Executive Summary

Predetermined Change Control Plans (PCCPs) represent a transformative regulatory tool for AI/ML Software as a Medical Device (SaMD). Traditionally, medical device manufacturers must submit a new premarket application (510(k), PMA supplement, or De Novo request) whenever a marketed device undergoes significant changes. However, adaptive AI/ML-driven devices continuously learn and evolve, rendering the static regulatory paradigm insufficient. To reconcile innovation with safety, the U.S. Food and Drug Administration (FDA) – in collaboration with Health Canada and the U.K. MHRA – has established PCCPs as a pre-approved blueprint for future algorithm modifications. When properly designed and authorized, a PCCP allows pre-specified software updates to occur without separate regulatory submissions, provided they remain within the agreed scope and follow the defined change protocol.

This Implementation Guide synthesizes the FDA’s guidance and related literature to provide an in-depth reference for industry, regulators, and stakeholders. It begins with historical context and regulatory drivers for PCCPs, including key legislative changes (e.g. Section 515C of the FD&C Act) (^[1]) (^[2]). We then define PCCPs, explaining their components (planned modifications, implementation protocol, impact assessment) (^[3]) (^[4]). Next, we detail the FDA’s formal guidance: from the 2023 draft to the finalized guidance (late 2024) (^[5]) (^[6]). Guidance content is examined, including recommendations for describing AI-enabled device modifications, validation methods, real-world monitoring, and performance metrics (^[7]) (^[8]). Throughout, we cite supporting evidence: FDA documents, international harmonization principles, published studies, and expert analyses.

The report then addresses implementation: best practices for incorporating PCCPs into quality systems (21 CFR Part 820/ ISO 13485), risk management (ISO 14971), and Good Machine Learning Practices (GMLP) (^[9]) (^[10]). We discuss data requirements (training/validation datasets), change verification procedures, post-market surveillance, and transparency to users. A case-study framework highlights how a hypothetical AI SaMD (e.g. an adaptive imaging algorithm) would use a PCCP to iterate improvements while assuring safety. Tables summarize key elements: comparing “Traditional Change Control” vs “PCCP-Enabled” processes by regulatory pathway, and the FDA’s 5 PCCP Guiding Principles (^[4]) (^[8]).

Finally, the guide explores implications and future directions. We analyze how PCCPs impact innovation speed, cost, and patient benefit, as well as challenges (e.g. ensuring data integrity, managing bias, cross-jurisdictional harmonization). We contrast the FDA’s approach with other frameworks: e.g. the EU’s current stance (no formal PCCP yet) and calls for legislative action (^[11]). Expert opinions indicate that, to date, most AI devices remain “locked” models, with only a small fraction leveraging PCCPs, reflecting the practical difficulty of deploying continuous learning safely (^[12]) (^[13]). The conclusion underscores the potential of PCCPs to both drive responsible ML/AI device evolution and raise new governance questions. We recommend that manufacturers carefully design PCCPs according to FDA guidance, invest in monitoring infrastructure, and engage with regulators early to align on change scopes.

Key Takeaways: PCCPs allow manufacturers to predefine a set of algorithm changes, test procedures, and monitoring plans so that approved updates do not require repeated submissions (^[7]) (^[14]). The FDA’s guidance (August 2025 final) details what a PCCP must contain, building on Good ML Practices (^[7]) (^[8]). A well-constructed PCCP addresses risk (risk-based a la ISO 14971), evidence generation, transparency to users, and a total product lifecycle viewpoint (^[15]) (^[16]). Legally, Section 515C of the FD&C Act formalizes that when a PCCP is authorized, supplements/510(k)s are not required for planned changes within that PCCP (^[17]) (^[18]). This report aims to serve as a comprehensive reference for navigating and implementing PCCPs in the development of AI/ML SaMD.

Introduction and Background

Advances in artificial intelligence (AI) and machine learning (ML) are rapidly transforming medical devices. AI/ML-enabled SaMD can analyze medical images, personalize treatments, and assist diagnosis in ways not possible with conventional fixed-function software. Critically, many AI/ML algorithms can learn from new data over time, potentially improving performance or adapting to changing conditions (^[19]).This adaptive capability promises better health outcomes but conflicts with traditional medical device regulation, which assumes a static device. Under current frameworks (e.g. U.S. FDA or EU MDR), significant changes to a medical device (including software) generally require prior regulatory review and authorization (^[20]). For example, modifying an algorithm’s logic or retraining a model on new data would typically oblige the manufacturer to submit a new 510(k) or PMA supplement before marketing the change (^[5]). This model of “lock then submit” leads to regulatory bottlenecks for adaptive SaMD; updates may be slow to deploy, delaying benefits to patients (^[21]).

To address this challenge, regulators and industry have long discussed frameworks that permit controlled learning in the field. In 2019, the FDA proposed the concept of an “Algorithm Change Protocol (ACP)” for AI/ML SaMD, envisioning a pre-specified plan for updates (^[22]) (^[20]). The idea was to specify in advance how a device could evolve, so changes could occur without separate submissions if they followed the plan. In parallel, international groups (IMDRF, Health Canada, MHRA) issued Good Machine Learning Practice (GMLP) principles encouraging ongoing monitoring of AI/ML devices and managing retraining risks (^[23]) (^[9]).

