One Set of Principles, Many Rulebooks: Harmonizing AI Medical Devices

Imagine the same AI-based imaging tool reading a chest scan in Toronto on Monday and a nearly identical scan in Munich on Tuesday. Should the two health systems judge that tool by the same yardstick? A 2025 document from the International Medical Device Regulators Forum (IMDRF), coded N88, tries to move the answer toward yes. It sets out ten shared principles for good machine learning practice, and while it changes no country's law, it gives many regulators one common reference to point back to.

Key points#

• IMDRF N88, finalized in early 2025, lists ten guiding principles for developing AI and machine-learning medical devices safely across a product's whole life.
• IMDRF is a voluntary forum of regulators. It cannot force any member to adopt its documents; members choose whether to reflect them.
• The ten principles began as a joint 2021 statement by the FDA, Health Canada, and the UK's MHRA, then were carried up to a wider multi-country level.
• Harmonization here means shared expectations, not one binding rulebook. National laws such as the EU AI Act still differ.

The problem N88 is trying to solve#

A company that trains one diagnostic model does not want to rebuild its evidence twelve different ways for twelve different agencies. That fragmentation has long been a real cost, and it can slow how quickly a useful tool reaches patients. When regulators anchor to the same principles, a manufacturer can assemble one core validation story and adjust it at the edges for each market, rather than starting from scratch.

There is a patient-facing side too. Machine-learning devices behave differently from ordinary software. Their accuracy can drift as the patient population shifts, and a model can absorb and repeat bias baked into its training data. If every participating regulator agrees on the same baseline, such as using data that represents the intended patients and watching performance after release, the floor rises everywhere at once, not only where the strictest agency happens to sit.

What IMDRF actually published#

IMDRF is a voluntary group of device regulators. Its members include authorities from the United States, the European Union, Japan, Canada, the United Kingdom, Australia, Brazil, China, Singapore, South Korea, and Switzerland, with the World Health Organization taking part as an observer. The forum has no authority to compel anyone. Its output is guidance that members may fold into their own frameworks if they choose.

The N88 final document, dated early 2025, names ten principles meant to support safe, effective, high-quality AI/ML-enabled devices across the total product life cycle. By IMDRF's own account, N88 builds directly on ten guiding principles that the U.S. Food and Drug Administration, Health Canada, and the UK's Medicines and Healthcare products Regulatory Agency issued together in October 2021. Three national regulators wrote a shared starting point; IMDRF then lifted that content to a broader multilateral level. The FDA still hosts the same principles on its own website, which is part of why the alignment is more than words on paper.

The ten principles, in plain language#

The principles track a device from first design to routine use. Paraphrased, they ask developers to:

• bring multidisciplinary expertise across the whole product life;
• follow sound software engineering and security practice;
• use datasets that represent the intended patient population;
• keep training and test data separate, so results are not self-flattering;
• rely on the best available reference standards;
• fit the model design to the data and the clinical setting at hand;
• judge the performance of the human-and-AI team, not the algorithm alone;
• test under clinically realistic conditions;
• give users clear, honest information; and
• monitor deployed models for real-world performance and drift.

Read together, these are less a technical recipe than a shared statement of what reviewers will look for. A developer who can show representative data, an honest split between training and testing, human-factors testing, and a monitoring plan is speaking a language that the FDA, Health Canada, and the MHRA had already agreed on, and that IMDRF has now offered to its wider membership.

Where harmonization stops#

You have to read N88 for what it is, and for what it is not. A guiding-principles document is not a regulation. It does not override the EU's Artificial Intelligence Act or Medical Device Regulation, and it does not amend United States law. The EU and the FDA still run distinct legal systems with distinct definitions, evidence thresholds, and enforcement tools. Agreement at the level of principle can sit alongside genuine disagreement at the level of binding requirement. Two agencies can share a vocabulary and still reach different decisions on the same device.

The forum has signaled that this remains a moving field. The same working group opened a public consultation in 2026 on a technical framework for managing an AI model's life cycle, and a companion effort on software risk characterization worked to line up terminology, folding the EU idea of medical device software together with the FDA idea of software as a medical device. That direction, toward shared terms as well as shared principles, is what could make the harmonization durable. Shared terms are a foundation for alignment, though, not proof of matching verdicts.

What to watch next#

The honest way to read N88 is as a milestone in a long convergence, not a finish line. The near-term signal you should watch is whether individual regulators start citing these principles inside their own binding guidance and review practice, and whether the pending life-cycle framework turns high-level ideas into more concrete expectations. If that happens, a developer's single, well-documented case for a model's safety and performance will travel further across borders. If it does not, N88 will stay a useful common vocabulary that each country still translates into its own law on its own terms.