GMLP for AI Medical Devices: What Founders Must Know

Good Machine Learning Practice (GMLP) is the set of 10 guiding principles that regulators use to describe how safe, effective AI/ML-enabled medical devices should be built and maintained. In January 2025, the International Medical Device Regulators Forum (IMDRF) released the final version of those principles, building on the 2021 work of the FDA, Health Canada and the UK's MHRA. GMLP is not a checklist you file with FDA. It is the standard your team, your data and your evidence will be measured against.

If you build healthcare SaaS with a model inside it, this affects your roadmap, your hiring and your fundraising story. Here is what the principles say, how they show up in a submission, and where founders lose time.

TL;DR

• GMLP is 10 principles from IMDRF covering the full life cycle of an AI-enabled device, from team makeup and data to post-deployment monitoring.
• The FDA treats GMLP as the foundation for its life-cycle oversight. Principles are guidance, but reviewers expect to see them reflected in your documentation.
• Most AI devices reach the market through 510(k), yet public summaries often leave out subgroup performance and prospective validation. Investors are starting to look past the clearance itself.
• Build data lineage, train/test independence, subgroup analysis and monitoring into the plan from day one. Retrofitting them is expensive.
• A Predetermined Change Control Plan (PCCP) is a front-loaded commitment, not a shortcut.

Table of Contents

• What GMLP is, and what it is not
• The 10 principles in plain language
• How the FDA applies these ideas to submissions
• Transparency is becoming a baseline expectation
• What the numbers say about the AI device market
• Why investors should read past the clearance
• GMLP and the Predetermined Change Control Plan
• Where startups lose time
• A founder's GMLP starting plan
• Our perspective
• Working with The StartUp MD
• FAQ
• Sources

What GMLP is, and what it is not

GMLP began as a 2021 joint effort of FDA, Health Canada and MHRA. The principles were later taken up by IMDRF, and the final IMDRF document (N88) was published in January 2025. The FDA's own page frames the principles as a way to inform good practice, not as a new regulation.

That distinction matters. GMLP is not a certification, and no one will hand you a GMLP stamp. It is a shared vocabulary. When an FDA reviewer asks how you split your training and test data, or how you know your model works for patients unlike your development cohort, they are asking GMLP questions whether or not they use the term.

The principles also sit inside a wider structure. The FDA's oversight of AI-enabled devices rests on the Total Product Life Cycle approach, which looks at a device from design through post-market use, as described in a Bipartisan Policy Center review of health AI regulation. GMLP is the practical layer beneath that approach.

The 10 principles in plain language

The IMDRF document lists these principles. Here is what each means for a founder.

Principles 1 and 7 are the ones startups most often underestimate. A model can be statistically excellent and still fail in a clinic because no one asked how a busy physician will use it. That is a clinical leadership problem, not a data science problem.

How the FDA applies these ideas to submissions

GMLP gets concrete in FDA's recent work on AI-enabled device software. A law firm summary of the agency's recent moves lists the content elements FDA recommends for marketing submissions, including data lineage and splits, performance tied to claims, bias analysis and mitigation, the human-AI workflow, and monitoring. Put that list beside the 10 principles and the overlap is obvious.

In practice, reviewers want to see:

1. Where the data came from. Sources, collection dates, sites, demographics and exclusions.
2. How it was split. Evidence that training, tuning and test sets are independent.
3. How performance maps to your claims. Every claim in the labeling traces to a result.
4. How subgroups perform. Not just overall accuracy, but results by age, sex, race, site and equipment where relevant.
5. How a human uses the output. What the clinician sees, what they can override, and what happens when they disagree.
6. How you will watch it after launch. Triggers, metrics and responsibilities.

If you are also building a decision support tool, our guide to the documents FDA reviewers want for clinical decision support covers the paperwork side in more detail.

Transparency is becoming a baseline expectation

The direction of travel is clear. Regulators are moving away from a model where software is locked at clearance and toward one where manufacturers show their work across the product's life. One research paper on radiology AI that evolves over its life cycle argues that data drift makes static validation insufficient, because shifts in patient populations and imaging conditions can degrade deep learning models.

For your team, this means three habits:

• Record data lineage as you go. Reconstructing it a year later is painful and sometimes impossible.
• Report performance by subgroup. If you cannot, you will have to explain why.
• Keep a model update history. Know what changed, when and why, and what you tested before release.