Building on these concepts, the FDA (with Health Canada and MHRA) in 2021-2023 developed the notion of a Predetermined Change Control Plan (PCCP). A PCCP is essentially the “operational embodiment” of an ACP – a formal plan, agreed with regulators, describing which modifications will be made, how they will be implemented, and how their impact will be assessed (^[3]) (^[4]). By pre-authorizing changes within the PCCP, regulators aim to accommodate the rapid, iterative improvements of AI/ML SaMD while still ensuring safety and effectiveness (^[24]) (^[7]).

This report provides a comprehensive analysis of PCCPs in the context of AI/ML SaMD. We examine the legal basis (e.g. Section 515C of the FD&C Act) and regulatory guidance (draft and final FDA guidances) that define PCCPs. We detail the structure and content of a PCCP, citing official documents and expert interpretations. We discuss implementation considerations (how developers should create and manage PCCPs) and illustrate with examples and tables. Finally, we assess broader implications: how PCCPs may affect innovation, what challenges remain (e.g. in evidence collection and oversight), and how future policy might evolve. Throughout, all claims are supported by authoritative sources (FDA regulations, guidance documents, academic studies, and industry commentary) to provide a credible technical reference.

Historical Context: Regulation of AI/ML SaMD and the Need for PCCPs

Before AAC, regulatory frameworks treated devices as static artifacts. The device’s safety/effectiveness was assessed based on its design at the time of submission, and post approval, only minor changes could be implemented without further review. Any “significant” change—to design, labeling, intended use, or manufacturing process—normally triggered a new submission (a PMA supplement or new 510(k)) (^[20]) (^[25]). This model works well for hardware and traditional software, but not for continuously learning AI/ML. AI models can degrade (data drift) or improve (due to more data or better models) over time, making it impractical to re-lock a model indefinitely (^[12]) (^[13]).

Academic analyses noted this mismatch years ago. Gilbert et al. (2021) observed that “the performance of ML models can be continually improved based on updates from automated learning from data,” yet traditional regulations were not designed for such adaptivity (^[26]) (^[1]). The FDA itself acknowledged in 2019 that “AI/ML-based software as a medical device can continuously learn and adapt,” and proposed an ACP concept to allow predefined model changes (^[20]). Since then, regulatory initiatives have accelerated:

• FDA 2019 Discussion Paper: The FDA’s 2019 *“Proposed Regulatory Framework for Modifications to AI/ML-Based SaMD” introduced the idea of an Algorithm Change Protocol (ACP) as part of a submission (^[26]). Though a working concept, ACP lacked detailed formalization then.
• IMDRF GMLP (2021): In October 2021, the FDA, MHRA, and Health Canada released 10 GMLP guiding principles, principle 10 of which explicitly calls for monitoring deployed models and managing retraining risks (^[23]) (^[1]). Subsequently, IMDRF in 2022 published a Good Machine Learning Practice document reinforcing these tenets (^[27]) (^[28]).
• FD&C Act Amendment (2022): The U.S. Congress, via the FDA Safety and Landmark Advancements Act of 2022 (FDORA), formally added Section 515C to the FD&C Act, entitled “Predetermined Change Control Plans for Devices.” This statutory addition authorized PCCPs for devices requiring PMA or 510(k) review (^[1]) (^[2]). In brief, Section 515C(a) and (b) now stipulate that when a PCCP is approved by FDA, certain changes (within its scope) will not trigger a new submission (^[17]) (^[18]). The law empowers FDA to require or clear PCCPs and waive supplement/510(k) requirements for those changes.
• FDA Guidance (2023-2024): On April 3, 2023, FDA issued a Draft Guidance for industry on PCCPs (then called “marketing submission recommendations for a Predetermined Change Control Plan (PCCP) for AI/ML-enabled Device Software Functions”) (^[25]).️ Following stakeholder feedback, FDA finalized its PCCP Guidance in December 2024 (effective early 2025) (^[6]) (^[29]). Concurrently, the FDA issued Guiding Principles for PCCPs (joint with Canada/MHRA) in Oct 2023 (^[9]), and initiated a Draft Guidance extending PCCPs to non-AI devices (Aug 2024) (^[30]).

Collectively, these changes establish the requirement and framework for PCCPs. Section 515C provides the legal basis, while FDA guidance tells manufacturers how to develop and submit PCCPs. Importantly, FDA’s 2024 Final Guidance explicitly renames “ML Device Software Functions” to “AI-Enabled Device Software Functions” to capture the broader phenomenon (though most applications remain ML-based) (^[31]). The guidance applies to all pathways (510(k), De Novo, PMA) and even covers AI components of combination products (^[7]).

Implications: In essence, when a device is cleared/approved with an authorized PCCP, manufacturers can implement routine updates as long as they follow the PCCP. For example, a PMA device owner “shall not require” a PMA supplement for a change made under an approved PCCP (^[32]). Likewise, for a cleared Class II device, no new 510(k) is needed if the change is within an approved PCCP (^[33]). FDA may also require PCCPs to include certain elements (e.g. labeling, performance criteria, user notification) to maintain safety (^[34]) (^[18]).

