and drift when you re-train |
Is GMLP mandatory for an FDA submission?
No. GMLP is a set of guiding principles, not a regulation [1]. FDA describes them as principles that "can inform the development of" good machine learning practice [1]. In 2025, 320 of the 329 AI-enabled devices cleared through a 510(k) did not name GMLP in their public documents [7].
But much of what GMLP describes is required elsewhere. FDA's final PCCP guidance, updated August 18, 2025, names the GMLP document as an example when it discusses re-training practices [4]. FDA's January 2025 draft guidance on AI-enabled device software functions lists GMLP among the agency's efforts behind its life cycle approach [5].
FDA does not regulate AI as such; it regulates medical devices, including AI-enabled ones [8]. Some evidence becomes binding through a device type's special controls. For triage software under 21 CFR 892.2080, the test dataset must contain enough cases from important cohorts to characterize performance in each subset [6]. That is principle 3 and principle 8 written into a regulation.
Special controls depend on your product code. To see which regulation applies to your device, Complizen's free device check returns candidate product codes with the regulation behind each.
What do 2025 AI 510(k)s show about GMLP?
Very few name it, but many show the evidence behind it. We read the public letters and summaries of all 329 AI-enabled devices cleared through a 510(k) in 2025 [7]:
| What the documents mentioned | Related principle | 510(k)s | Share |
|---|---|---|---|
| GMLP by name | All | 9 | 3% |
| Subgroup or stratified results | 3, 8 | 141 | 43% |
| Race or ethnicity | 3 | 105 | 32% |
| Multiple sites, centers or hospitals | 3, 8 | 72 | 22% |
| Test data independent of development data | 4 | 42 | 13% |
| A reader study | 7 | 38 | 12% |
| A cleared PCCP | 10 | 31 | 9% |
What this tells you. FDA does not look for the word GMLP. It looks for the evidence: representative data, separate test sets, subgroup results and human-AI testing [5, 6]. A 510(k) summary is short, so these figures are a floor, not a full count of what each submission contained.
How we counted. We used FDA's AI-enabled device list, current as of September 4, 2026, and kept the 329 entries with a 510(k) decided in 2025 [7]. We searched each public letter and summary for the phrases in the table, and checked samples by hand.
How do you show GMLP in a 510(k)?
Put the evidence for each principle where FDA expects to read it. FDA's January 2025 draft AI guidance gives a table of recommended locations in the marketing submission [5]. We mapped the principles to those sections:
| Principle | Draft guidance section | Where it goes in the submission [5] |
|---|---|---|
| 1, 2 | Risk assessment | Risk management file of the software documentation |
| 3, 4, 5 | Data management | Software description (development data); performance testing (test data) |
| 6 | Model description and development | Software description |
| 7, 8 | Validation | Performance testing; software verification and validation |
| 9 | User interface and labeling | Software description; labeling |
| 10 | Device performance monitoring | Risk management file of the software documentation |
The draft guidance is not final, so treat the map as a way to organize your file, not a checklist FDA has adopted [5]. The software documentation itself follows FDA's 2023 premarket software guidance, at a Basic or Enhanced level [9]. If you plan to update the model after clearance, a PCCP is the formal route. Our PCCP guide explains what goes into one.
Many AI teams have the evidence but spread across research reports and model cards. Complizen's free Gap Assessment compares your documents with what a 510(k) needs and names each missing item, with its cost and lead time.
How does GMLP relate to transparency and PCCPs?
Both later principle sets build directly on GMLP [2, 3]. The transparency principles of June 2024 expand principles 7 and 9: the human-AI team and clear information for users [2]. The PCCP principles of October 2023 draw in particular on principle 10: monitoring deployed models and managing re-training risks [3].
The transparency principles cover who needs information, why, what, where, when and how [2]. They say transparency is a good practice to consider for all medical devices, not only ML devices [2].
The PCCP principles describe a plan that specifies planned modifications, the protocol for making them, and how you assess their impact [3]. In 2025, 31 of the 329 AI 510(k)s came with a cleared PCCP [7].
What do AI device makers outside the US need to know?
GMLP is shared by three regulators and now by IMDRF, so one set of practices can support several markets [1]. Most AI devices FDA cleared in 2025 came from outside the US: 194 of the 329 510(k)s [7].
The principles do not change what FDA asks about your data. Say you validate with data from outside the US. FDA's draft AI guidance then asks you to explain how they compare with the US population and US medical practice [5]. It also says at least three geographically diverse US clinical sites may be appropriate for clinical validation [5]. Our guide to FDA clearance for AI devices from Korea, Japan and Taiwan shows what applicants from those countries did.
What mistakes do teams make with GMLP?
Most treat it as a label instead of a set of evidence. Check these four:
- Claiming GMLP compliance without evidence. Only 9 of 329 cleared AI 510(k)s named GMLP, while 141 showed subgroup or stratified results [7]. Evidence counts, not the label.
