FDA's Predetermined Change Control Plan: What AI Medical Device Makers Must Lock In Before Submission

More than 950 AI/ML-enabled medical devices had received FDA authorization by the end of 2024. The majority of those manufacturers cleared their initial 510(k) or De Novo submission, celebrated the milestone — and then walked straight into a compliance gray zone they hadn’t planned for.

The gray zone is this: AI models change. They drift, they get retrained, they improve. And under FDA’s traditional device framework, a “significant change” to cleared software triggers the need for a new premarket submission. For a static software product, that’s manageable. For an AI system designed to adapt based on real-world data, it’s an operational nightmare.

That’s exactly the problem FDA’s Predetermined Change Control Plan (PCCP) guidance was built to solve. FDA finalized the PCCP guidance in December 2024, giving manufacturers a formal mechanism to pre-approve a defined set of future algorithm modifications at the time of initial submission. Done correctly, a PCCP lets your AI device evolve post-clearance without triggering a new 510(k) every time your model retrains. Done incorrectly — or not done at all — and you’re looking at unlicensed device modifications, Warning Letters, and the kind of enforcement attention nobody wants.

What FDA’s PCCP Guidance Actually Requires

The PCCP concept originated in FDA’s January 2021 “AI/ML-Based Software as a Medical Device (SaMD) Action Plan,” one of five pillars FDA identified for bringing AI-driven devices into a coherent regulatory framework. It took three years of stakeholder engagement, a 2023 draft guidance, and the finalized December 2024 rule to get to what we have today.

The guidance applies specifically to AI/ML-enabled Device Software Functions (AI/ML DSFs) — the subset of SaMD where the device’s intended function is driven by a trained algorithm. Think diagnostic imaging classifiers, early-warning sepsis predictors, ECG arrhythmia detectors. If the intelligence in your device lives in a model weight file, this guidance is written for you.

A compliant PCCP must contain four discrete elements:

1. Description of Planned Modifications — A specific, bounded list of the algorithm changes you anticipate making. Not “we may improve performance” — FDA expects defined modification types, such as “expand training dataset to include pediatric patients” or “update classification threshold from 0.72 to a range of 0.65–0.80.”

2. Modification Protocol — The methodology, testing standards, and data governance procedures you’ll follow when implementing each planned change. This section needs to reference your design controls under the QMSR (21 CFR 820, effective February 2026) and demonstrate that your change management process is reproducible and auditable.

3. Impact Assessment — A structured analysis of how each planned modification could affect device safety and effectiveness. FDA reviewers will scrutinize whether your impact assessment accounts for real-world performance drift, dataset shift, and subpopulation performance effects.

4. Summary of Planned Modifications — A matrix-style overview tying each planned change to its protocol and impact assessment, so reviewers can verify internal consistency across the document.

One thing that surprises manufacturers the first time they attempt a PCCP: FDA is not asking you to pre-validate every future model version. They’re asking you to pre-specify the rules by which future versions will be validated. That distinction matters enormously for how you scope and resource the document.

Four Architecture Decisions That Determine Your PCCP’s Success

We’ve reviewed PCCPs that sailed through FDA review and ones that generated cycle after cycle of deficiency letters. The difference almost never comes down to writing quality. It comes down to four engineering and validation architecture decisions that manufacturers need to lock in before the document is drafted.

1. Establish your performance boundaries in the cleared submission, not after.

Your PCCP’s impact assessments will reference performance thresholds — sensitivity, specificity, AUC, or whatever metric FDA accepted at clearance. If those thresholds weren’t clearly documented in your original 510(k), you have no baseline to anchor modifications against. We’ve seen manufacturers file supplemental submissions solely to establish a documented performance baseline before their PCCP could proceed — an entirely avoidable detour.

2. Define your training data governance framework before submission.

FDA’s PCCP guidance puts significant weight on data integrity and representativeness. If you’re planning modifications that involve expanded training datasets, FDA expects a documented process for how new training data is sourced, validated for quality, assessed for demographic balance, and version-controlled. IEC 62304, the medical device software lifecycle standard, provides the scaffolding; your SOP needs to operationalize it specifically for AI/ML workflows.

3. Separate your AI/ML DSF from static software functions in architecture documentation.

Regulators review devices, not systems. Your QMSR-aligned design documentation needs to clearly delineate which software modules are subject to the PCCP and which are static components subject to standard change control. Blurring this line is the fastest way to generate a major deficiency — reviewers can’t authorize changes to components they can’t confidently identify.