In summary, the FDA has moved from a passive stance (requiring every major change to be individually reviewed) to a proactive lifecycle approach, where pre-defined changes are vetted upfront. This represents a paradigm shift in SaMD regulation, aimed at balancing innovation speed with patient safety.

Predetermined Change Control Plans (PCCPs): Definition and Components

A Predetermined Change Control Plan (PCCP) is formally defined in FDA guidance as a manufacturer-proposed plan that “specifies certain planned modifications to a device, the protocol for implementing and controlling those modifications, and the assessment of impacts from modifications.” (^[3]) In practice, a PCCP is like a playbook submitted during the initial marketing application (510(k), PMA, or De Novo) describing how the AI/ML algorithm may evolve post-approval. A well-constructed PCCP typically includes the following core components:

• Scope/Intended Changes (Description of Modification, DOM): This section lists each type of change that may be made. Changes must be specific and limited to the device’s original intended use. For example, a PCCP might allow retraining on new image data, adjusting classification thresholds, or adding new but equivalent input sensor modalities (^[35]) (^[4]). It cannot include changes that extend the device to a new clinical use or alter its intended population (^[36]) (^[20]). In FDA’s Guiding Principles, this is the “Focused and Bounded” requirement: the PCCP “describes specific changes that a manufacturer intends to implement” within the original scope (^[35]).
• Change Protocol (Modification Protocol): For each planned modification, the PCCP describes how the change will be developed, validated, and implemented. This includes the algorithmic approach, retraining methods, software development processes, and verification testing protocols (^[7]) (^[14]). For example, it would specify the source of new training data, the model architecture updates (if any), performance metrics (e.g. accuracy, sensitivity), acceptance criteria, and version control procedures. The protocol may also outline continuous monitoring triggers (e.g. performance drop thresholds) that would halt changes. By detailing these methods upfront, the PCCP assures FDA that appropriate engineering and quality controls are in place for each update.
• Impact Assessment (Performance Monitoring Plan): The PCCP must define how the impact of each modification will be measured and documented. This typically involves pre-specified performance metrics and evaluation datasets (benchmark test sets) to quantify improvement or risk. FDA expects manufacturers to have metrics (e.g. ROC-AUC, false-negative rate) and success criteria defined a priori (^[7]) (^[14]). The plan should also include a post-deployment monitoring strategy (real-world data collection, periodic audits) to ensure safety. The FDA’s Guiding Principles emphasize evidence generation: a PCCP should be supported by evidence throughout the total product lifecycle (^[8]). In other words, the device’s performance before and after each change must be documented to "ensure ongoing safety and effectiveness" (^[8]).
• Risk Control Measures: Although not always labeled separately, a PCCP implicitly incorporates risk management. It should enumerate any new hazards introduced by the changes and how they are mitigated. For instance, if a modification could increase false positives, the PCCP would define monitoring for that and fallback conditions. FDA’s risk-based principle states that the PCCP’s design and implementation must be “driven by a risk-based approach” in line with ISO 14971 (^[15]). In practice, this means the PCCP might include robust validation tests on edge cases, or throttling of model changes.
• Transparency and Disclosure: Best practices call for transparency to users and stakeholders. The PCCP should specify how changes will be communicated (e.g. labeling updates, customer notifications) and ensure stakeholders understand the device’s baseline and anticipated evolution. The FDA Guiding Principles recommend that PCCPs provide “clear and appropriate information” so that users are aware of device performance before and after changes (^[37]).

These elements often appear under various names in documents. In industry literature, manufacturers refer to a PCCP as comprising a Description of Modification (DOM), a Modification Protocol (MP), and an Impact Assessment (^[10]). Figure 1 below illustrates the relationship between these components.

Table 1. Core components of a PCCP (adapted from FDA guidance and MDIC recommendations).

By submitting a PCCP with the original regulatory application, the manufacturer pre-approves this package of changes. Once FDA authorizes the PCCP, the device sponsor is permitted to implement any of the described modifications without additional submissions, as long as each change strictly follows the PCCP protocol (^[17]) (^[33]). The intent is to streamline adaptive improvements: incremental changes within a validated plan are treated as “condition-based” rather than “version-by-version” updates.

Regulatory Framework for PCCPs

U.S. Legal Authority (FD&C Act §515C)

The 2022 enactment of FDORA (FDA Safety & Landmark Advancements Act) amends the FD&C Act by adding Section 515C, which explicitly authorizes PCCPs for devices requiring premarket approval or clearance (^[17]) (^[2]). Section 515C(a) applies to approved (class III/PMA) devices and Section 515C(b) to cleared (class II/510(k)) devices. Its main effects are:

• No Supplemental Application Required: For a PMA-approved device, §515C(a)(1) provides that “Notwithstanding §515(d)(5)(A), a supplemental application shall not be required for a change to a device approved under §515 if such change is consistent with a predetermined change control plan that is approved pursuant to paragraph (2)” (^[17]). In plain terms, if a change is made under an authorized PCCP, you do not need a PMA supplement. (The provision explicitly exempts PCCP-covered changes from the standard statutory requirement for supplement filings.)

