IMDRF Sets the Standard: 10 Key Principles for AI-enabled Medical Devices

Ron Sangal
A hospital room full of equipment with futuristic user interfaces.

The International Medical Device Regulators Forum (IMDRF) has released a new document outlining ten guiding principles for Good Machine Learning Practice (GMLP) in the development of medical devices that incorporate artificial intelligence (AI), including machine learning. This document is intended to promote the development of safe, effective, and high-quality AI-enabled medical devices.

The ten guiding principles are:

  1. Well-defined intended use: AI-enabled medical devices must be designed and used to address clinically meaningful needs. This requires a thorough understanding of the device’s intended use, benefits, and risks throughout its lifecycle. Multidisciplinary expertise should be leveraged to ensure safety and effectiveness.
  2. Good software engineering, medical device design, and security practices: It is vital to ensure robust software engineering practices are implemented throughout the product life cycle. This can be achieved by using validated quality management systems and quality assurance tools, as well as following strict data management and cybersecurity protocols. This also includes having well-structured risk management and design processes to ensure confidence in the outputs of the model.
  3. Clinical evaluation with representative datasets: Data collection protocols must ensure the datasets used for training, testing, and monitoring the AI model sufficiently represent the intended patient population, use environment, and inputs. This helps manage bias, promote generalisability, assess usability, and identify potential underperformance.
  4. Independent training and test datasets: Training and test datasets should be selected and maintained independently of one another. All potential sources of dependence, including factors related to patients, sites, and data acquisition, should be considered and addressed.
  5. Fit-for-purpose reference standards: Accepted methods for developing reference standards should be used to ensure that clinically relevant and well-characterised data is collected. The limitations of reference standards should be understood, and the rationale for their choice should be documented based on the device’s intended use and assessment of their suitability for the intended use environment.
  6. Model choice and design tailored to data and intended use: The choice and design of the AI model should be evaluated and shown to be suitable for the available data and support the mitigation of known risks such as overfitting, performance degradation, and security risks. The clinical benefits and risks related to the product should be well understood and used to derive clinically meaningful performance goals for testing.
  7. Assessment of human-AI interactions: Device performance should be evaluated within its intended use environment and clinical workflow, considering interactions with all users. Human factors like user skills, understanding of model outputs, potential for overreliance, device autonomy, and user error should be addressed for both normal use and foreseeable misuse.
  8. Performance testing in clinically relevant conditions: Methodologically and statistically sound test plans should be developed and executed to generate clinically relevant device performance information independently of the training dataset. Considerations should include the intended patient population, relevant subgroups, clinical environment, use by the human-AI team, measurement inputs, and potential confounding factors.
  9. Clear and essential information for users: All users (healthcare professionals, patients, etc.) must receive clear, relevant information about the product’s intended use, indications, benefits, risks, performance, and limitations. This includes details about the model’s development, data used, inputs, outputs, and user interface. Users should also be informed about device updates and have a way to report concerns to the manufacturer.
  10. Monitoring of deployed models and management of re-training risks: Deployed models should be capable of ongoing monitoring in real-world use with a focus on maintaining or improving safety and performance. When models are retrained after deployment, appropriate controls should be in place to manage risks of overfitting, unintended bias, or degradation of the model that may impact safety and performance.

These guiding principles are a call to action for international standards organisations, regulators, and other collaborative bodies to further advance GMLP. Areas of collaboration include research, educational tools and resources, international harmonisation, and consensus standards to inform regulatory policies and guidelines.

Diagram illustrating what is considered a good machine learning process.
Good Machine Learning Practice

The IMDRF emphasises the importance of GMLP in the context of evolving AI technologies, particularly generative AI. Generative AI presents unique considerations and potential risks, such as the use of foundation models not under the provenance of medical device manufacturers. The regulatory science of measuring performance and characterising and detecting errors in these models is maturing to meet these challenges.

As the field of AI medical devices continues to evolve, so too must GMLP and consensus standards. The IMDRF’s publication of these guiding principles is a significant step in promoting the safe and effective development of AI-enabled medical devices. Medical device manufacturers should familiarise themselves with these principles and incorporate them into their development processes to ensure compliance and maintain patient safety.

Subscribe to our newsletter for the latest updates on this rapidly changing field. If you have any questions, book a free, no-obligation call with one of our Software as a Medical Device (SaMD) experts.

Related articles

  1. Cybersecurity Vulnerabilities in Medical Devices: FDA Alerts on Contec and Epsimed Monitors

    Patients can be exposed to risks when devices are online. We explore implications for EU MDR/IVDR cybersecurity requirements, including MDCG guidance

    Dr Clare Dixon Dr Clare Dixon Regulatory Specialist
  2. Software as a Medical Device

    Software as a Medical Device

    Unless you have spent time working with medical device legislation in the past, the idea that software could be a medical device may be rather unexpected.

    Dr Paul Hercock Dr Paul Hercock Chief Executive Officer

More articles

Do you need support with your medical device approval strategy?

Contact us today