4. Align your PCCP scope to your clinical risk classification.

The IMDRF’s SaMD framework, which FDA adopted as a risk stratification reference, places software devices into four categories based on the significance of the information provided and the criticality of the clinical situation. A device providing diagnostic information in a critical care setting faces a fundamentally different PCCP review standard than a Class II wellness monitoring application. Scope your planned modifications accordingly; overclaiming future changes in a high-risk device class invites exactly the scrutiny you’re working to avoid.

What Happens When You Skip the PCCP

Let me be direct about the enforcement trajectory for AI devices that modify their algorithms post-clearance without a PCCP on file.

Under 21 CFR 807.81(a)(3), a new 510(k) is required when a change or modification “could significantly affect the safety or effectiveness of the device.” FDA’s guidance on deciding when to submit a 510(k) for a change to an existing device — in place since 1997 and reinforced by subsequent digital health policy statements — establishes that retraining a cleared AI model on new data may constitute a significant change depending on the magnitude of performance shift and the clinical context.

Without a PCCP, manufacturers face an unenviable choice every time they retrain: either submit a new 510(k) (typically a 12–18 month process, including time to resolve deficiencies) or make an internal “not significant” determination and document it with sufficient rigor to survive an inspection. That latter path works until it doesn’t. And when it doesn’t, the consequences include FDA-483 observations, Warning Letters, import alerts, and in extreme cases, consent decrees that effectively halt commercial operations.

FDA’s Digital Health Center of Excellence (DHCoE), established in 2020, has made AI/ML device oversight a stated enforcement priority. Investigators with specific digital health training are now embedded in routine device inspections, and the program’s scope has expanded consistently each fiscal year. “We didn’t know we needed a PCCP” is not a finding that ages well under inspection.

How to Prepare Your PCCP: A Three-Stage Process

For manufacturers who either didn’t include a PCCP in their initial submission or received clearance before the December 2024 guidance was finalized, the practical path forward involves three stages.

Stage 1: Gap Assessment (4–6 weeks)

Map your current AI/ML architecture against PCCP requirements. Identify which algorithm components are subject to post-market modification, document your current change control procedures, and assess whether your design history file contains sufficient baseline performance data. This is where engaging regulatory compliance consulting services early pays off — gaps identified here cost a fraction of what they cost after a deficiency letter arrives.

Stage 2: PCCP Document Development (8–12 weeks)

Draft the four PCCP components with cross-functional input: regulatory affairs for the impact assessments, data science for the modification protocols, and quality assurance for the data governance framework. If your device has been on the market for more than 12 months, you’ll likely need retrospective documentation of any algorithm updates already implemented — and a clear explanation of how those updates were evaluated.

Stage 3: Submission Integration and Pre-Sub Engagement

For devices not yet cleared, the PCCP is submitted as part of the marketing submission — embedded in the software documentation section with explicit cross-references to the 510(k) performance testing results. For cleared devices seeking to add a PCCP, FDA has indicated that a supplemental submission may be required depending on the device class and the scope of modifications you’re seeking to authorize. Consider engaging FDA’s DHCoE through the Q-Submission (Pre-Sub) program for preliminary feedback on your PCCP structure before filing; that 60–90 day investment routinely saves 6–12 months of review cycle time.

The Compliance Advantage Most Teams Are Leaving on the Table

There’s a strategic dimension to the PCCP that compliance teams sometimes undersell internally. A well-constructed PCCP signals to FDA reviewers that your organization has mature AI governance — that you understand how your algorithm will evolve and why that evolution is controlled and bounded. That signal affects review timelines, the tenor of reviewer correspondence, and your firm’s standing in subsequent submissions.

Manufacturers who invest in PCCP architecture now are building a regulatory asset, not just checking a compliance box. As FDA increases scrutiny of post-market AI performance — and the agency’s track record suggests this trajectory will continue — having a PCCP on file transforms every algorithm update from a potential enforcement event into a pre-authorized operational action.

Over 950 authorized AI/ML devices. Somewhere between a few dozen and a few hundred have PCCPs on file. If you’re reading this and your device isn’t among them, that gap is worth closing before your next scheduled FDA inspection.

Written by Sam Sammane, Founder & CEO, Aurora TIC | Founder, Qalitex Group. Learn more about our team

Talk to our compliance consultants about your AI/ML device PCCP strategy. Contact us

Related from our network

• ISO 17025-Accredited Testing to Support Medical Device Submissions — Qalitex Laboratories provides accredited analytical and functional testing to support design verification and 510(k) documentation.
• Medical Device Regulatory Compliance for the Canadian Market — Androxa supports Health Canada licensing and GMP compliance for device manufacturers entering Canada.