• PCCP Submission and Approval: §515C(a)(2) gives FDA the power to approve a PCCP describing planned changes for a PMA device (^[17]). FDA can accept a PCCP either with the original PMA or in a PMA supplement. Similarly, §515C(b)(2) allows FDA to clear a PCCP in a 510(k) or De Novo submission for a Class II device (^[18]). Effectively, the manufacturer submits the PCCP as part of its marketing application, and if FDA finds it acceptable, the PCCP is “authorized.”

• No New 510(k) Required: For changes to cleared devices, §515C(b)(1) states that a new 510(k) submission is not required if the change is within the scope of an approved PCCP. Bridging Consulting interprets this to mean: “A new 510(k) is not required for a change made to a 510(k) device if such change is within the scope of and consistent with an approved PCCP.” (^[33]). As with PMAs, this grants legal cover for not filing a supplemental 510(k) for PCCP-approved updates.

• Enforcement & Conditions: Section 515C also includes provisions allowing FDA to impose conditions. For instance, FDA “may require that a change control plan include labeling… and a control plan” such as notifying patients/users if a change fails performance criteria (^[34]). The law further ensures PCCPs integrate with existing statues: e.g. it amends 21 CFR §513(i) (substantial equivalence) and §510(l) (circumvention) so that PCCP-driven changes do not trigger undue regulatory barriers (^[17]) (^[38]).

In summary, Section 515C gives FDA clear authority to allow certain updates without new submissions, provided a PCCP has been approved. This legislative backing is crucial – it codifies that PCCPs are part of the official approval process, not merely an administrative convenience (^[2]) (^[17]).

FDA Guidance Documents

The FDA has released several key documents outlining expectations for PCCPs:

• Guiding Principles for PCCPs (Oct 2023): Published jointly by FDA, Health Canada, and MHRA, this guidance is not binding law but presents high-level principles. It defines PCCPs, explains why they are needed, and enumerates five guiding principles (Focused/Bounded, Risk-Based, Evidence-Based, Transparent, TPLC Perspective) (^[39]) (^[35]). These principles serve as the foundation for regulatory thinking on PCCPs. For example, they clarify that PCCP changes must keep the device within its intended use (Principle 1) and that transparent communication is a best practice (Principle 4) (^[35]) (^[37]). These principles do not spell out procedural detail but guide manufacturers in designing robust PCCPs.

• Draft Guidance (April 2023): Formally titled “Marketing Submission Recommendations for a Predetermined Change Control Plan for AI/ML-Enabled Device Software Functions”, this FDA draft guidance detailed what a PCCP submission should look like. Key points included that manufacturers should describe planned modifications, the methodology for making them, and the impact assessment strategy (^[7]). The draft emphasized that implementing a PCCP (value: accelerate improvements) while still assuring safety (^[5]). It also noted exclusions: changes leading to new intended uses or material changes outside scope are inappropriate for PCCPs (^[40]). The draft went on to advise what information to include (modeling approach, validation datasets, monitoring metrics, etc.), though FDA’s full text was in PDF. Public comments on this draft informed the final language.

• Final Guidance (Dec 2024 / Jan 2025): On December 4, 2024, FDA finalized the PCCP guidance (“2024 Final Guidance” (^[6])). The final guidance – effective early 2025 – is largely consistent with the draft, but with clarifications. For instance, it renames “Machine Learning Device Software Functions (ML-DSFs)” to “AI-Enabled Device Software Functions (AI-DSFs)”, to align with FDA’s AI glossary (^[31]). It also emphasizes that PCCPs apply to all device marketing pathways (510(k), De Novo, PMA) (^[7]). Notably, the final guidance aligns FDA’s approach across AI and non-AI devices: it references a separate FDA Draft on PCCPs for all medical devices (Aug 2024), suggesting a broader policy shift (^[30]). Key recommendations from the final guidance include:

• Clearly define each planned AI modification and the process for updating the model (^[7]).

• Demonstrate software validation methodologies (statistical tests, performance evaluation) before and after changes (^[7]).

• Set criteria for real-world monitoring, e.g. how to detect data drift or degrade in performance.

• Incorporate GMLP elements, such as maintaining cybersecurity and data governance through the lifecycle (leveraging principle 10). The final guidance also emphasizes a Total Product Lifecycle (TPLC) approach: combining the PCCP in premarket review with robust postmarket oversight (^[8]) .

• Other Guidance: The FDA’s Digital Health and AI/ML software pages now feature resources on PCCPs. For example, FDA’s AI/ML-enabled device list and ongoing monitoring expectations reinforce the need to manage change through the device’s lifecycle (^[41]). Additionally, the FDA’s recent Software Precertification pilot reports and guidance (post-2020) echo the TPLC mindset even though they do not explicitly address PCCPs.