None of this requires a large company's resources. It requires deciding early that these records matter. A practical AI model governance framework can help your engineering and operations teams think through ownership, oversight and reporting before an auditor or a customer asks for them.

What the numbers say about the AI device market

The market is growing fast. As of July 2025, the FDA had authorized more than 1,250 AI-enabled medical devices, up from about 950 in August 2024. Radiology accounts for 77% of them and cardiovascular for 9%. Most authorized devices still use traditional predictive models, not generative AI.

The route to market is narrower than many founders expect. Roughly 96% of AI-enabled device authorizations go through 510(k). In 2024, 94.6% of ML-enabled devices were cleared via 510(k) and 5.4% through De Novo, with median review times of 151 days and 372 days respectively.

Those figures cut two ways:

• A 510(k) can mean faster entry, but only if a suitable predicate exists. If one does not, you are planning for De Novo. Our piece on De Novo versus 510(k) strategy for SaMD founders walks through that decision.
• A fast clearance does not equal strong clinical evidence. The same 2024 analysis points to documented gaps in reported algorithmic details and prospective validation.

Why investors should read past the clearance

For venture and private equity teams, an FDA authorization is a milestone, not proof of clinical value. A review of FDA-approved AI/ML devices published in the Journal of Medical Artificial Intelligence notes that many have limited prospective clinical validation. Our reading is that the durable value sits with companies that can show performance across diverse, real-world patient populations, not only equivalence to a predicate.

Due diligence has a second trap. A study of FDA's PCCP experience found that public summaries are not updated after clearance, even when the model changes, and that many manufacturers do not publicly report subgroup analyses. Relying on the summary alone can mislead you. Ask for the technical file, the labeling and the monitoring plan.

Questions worth putting to any AI device company in your portfolio or pipeline:

1. Who owns clinical validation, and do they have authority over release decisions?
2. Was the test set truly independent, and from which sites?
3. How does the device perform in subgroups, and where is that documented?
4. What happens when the model drifts? Who is alerted, and what is the response?
5. Is a PCCP in place or planned, and is the infrastructure behind it real?

For revenue-side scrutiny, our healthcare SaaS revenue model evaluation guide for investors pairs well with this clinical checklist.

GMLP and the Predetermined Change Control Plan

Principle 10 asks you to monitor and manage models after deployment. The PCCP is the regulatory vehicle for planned model changes. On December 4, 2024, FDA finalized its guidance on PCCPs for AI-enabled device software functions. Under a PCCP, modifications you described and validated in advance can be made without a new marketing submission.

Uptake is limited. As of 2024, only about 17% of FDA-authorized ML-enabled devices used one. The reason is the evidence bar. A PCCP asks you to describe planned changes, the methods to develop and validate them, and an assessment of their impact, all before you ship.

Founders should treat it as a risk-management commitment. The hard part is defining change boundaries that are specific enough for FDA to accept and broad enough to fit your future data. You have to predict your own roadmap, and have the drift detection and validation infrastructure to back it up. Our five-step PCCP checklist for SaMD shows how to structure that work and avoid deficiency letters.

Where startups lose time

These are the patterns we see most often when early companies approach AI device development.

Treating GMLP as a late-stage regulatory exercise. By the time a regulatory consultant is hired, the dataset is already built, the split is already made and the lineage is already unrecorded. Fixing that can mean rebuilding.

Validating the algorithm, not the workflow. Principle 7 asks about the human-AI team. If the clinician ignores or over-trusts the output, headline accuracy is moot.

Thin subgroup analysis. A model trained at two academic centers can behave differently in community settings. If you cannot show where it holds up, say so in labeling, and plan more data.

Security and engineering as afterthoughts. Principle 2 pulls cybersecurity into the model pipeline. Our FDA cybersecurity checklist for devices and the guide to SBOM requirements in SaMD regulatory strategy cover what reviewers expect. If your product handles protected health information, review HIPAA compliant AI controls with your engineering leads too.

Submission gaps. Missing documentation is a common reason for delays. See seven FDA SaMD guidance submission gaps for what to check before you file.

A founder's GMLP starting plan

If you are pre-submission, this sequence keeps the work manageable.

