IMDRF Good Machine Learning Practice Principles (N88)

1. What Is IMDRF Good Machine Learning Practice Principles (N88)?

The International Medical Device Regulators Forum (IMDRF) Good Machine Learning Practice (GMLP) principles are ten guidelines for developing and maintaining safe, effective, high-quality medical devices incorporating artificial intelligence (AI), including machine learning. N88 is the document identifier. This is a lifecycle quality and decision-making framework, not an algorithm-selection method or a marketing authorization.

For executives in medical devices and diagnostics, the practical question is: “What evidence and controls justify releasing this AI-enabled function, expanding its use, or changing its model?” Consultants can use N88 to structure a cross-functional review connecting clinical claims, development practices, validation, user interaction and post-market responsibilities.

2. Origin and Background

IMDRF’s Artificial Intelligence/Machine Learning-enabled Working Group authored N88, published on January 29, 2025. It builds on principles released in October 2021 by the U.S. Food and Drug Administration (FDA), Health Canada and the United Kingdom’s Medicines and Healthcare products Regulatory Agency.

The initiative addresses the distinctive challenges of data-driven, iterative device development. Its purpose is international convergence around good practices, rather than replacing national regulatory requirements. Its relevance extends beyond policy discussion: Australia’s Therapeutic Goods Administration has adopted N88 as guidance for compiling evidence of compliance with its Essential Principles.

3. How IMDRF Good Machine Learning Practice Principles (N88) Works

The principles span development, deployment and maintenance. They are interdependent expectations, not ten sequential approval gates. The core logic connects a clinically meaningful purpose with trustworthy data, suitable engineering, credible performance evidence and continuing control.

The ten principles, summarized rather than quoted, are:

1. Intended purpose and multidisciplinary expertise: Understand the clinical role, benefits and patient risks; involve appropriate expertise throughout the lifecycle.
2. Engineering, device design and security: Maintain robust software, usability, data management, quality practices and cybersecurity.
3. Representative datasets: Cover intended patients, environments and measurement inputs in training, testing and monitoring.
4. Independent training and testing: Address patient, site and acquisition dependencies; make external validation proportionate to risk.
5. Fit-for-purpose reference standards: Justify the clinical comparison method and understand its limitations.
6. Appropriate model choice and design: Match the model to available data, intended purpose and clinically meaningful performance goals.
7. Human-AI interaction: Evaluate clinical workflow, user understanding, overreliance and human-AI team performance.
8. Clinically relevant testing: Use sound methods addressing intended conditions, subgroups and confounding factors.
9. Clear user information: Explain intended use, performance, risks, limitations, updates and concern-reporting routes.
10. Monitoring and controlled retraining: Track deployed performance and manage retraining-related bias, overfitting and degradation.

For practical application, assess a defined device function and model version—not the manufacturer’s general AI maturity. An imaging algorithm, its acquisition hardware, preprocessing pipeline and clinician interface should be considered together. A useful implementation artifact is an evidence register linking each principle to supporting records, unresolved risks, accountable owners and decisions. This register is a management aid, not an official N88 scoring system.

4. When to Use IMDRF Good Machine Learning Practice Principles (N88)

Use N88 when planning an AI-enabled device, preparing a release decision, evaluating an acquired technology, extending an indication or reviewing a proposed model update. It is especially useful when responsibility is fragmented across clinical affairs, data science, engineering, quality and regulatory teams.

Useful questions include:

• Does the evidence support use across the proposed patient population and acquisition equipment?
• What must change before entering a new clinical setting?
• Can deployed performance be monitored, and who acts when it deteriorates?

Assemble the intended-use statement, risk records, dataset provenance, validation reports, user studies, security evidence and monitoring arrangements. Regulators’ associated guidance reinforces the importance of explaining lifecycle quality practices, rather than supplying model-performance results alone.

The analysis assumes a clear intended purpose, identifiable product versions and evidence that can be interrogated. An initial workshop can expose gaps; it cannot replace missing clinical studies. Do not use N88 to determine pricing or rank non-AI products. Conclusions become misleading when broad claims are assessed against narrow, undocumented datasets.

5. How to Apply IMDRF Good Machine Learning Practice Principles (N88): Step-by-Step

1. Clarify the decision and boundaries.

   Specify whether the team is deciding to develop, submit, release, expand or update a device function. Define patients, users, clinical settings, compatible equipment, target jurisdictions and the decision horizon.

2. Gather controlled evidence.

   Collect approved specifications, risk assessments, dataset inventories, annotation protocols, training records, test reports, interface studies and monitoring procedures. Distinguish completed evidence from planned work and informal assertions.

3. Define the units of analysis.

   Identify the device function, model version, preprocessing version and deployment configuration. Break down performance by clinically relevant populations, sites and acquisition conditions rather than relying only on pooled results.

4. Build the evidence register.

   Create one row per principle, with evidence references, applicability rationale, gaps, patient-safety implications, owners and closure criteria. Use qualitative status labels; avoid implying that N88 supplies numerical weights.

5. Challenge the interpretation.

   Ask whether evaluation reflects the intended workflow, whether reference labels are defensible and whether training-test dependence has been addressed. Separate statistical uncertainty from an actual failure to meet clinical goals.

6. Translate gaps into decisions.

   Decide whether to collect additional data, revise claims, redesign the interface, strengthen security or postpone release. Assign a budget, accountable executive and evidence-based completion condition to each material action.

7. Test alternative assumptions.

   Revisit conclusions under different patient mixes, equipment configurations, operating thresholds and data availability. Include scenarios where reliable outcome labels arrive late or cannot be obtained consistently.