In sum, FDA guidance codifies the concept that a PCCP is reviewed as part of an AI device’s initial marketing submission, and once granted, it enables pre-authorized updates (^[7]) (^[17]). The guidance documents we cite throughout (indicated by carets after citations) should be read in detail by any sponsor undertaking PCCP development.

International Perspectives

While this guide focuses on FDA-regulated SaMD, PCCP ideas are gaining international traction. The guiding principles document itself is tri-national (US, Canada, UK) (^[9]), and Health Canada has begun incorporating PCCPs in its regulatory process (the guidance is jointly produced) (^[14]). The UK’s MHRA similarly published guidance and is expected to align its regulations (the guiding principles are on GOV.UK dated Oct 2023 (^[42])). In Yazao’s EU-focused survey, experts lament that the European Union currently “lags behind” in implementing PCCPs, urging EU regulators to legislate analogous provisions (^[11]). Indeed, the EU Medical Device Regulation (MDR) does not yet have an explicit PCCP-like mechanism; instead, significant software changes generally require notified body review, which is cumbersome for AI/ML. The upcoming EU AI Act (for all AI products) may have some relevant controls but is not device-specific.

Table 2 below compares how different jurisdictions handle adaptive SaMD changes:

Table 2. International landscape: Predetermined change plans in major medical device jurisdictions.

In conclusion, the FDA-led PCCP framework is among the most advanced. Other regulators (UK, Canada) are supportive, but Europe and others have yet to formalize PCCPs. Harmonization of PCCP expectations is an ongoing goal – the guiding principles document explicitly “encourages international harmonization” (^[43]). Any U.S. sponsor planning to expand abroad should monitor parallel initiatives and ensure their PCCP plan could satisfy multiple agencies where possible.

Implementing a PCCP: Best Practices and Process

Designing and executing a PCCP requires integrating change control into the AI/ML development lifecycle. Below we outline the key steps and considerations, drawing on FDA guidance, standards, and expert analyses.

1. Pre-market Preparation

• Quality Management Integration: From the outset, a PCCP should be embedded into the device’s quality system (QSR/ISO 13485). Section 7.3 of 21 CFR 820 (design controls) and ISO 62304 (software lifecycle) require procedures for change management and verification. The PCCP essentially becomes part of these procedures. Manufacturers should update their change control SOPs to recognize PCCP-authorized changes as “approved” without new submissions. This includes documenting who has authority to initiate changes, how design validation will occur, and how records will be kept.

• Risk Analysis and GMLP: Early in development, conduct a risk assessment (per ISO 14971) identifying hazards associated with AI modifications. The PCCP will build on this by specifying how new risks (e.g. overfitting, drift) are controlled. Good Machine Learning Practice plays a role too: for example, ensuring data represent the intended population, tracking dataset lineage, and managing cybersecurity. The FDA guidance notes that PCCPs “draw upon” GMLP Principles (^[44]), so developers should ensure the PCCP planning aligns with Principles 1–10 of GMLP (like input data relevance, performance monitoring, etc.) (^[44]) (^[8]). Ideally, aspects of the PCCP are referenced in the device’s design history file and risk management file.

• Define Change Opportunities: With an interdisciplinary team (AI engineers, clinicians, regulators), map out which device aspects might need future tuning. Common examples include: new training data sets, model hyperparameter adjustments, threshold updates for classification, new supported data inputs (e.g. additional imaging modalities), or algorithmic improvements. For each potential change, document why it might be needed (data drift, expanding indication, hardware upgrades, etc.). Prioritize changes that have high impact and are worth including in the PCCP. Remember, PCCPs should focus on planned evolutions; they are not meant for arbitrary unknown future work.

• Develop Performance Metrics and Datasets: For each identified change type, decide on how to evaluate it. Collect baseline datasets and annotation standards early. For example, if the device analyzes X-rays, assemble a baseline test set representing relevant patient populations. Establish statistical performance metrics (sensitivity, specificity, AUC, etc.) and acceptance criteria (e.g. performance should not drop below X%). Plan to re-run these tests after each change. The PCCP should specify the reference data and statistical tests used in each update cycle.

• Draft the PCCP Document: Using FDA guidance as a template, draft the PCCP text. Key sections typically include: description of each planned change (with clear boundaries), engineering protocol for implementing the change, validation plan (including what data and metrics will be used), and risk controls. Clarity is crucial: vague statements like “algorithm improvements” are insufficient. The FDA and MDIC materials suggest using specific, measurable terms. For example, rather than “increase accuracy,” specify “retrain model on new data to maintain ≥90% accuracy on the holdout set.” LCID references (^[10]) (^[7]) for such detail.

2. Marketing Submission (Premarket)

• Include PCCP in Package: Submit the PCCP as part of your 510(k), De Novo, or PMA files. The FDA expects it to be a discrete document or section. It should be labeled “Predetermined Change Control Plan (PCCP)” and incorporated by reference into your submission. This allows the FDA to review and authorize it as part of clearance/approval. When relevant, the PCCP may be cross-referenced in the main application (e.g. in summary of performance, risk analysis).