- Splitting data only by image, not by patient or site. Principle 4 asks you to consider patient, data acquisition and site factors when you separate training and test data [1].
- Testing the model alone. Where a clinician uses the output, principle 7 asks you to test the human-AI team [1].
- Re-training without controls. Principle 10 asks for controls against overfitting, bias and drift, and a cleared PCCP is the formal way to pre-plan model changes [1, 3].
Frequently asked questions
What does GMLP stand for?
GMLP stands for good machine learning practice. It is a set of 10 guiding principles for developing AI and machine learning medical devices. FDA, Health Canada and the UK's MHRA published them in October 2021. IMDRF issued a final GMLP document with 10 principles in January 2025.
Is GMLP required for a 510(k)?
No. GMLP is a set of guiding principles, not a regulation, so you do not need to cite it. But FDA reviews the evidence it describes, such as representative data, independent test sets and subgroup results. For some device types, special controls make parts of that evidence mandatory.
Who published the GMLP principles?
FDA, Health Canada and the UK's Medicines and Healthcare products Regulatory Agency published the 10 principles together in October 2021. In January 2025, the International Medical Device Regulators Forum (IMDRF) released a final document with 10 GMLP principles that builds on the 2021 version.
What are the 10 GMLP principles?
The first five cover multi-disciplinary expertise, software engineering and security, representative data, independent training and test sets, and reference datasets. The other five cover model design, the human-AI team, clinically relevant testing, clear information for users, and monitoring deployed models.
Does GMLP apply to all AI medical devices?
The principles were written for medical devices that use AI and machine learning, across the whole life cycle. They are not limited to one pathway. The transparency principles that build on them say transparency is good practice for all medical devices, not only machine learning ones.
How many cleared AI devices mention GMLP?
Few do by name. Of the 329 AI-enabled devices cleared through a 510(k) in 2025, 9 named GMLP in their public letters or summaries. Many more showed the evidence behind it: 141 mentioned subgroup or stratified results and 105 mentioned race or ethnicity.
What is the difference between GMLP and a PCCP?
GMLP is a set of principles for developing and running machine learning devices. A predetermined change control plan (PCCP) is part of a marketing submission. It pre-specifies planned changes, how you will make them and how you will assess their impact. The PCCP principles draw mainly on GMLP principle 10.
Is GMLP the same as FDA's AI guidance?
No. GMLP is a short set of principles from 2021. FDA's guidance on AI-enabled device software functions, a draft from January 2025, gives detailed submission recommendations. The draft cites GMLP as one of FDA's earlier efforts. It is not final, so it is not yet FDA's settled position.
Does GMLP require data from US patients?
No. GMLP asks for data that represent your intended patient population. But FDA's draft AI guidance asks you to explain how any validation data from outside the US compare with the US population and US medical practice. Plan that early.
How does GMLP relate to ISO 14971?
GMLP principle 2 asks for methodical risk management, and principle 10 asks you to manage re-training risks. FDA's draft AI guidance puts risk assessment and performance monitoring in the risk management file of your software documentation. FDA's 2023 software guidance points to ISO 14971 for building that file.
Can a wellness app use GMLP?
Yes. Nothing stops any software team from following the principles. FDA's transparency principles say transparency is good practice for all medical devices. If your app later adds medical claims, you will already have the kind of data and test records a device submission needs.
Where can I read the official GMLP principles?
FDA's page "Good Machine Learning Practice for Medical Device Development: Guiding Principles" has the October 2021 document and links to IMDRF's January 2025 final document. FDA's related pages cover the transparency principles from June 2024 and the PCCP principles from October 2023.
References
- FDA. Good Machine Learning Practice for Medical Device Development: Guiding Principles, content current as of December 19, 2025, with the October 2021 principles and a link to IMDRF's final document N88, January 2025.
- FDA, Health Canada and MHRA. Transparency for Machine Learning-Enabled Medical Devices: Guiding Principles. June 2024.
- FDA, Health Canada and MHRA. Predetermined Change Control Plans for Machine Learning-Enabled Medical Devices: Guiding Principles. October 2023.
- FDA. Marketing Submission Recommendations for a Predetermined Change Control Plan for Artificial Intelligence-Enabled Device Software Functions. Final guidance, issued December 4, 2024, updated August 18, 2025.
- FDA. Artificial Intelligence-Enabled Device Software Functions: Lifecycle Management and Marketing Submission Recommendations. Draft guidance, January 7, 2025.
- eCFR. 21 CFR 892.2080, radiological computer aided triage and notification software. Text checked in the April 1, 2025 annual edition.
- FDA. Artificial Intelligence-Enabled Medical Devices list, current as of September 4, 2026, matched to the public letters and summaries in FDA's 510(k) database and applicant countries in openFDA. Analyzed by Complizen, accessed October 15, 2026.
- FDA. Artificial Intelligence-Enabled Medical Devices, content current as of September 22, 2026.
- FDA. Content of Premarket Submissions for Device Software Functions. Final guidance, June 14, 2023.