Toward One Rulebook: International Harmonization for ML Medical Devices

In January 2025, the International Medical Device Regulators Forum (IMDRF) finalized a document, coded IMDRF/AIML WG/N88 FINAL:2025, that sets out ten shared guiding principles for good machine learning practice (GMLP) in medical devices. It does not create a single binding law across countries. What it does is give regulators across many jurisdictions a common vocabulary and a common set of expectations for how AI-enabled devices should be developed, tested, and monitored. That is the practical meaning of harmonization here: not one rulebook enforced everywhere, but one reference point that national rulebooks increasingly point back to.

This article is educational and is not medical or regulatory advice.

What IMDRF actually published

IMDRF is a voluntary group of medical-device regulators whose members include authorities from the United States, the European Union, Japan, Canada, the United Kingdom, Australia, Brazil, China, Singapore, South Korea, and Switzerland, with the World Health Organization as an observer. The forum has no power to compel any member to adopt its documents. Its output is guidance that members may choose to reflect in their own frameworks.

The N88 final document, dated late January 2025, identifies ten principles intended to promote the development of safe, effective, and high-quality AI/ML-enabled devices across the total product life cycle. According to IMDRF's own account, N88 builds directly on a set of ten guiding principles that the U.S. Food and Drug Administration, Health Canada, and the UK's Medicines and Healthcare products Regulatory Agency jointly issued in October 2021. In other words, three national regulators drafted a shared starting point, and IMDRF then carried that content up to a broader multilateral level. The FDA continues to host those same principles on its own site, which is one reason the alignment is more than rhetorical.

The ten principles, in plain terms

The principles cover the full arc of a device's life. Paraphrasing the published set, they call for multidisciplinary expertise across the product life cycle; sound software engineering and security practices; datasets that represent the intended patient population; separation of training and test data so results are not self-flattering; reliance on the best available reference standards; model design fitted to the available data and clinical setting; attention to the performance of the human-AI team rather than the algorithm alone; testing under clinically relevant conditions; clear information for users; and monitoring of deployed models for real-world performance and drift.

Read together, these are less a technical recipe than a shared statement of what regulators will look for. A developer who can show representative data, honest test separation, human-factors testing, and a monitoring plan is speaking a language that the FDA, Health Canada, and the MHRA had already agreed on, and that IMDRF has now extended to its wider membership.

Why a shared reference point matters

A device company that trains one model does not want to redesign its evidence package a dozen times for a dozen agencies. Historically, that fragmentation was a real cost. When regulators anchor to the same principles, a manufacturer can build one core validation story and adapt it at the margins, rather than starting over per market. The stated aim of the working group is convergence on expectations, so that oversight is more consistent across borders.

There is a patient-facing argument too. Machine-learning devices carry risks that traditional software does not: performance can degrade as clinical populations shift, and a model can encode bias present in its training data. Principles that every participating regulator recognizes, such as representative data and post-deployment monitoring, raise the floor everywhere at once instead of only where the strictest regulator happens to operate.

The limits of harmonization

N88 needs to be read for what it is and is not. A guiding-principles document is not a regulation. It does not override the EU's Artificial Intelligence Act or the Medical Device Regulation, and it does not amend U.S. law. The EU and the FDA still run distinct legal systems with distinct definitions, evidence thresholds, and enforcement tools. Convergence at the level of principles can coexist with real divergence at the level of binding requirements.

IMDRF signaled that this is a moving field rather than a finished one. The same working group opened a public consultation in 2026 on a technical framework for AI life-cycle management, and a companion document on software risk characterization worked to align terminology, folding the EU concept of medical device software together with the FDA concept of software as a medical device. That direction of travel, toward shared terms as well as shared principles, is what makes the harmonization credible over time. But shared terms are a foundation for alignment, not proof that two agencies will reach the same decision on the same device.

What to watch next

The honest way to read N88 is as a milestone in a long convergence, not an endpoint. The near-term signal to watch is whether individual regulators cite these principles in their own binding guidance and review practices, and whether the pending life-cycle framework turns high-level principles into more operational expectations. If that happens, a developer's single, well-documented case for a model's safety and performance will travel further across borders. If it does not, N88 will remain a useful common vocabulary that each jurisdiction still translates into its own law on its own terms.