• Supporting Evidence: In addition to the plan itself, include justification and pilot data if available. For instance, if you plan to add a certain new data modality later, provide evidence now that integration is feasible. If you will update training data, show that initial data collection and model performance meet quality standards. Any evidence you can pack in to support the PCCP will ease the FDA’s review. FDA’s Draft Guidance implied that data used in developing the plan should also be submitted (^[5]).

• Risk Management Updates: Explain how the design risk file will be updated as changes happen. FDA expects that PCCP changes will be managed via your quality system, including updating risk/clinical evaluations as needed. The PCCP should state that any new risk found during an update will trigger appropriate CAPAs or communications. This reassures FDA that unresolved risks will not propagate unchecked.

• Labeling and Prominent Notice: To fully satisfy transparency, many recommend disclosing the existence of a PCCP in labeling or user manuals, especially if patients can be affected. For example, the device may note it can learn/improve over time with FDA oversight. FDA’s principles advise clear stakeholder awareness (^[37]). In practice, a statement in the “Instructions for Use” such as “This device includes an adaptive AI algorithm; updates will be performed under an FDA-approved change protocol” can suffice. If labeling changes (metrics or instructions) are themselves part of the PCCP, describe how they will be managed.

• Obtain FDA Authorization: During review, the FDA evaluator will examine the PCCP plan. If acceptable, the PCCP is effectively authorized as part of your clearance/approval. For PMAs, the approval letter may explicitly reference the PCCP (or it becomes part of the approval decision). For 510(k)s, an approval letter (or conditions) will note that changes within the PCCP’s bounds do not require a new 510(k) (^[14]) (^[18]). Keep documentation of this authorization in your regulatory file.

3. Post-market Execution

Once the device is on the market with an authorized PCCP, the manufacturer can begin implementing the planned updates. The following are best practices:

• Follow the Protocol Exactly: For each update, strictly adhere to the methods described in the PCCP. This includes using only the pre-specified datasets, retraining methods, and validation procedures. Deviating from the plan can breach the PCCP authorization. If a change unobvious in the original plan becomes necessary (e.g. new input data type), then FDA guidance indicates a new submission would be required. Always check that the change “remains within the bounds of the PCCP, including methods for verifying and validating the changes” as the guidance notes (^[35]).

• Verification and Validation: After implementing a modification, run all the pre-defined tests. For example, if your PCCP says you will use an external test set A after retraining, then do so and record the results. The output should meet the acceptance criteria defined in the plan. Maintain thorough records: this is evidence that the device “remains safe and effective” post-change (^[7]). If any test fails, the PCCP should have stipulated immediate actions (perhaps revert to the prior model version and report the issue).

• Continuous Monitoring: In addition to planned verification tests, the manufacturer should continuously monitor real-world performance. This may involve collecting usage data, soliciting user feedback, or running on anonymized clinical data. For example, track the algorithm’s predictions over time and watch for drift in key performance indicators. FDA’s TPLC principle for PCCPs implies that the manufacturer should not be passive post-market (^[16]). If performance degradations are detected, the plan should include triggers for corrective actions (which might include withdrawing the update, issuing education, or notifying FDA).

• Documentation and Reporting: A robust record of all changes is critical. Each update cycle, document: what was changed, how it was changed, and the results of testing. You should update the device history file to include all PCCP-driven changes. Certain jurisdictions may require periodic summary reports of changes (e.g. an updated software update summary to FDA as part of annual reporting). Even if not mandatory, keeping an ongoing “change log” is sound practice. FDA’s guidance stresses maintaining high regulatory standards through monitoring and maintenance (^[45]).

• Regulatory Interactions: Even though planned changes do not require new 510(k) or supplement filings, the sponsor still needs to update FDA on certain matters. For example, if a PCCP-driven update dramatically extends product lifecycle or changes a critical parameter, it may be prudent (or required) to notify FDA. Also, if you ever deviate from the authorized PCCP (e.g. due to an unexpected algorithm redesign), you would need to submit a new 510(k) or supplement and propose a new PCCP. Engaging with FDA through pre-submission meetings can clarify any borderline cases.

4. Example Use Case (Hypothetical)

To illustrate PCCP implementation, consider a hypothetical AI/ML SaMD: an FDA-cleared software that analyzes retinal scans for diabetic retinopathy screening (similar to IDx-DR). The initial device uses a convolutional neural network trained on historical patient images. Anticipating future improvements, the manufacturer prepares a PCCP covering:

• Data Expansion: Plan to incorporate new patient images from diverse geographies to improve sensitivity. The interventional steps: collect 5,000 new labeled images over time; retrain model nightly; revalidate on a held-out test set of 2,000 images; ensure pre-change and post-change sensitivity ≥85%.
• Algorithm Refinement: Plan to replace the neural net architecture with a new variant if it demonstrates higher AUC on the same dataset. The update protocol: confirm that new model’s performance ≥ old one by statistical testing, and include clinician confirmation.
• Threshold Adjustment: Plan to adjust the decision threshold if clinical preferences change (e.g. to reduce false negatives). The protocol: gradually shift threshold, test with retrospective data, and ensure specificity does not drop below 75%.