8. Align owners and iterate.

   Review the register jointly with clinical, engineering, quality, regulatory and deployment stakeholders. Resolve disagreements about intended use and risk before approving actions; revisit the analysis when the product or evidence changes.

Where gaps reflect missing procedures rather than missing experiments, targeted quality-system design can embed dataset approval, independent validation, release decisions and monitoring escalation into the manufacturer’s existing management system.

6. Example: IMDRF Good Machine Learning Practice Principles (N88) in Action

Fictional scenario: Lumen Dental Systems, a manufacturer of dental technologies, is developing software that highlights suspected caries on adult bitewing radiographs for dentists to review. Leadership wants to support several sensor families, but the evidence package is concentrated on one acquisition configuration.

Application: The team chooses N88 to assess the proposed claims and development controls together. Its units of analysis are the model version, supported sensor configurations and dentist-assisted workflow. It examines patient characteristics, image provenance, train-test separation, expert annotation procedures, subgroup results and dentist performance with and without assistance.

Insights: The review identifies repeat-patient leakage in an early experiment, limited evidence for one proposed sensor configuration and an interface that makes uncertain findings look definitive. It also reveals that deployment logging captures technical failures but not enough information to investigate clinical performance.

Decisions and actions: Lumen rebuilds the evaluation split, limits its proposed initial compatibility claims, commissions additional testing and revises the display. Quality and engineering establish version traceability and an escalation process for performance concerns. A wider release remains contingent on closing the evidence gaps and obtaining applicable authorization. These are illustrative decisions, not industry benchmarks.

7. Strengths and Limitations

Strengths

• Cross-functional clarity: It connects clinical purpose, engineering, evidence and deployment responsibilities in one discussion.
• Lifecycle perspective: It keeps monitoring and retraining controls visible alongside pre-release development work.
• Workflow relevance: It directs attention beyond isolated model accuracy to the interaction between the device and its users.

Limitations

• Not a complete compliance specification: National requirements and applicable quality-system obligations still need separate assessment.
• No universal acceptance thresholds: Teams must establish defensible performance and risk criteria for their device; a completed checklist is not evidence of safety.
• Execution remains substantial: The principles do not themselves secure clinical data access, create reliable reference labels or allocate monitoring resources.

Use N88 to structure judgment, not to manufacture a reassuring average score that conceals an unresolved safety-critical gap.

8. Common Pitfalls and How to Avoid Them

• Assessing the company instead of the device: An enterprise AI policy cannot demonstrate a particular function’s performance. Anchor the review to a controlled configuration.
• Counting images instead of independent evidence: Repeat patients and acquisition dependencies can undermine testing. Examine the relationships within datasets before interpreting results.
• Treating labels as unquestionable truth: Document annotation methods, disagreements and limitations; use a reference standard appropriate to the clinical claim.
• Ignoring user behavior: Test whether clinicians understand outputs and limitations, rather than assuming their presence eliminates risk.
• Monitoring without response authority: Define who investigates signals, restricts deployment and approves corrective action before launch.

Closing these gaps requires coordination across clinical evidence, software development and deployment. Dedicated program management support can maintain dependencies, decision logs and evidence milestones without displacing technical or regulatory accountability.

9. How IMDRF Good Machine Learning Practice Principles (N88) Relates to Other Frameworks

N88 should complement, not replace, established device-management tools:

• ISO 14971 risk management: Use this International Organization for Standardization (ISO) framework before and alongside N88 to identify hazards, evaluate risks and establish controls. It is more appropriate for the complete device risk-management process.
• ISO 13485 quality management: Use it alongside N88 to organize the processes through which development and lifecycle controls are implemented. N88 adds a machine-learning-specific perspective rather than creating a parallel quality system.
• IMDRF N60 cybersecurity principles: Apply these alongside N88 for deeper treatment of device cybersecurity and stakeholder responsibilities across pre-market and post-market activities.
• Predetermined Change Control Plans: Where appropriate, translate anticipated updates into a defined change plan. Under FDA’s approach, an authorized plan can support specified modifications implemented consistently with that plan—not unrestricted retraining.

For U.S. manufacturers, the FDA’s Quality Management System Regulation became effective on February 2, 2026, incorporating ISO 13485:2016 by reference. N88 implementation should therefore connect to applicable quality-system processes, not sit outside them.

10. Key Takeaways

• N88 connects clinical purpose, development evidence and lifecycle control for AI-enabled devices.
• Assess a specific device function and configuration—not general AI maturity.
• Challenge dataset independence, reference standards and human-AI interaction.
• Turn gaps into funded actions with accountable owners and closure criteria.
• Neither checklist completion nor strong average accuracy replaces device-specific evidence and applicable authorization.

11. FAQs About IMDRF Good Machine Learning Practice Principles (N88)

Is N88 a mandatory certification standard?

No. N88 provides guiding principles rather than a standalone certification scheme. However, regulators may incorporate its concepts into their expectations; assess the requirements and guidance applicable to each target market.

Does N88 apply to models that do not learn after deployment?

Yes. Its development, evaluation, transparency and monitoring principles remain relevant to fixed models. Retraining controls become relevant when retraining is proposed; continuous learning is not a prerequisite.

What is the minimum useful evidence for an N88 review?

Start with a precise intended-use statement, identifiable product configuration, dataset provenance, risk records and available testing. Include user information and monitoring arrangements. Missing evidence should become an explicit gap, not an assumed pass.

Can a smaller medical-device company use N88?

Yes. Begin with a simple evidence register and one accountable owner per gap. Use external clinical, security or regulatory expertise where necessary. Scale the review to the device’s risks without treating limited resources as justification for unsupported claims.