1. Define the intended use and the clinical question. Everything else follows from it. Write it in the language a clinician would use.
2. Put a physician leader on the team now. Principle 1 calls for multi-disciplinary expertise, and clinical judgment shapes the reference standard, the workflow and the labeling.
3. Document datasets from the first pull. Source, dates, sites, demographics, exclusions and cleaning steps.
4. Lock the split rules early. Patient-level separation, site-level where possible.
5. Plan subgroup reporting before you see results. Choose the subgroups for clinical reasons, not because they look good.
6. Design for the human in the loop. Prototype the interface with real users and test the combined performance.
7. Write the monitoring plan before launch. Metrics, thresholds, owners and response steps.
8. Decide about a PCCP deliberately. Only if your roadmap includes foreseeable model changes you can specify and validate.

For the broader picture of how regulatory work fits a startup, start with our healthcare startup regulatory basics for founders, and see how clinical product development is sequenced.

Our perspective

We see GMLP as a clinical leadership issue as much as a technical one. Most of the ten principles ask a question a physician would ask: Who is this for? What does the patient population look like? How will a clinician act on this output? What happens when it is wrong?

A startup can have strong engineers and a smart regulatory consultant and still miss those questions, because no one on the team has practiced medicine while using software. That is the gap a fractional Chief Medical Officer is built to close. A clinician at the table early shapes the intended use, the reference standard, the workflow testing and the labeling. It is far cheaper than discovering a mismatch in a deficiency letter or during investor diligence.

Our advice to founders is to treat GMLP as a product discipline, not a filing. Investors, take the same view: ask how the evidence was built, not only whether the device was cleared. If something feels misaligned in your clinical strategy, I'd welcome a conversation.

— Paul Bergeron MD, MBA

Working with The StartUp MD

The StartUp MD is a healthcare advisory firm for healthcare SaaS and digital health companies, led by Paul Bergeron, MD, MBA. We provide Fractional Chief Medical Officer and advisory services, including clinical strategy, product evaluation, regulatory guidance, market readiness assessment and investor support. If you are building an AI-enabled product and want clinical and regulatory leadership without a full-time executive hire, see how we work. Learn more about what a CMO does in a healthcare startup if you are weighing the role.

FAQ

Is GMLP a regulation I must comply with?

GMLP is a set of guiding principles, not a regulation or certification. The FDA says the principles inform good practice, as noted on its GMLP page. In practice, reviewers expect your submission to reflect them, so treat them as the standard your evidence will be judged against.

Who issued the GMLP principles?

FDA, Health Canada and the UK's MHRA first published 10 guiding principles in 2021. In January 2025, IMDRF released its final 10-principle document, N88, which is the current reference. Both versions cover the full life cycle of an AI-enabled device.

Does GMLP apply to generative AI?

The IMDRF principles address AI/ML-enabled devices broadly and are not limited to one model type. Most currently authorized devices still use traditional predictive models, according to the Bipartisan Policy Center review. If your product uses generative AI, discuss your plan with FDA early and with a regulatory professional.

Do I need a PCCP to follow GMLP?

No. A PCCP is optional and only useful if you can define future model changes and how you will validate them. Only about 17% of authorized ML-enabled devices used one as of 2024, per the medRxiv analysis. Post-deployment monitoring under Principle 10 applies either way.

Sources

• FDA: Good Machine Learning Practice for Medical Device Development, Guiding Principles
• IMDRF: Good Machine Learning Practice for Medical Device Development (N88)
• Bipartisan Policy Center: FDA Oversight, Understanding the Regulation of Health AI Tools
• Machine Learning-Enabled Medical Devices Authorized by the FDA in 2024
• Regulating Flexibility for AI: FDA Experience with PCCPs (medRxiv)
• Current state of FDA-approved AI/ML devices, Journal of Medical Artificial Intelligence
• Ropes & Gray: FDA Finalizes Guidance on PCCPs for AI-Enabled Device Software
• Maynard Nexsen: The AI in SaMD Trifecta
• alphaXiv: Regulating radiology AI medical devices that evolve in their lifecycle

Recommended

• Healthcare Startup Regulatory Basics Explained for Founders
• SBOM Now Required: SaMD Regulatory Strategy for U.S. Founders
• Avoid Months of Delay: De Novo vs 510(k) Strategy for U.S. SaMD Founders
• Avoid These 7 FDA SaMD Guidance Submission Gaps for U.S. Startups