The PCCP document specifies these changes with the details above (data sources, metrics, rollback conditions). FDA reviews and authorizes this PCCP. Later, the company collects additional images and retrains the network as planned. They run the specified tests, document that sensitivity improved from 83% to 87%, and verify no adverse effects. This update is implemented in the field without filing a new 510(k). The FDA, knowing the update occurred through an approved plan, remains assured of maintained safety.

If instead the company decided to use a completely new machine learning approach (e.g. a Support Vector Machine rather than CNN) – a change not in the PCCP – they would then need to submit a new 510(k).

(Note: The above scenario is illustrative; actual PCCPs would need more granular technical content and would undergo thorough FDA review.)

Evidence and Data Considerations

PCCPs place a premium on data quality and evidence. Since changes can be implemented with reduced regulatory friction, it is incumbent on the manufacturer to prove they are safe. Important points:

• Training and Validation Data: Requirements for data are higher than in traditional static devices. The FDA has recommended that AI/ML devices use diverse and representative datasets to avoid bias (^[10]). The PCCP should describe the source and curation of new data. Each retraining step uses both original and new data (if applicable) to prevent catastrophic forgetting. A good practice is to maintain a reference dataset that stays constant for validation, so improvements are measured against a stable baseline.

• Real-World Performance Metrics: Beyond initial test sets, monitor key performance indicators (KPIs) in the field. For instance, if the device outputs risk scores, track the distribution of scores and actual outcomes over time. Conduct periodic clinical validation studies if possible. FDA’s GMLP and Total Product Lifecycle principles imply that safety/effectiveness must be assessed post-market as well (^[8]) (^[16]).

• Statistical Issues: Adaptive devices risk “over-fitting” to recent data or encountering population shifts. The PCCP should specify statistical controls (e.g. cross-validation, hold-out sets). FDA’s guidance suggests evaluating the impact of retraining on performance and new risks. It may even require applying alert thresholds to detect drift. Some experts anticipate the use of control charts and performance “lot release” tests for each software version.

• Transparency of Model Changes: While not explicitly mandated by FDA, documenting the nature of each change (in clinical terms) can build trust. For example, a change in which features are used by the model may be described. The idea is that not only internal validation but also external observers (auditors, clinicians) can verify that the device remains doing its intended task. This aligns with the FDA’s “Transparent” principle (^[37]).

Table – Regulatory Pathways and PCCP Effects

The table below contrasts the traditional submission requirements versus the PCCP-enabled approach for different regulatory pathways:

Table 3. Effect of PCCP on regulatory submissions by pathway. Without PCCP, significant changes trigger new applications. Under an approved PCCP, planned changes do not require repeat submissions (^[17]) (^[33]).

This table underscores a critical advantage of PCCPs: avoiding sequential submissions. By handling updates within the lifecycle, manufacturers can iterate faster. However, it also means that the burden of proof shifts to the PCCP: each planned change must be justified upfront.

Challenges and Current Adoption

While PCCPs promise flexibility, implementation is non-trivial. As one recent survey concludes, “the current regulatory approach is not fit for purpose, specifically regarding fast-moving SaMD or continuous-learning AI SaMD” (^[12]). Only a few manufacturers have fully adopted PCCPs so far. According to industry analyses, the vast majority of cleared AI/ML devices in 2024–2025 remain “locked” models, with no ability to learn post-launch (^[13]). In LinkedIn research, only ~8% of new AI devices included an authorized PCCP by 2025 (^[13]). Several factors contribute:

• Regulatory Readiness: Crafting a robust PCCP requires significant upfront effort and clear regulatory understanding. Only companies with strong regulatory affairs teams and stable internal processes have pursued them. The K&P survey notes PCCPs are used “selectively, deliberate, and concentrated among teams with real regulatory maturity” (^[13]). Startups or small firms may lack the bandwidth or confidence to navigate the PCCP process.

• Clinical and Usability Changes: Surveys indicate that within a PCCP, technical and usability modifications are readily accepted, but planned clinical changes (broadening patient population, new indications) are more controversial (^[12]). Indeed, FDA expects PCCPs to stay within the original intended use (^[40]). This limits PCCP applicability for some products. If a software developer wants to actively expand use cases, those expansions likely need new submissions. Thus, many companies view PCCPs as tools for iterative improvement (e.g. model tuning) rather than for strategic growth into new markets.

• Data and Performance Uncertainty: Some companies worry that PCCPs may not cover truly novel issues that arise. For example, an AI model might perform differently in a demographic subgroup not present in the original data. If this need for adaptation wasn’t envisaged, the PCCP might be insufficient. There is also concern about generating the necessary evidence: maintaining large test datasets and federated data pipelines involves cost.

• Postmarket Surveillance: Effective PCCPs hinge on real-world monitoring systems. Establishing feedback loops with clinical sites (to detect rare safety events or drift) is challenging but essential. Not all manufacturers have such infrastructure yet. Regulatory guidance expects continuous monitoring, but specifics are still emerging.

• Inter-jurisdictional Alignment: The differences between FDA and EU approaches create strategic uncertainty. A global company may wish to align their PCCP with anticipated EU rules, but EU regulators have not given clear guidance. This misalignment can deter fully implementing an FDA-style PCCP until international approaches converge.

Despite challenges, thought leaders see PCCPs as key for the future. In a recent white paper, Orthogonal/MedSec argue that PCCPs can be extended “Beyond AI/ML,” applying similar pre-authorized plans to any complex SaMD (e.g. rules-engine software) (^[48]). They describe PCCPs as a way to “make the significant insignificant” by shifting the focus from each change’s bureaucratic approval to systematic risk control (^[49]). If realized fully, this could unleash a more agile medical software ecosystem.

Implications and Future Directions

Innovation versus Oversight: PCCPs are intended to foster innovation by decoupling routine updates from protracted reviews. As FDA noted, this “supports iterative improvement… while continuing to provide a reasonable assurance of device safety and effectiveness” (^[7]). From a patient’s perspective, faster updates could mean earlier adoption of improvements (e.g. higher accuracy, updated clinical guidelines integration). However, regulators still need confidence that the net effect of changes is beneficial. Thus, PCCPs require manufacturers to maintain stringent evidence even post-market.

Regulatory Workload: By reducing supplemental submissions, PCCPs may actually lighten FDA’s review workload in the long term. Instead of assessing dozens of supplements for an evolving device, FDA reviewers invest time upfront in evaluating the PCCP. Then, post-market, FDA monitoring shifts toward auditing compliance (inspections, performance data) rather than rote application reviews. Nonetheless, FDA will likely track PCCP updates through postmarket reporting (7920 reports, MDR forms, etc.), so the Agency will gather rich performance data on these devices.

Patient Safety: The safety net for PCCPs is the ongoing monitoring commitments. FDA’s principles emphasize that deployed models must be monitored and retraining risks managed (^[8]). In practice, adaptive SaMD with a PCCP will blur lines between pre- and post-market evaluation. Some commentators suggest new FDA tools such as “Real-World Performance” dashboards or formal “change risk meetings.” The Medical Device Innovation Consortium (MDIC) notes that detailed PCCPs help ensure updates are “proactively communicated, validated, and maintain safety/effectiveness” (^[50]). If well-executed, PCCPs could arguably improve safety: any intended change is scrutinized in advance, rather than potentially rushed through emergency updates.

Market Access: For medical device companies, having an FDA-cleared PCCP may become a competitive advantage. It signals to clinicians and investors that the company can continuously improve its product. Liberty Mutual’s FDA blog highlighted an example of a company marketing its “FDA-cleared PCCP” as a selling point (^[51]). However, this also raises ethical questions: how will patients consent to an evolving algorithm? Should end-users be re-consented or re-trained on each update? Current regulations do not require new patient consent for software updates, but in the future one could imagine “change labels” requiring briefing.

Global Harmonization: With FDA moving forward, other regulators may follow. The UK has shown leadership via joint guidance (^[42]). Health Canada and Japan’s PMDA are also active in AI regulation discussions. In the EU, the lack of a PCCP analog means manufacturers may face more difficulty updating EU-approved Google. Some in industry are calling on the EU to introduce similar provisions (either via regulatory guidance or legislation), especially as the MDR/IVDR’s postmarket surveillance requirements become more burdensome for software changes. Indeed, some experts recommend that EU notified bodies view PCCPs from other jurisdictions favorably even in the absence of formal EU rules (^[11]).

Future Guidance: The FDA has indicated ongoing work. For example, an August 2024 draft covered PCCPs for all medical devices, hinting at expansion beyond AI (^[30]). We may also see more specific guidance (e.g. on performance metrics selection, or template PCCPs). Regulators will undoubtedly learn from early PCCP submissions: FDA reviewers may share anonymized case examples or FAQs. Similarly, standards organizations (ISO, IEEE) may publish consensus documents on managing AI/ML changes.

Conclusion

Predetermined Change Control Plans are a groundbreaking regulatory innovation, tailored for the dynamic nature of AI/ML SaMD. Through legislative action (Section 515C) and detailed guidance, the FDA has created a framework where approved devices can be pre-authorized to evolve via predefined update pathways. This bridges the gap between the static, one-time approval model and the reality of AI that learns.

The transition to PCCPs requires careful planning. Manufacturers must anticipate device evolution, establish rigorous evaluation protocols, and commit to continuous monitoring. A well-crafted PCCP, integrated into the quality system and supported by evidence, can expedite innovation: enabling rapid deployment of algorithm improvements without repetitive regulatory hurdles (^[7]) (^[14]). In exchange, the manufacturer shoulders the responsibility to robustly demonstrate safety and effectiveness throughout the product lifecycle (^[8]).

In the long term, PCCPs could significantly alter the medical device landscape. They may become the de facto standard for any advanced SaMD, encouraging regulatory strategies that emphasize life-cycle management rather than single static submissions. Cross-sector collaboration (among regulators, industry, and academia) will be essential to refine best practices. Key focus areas include harmonizing global expectations, developing benchmark datasets for performance testing, and ensuring transparency to end-users.

Finally, while PCCPs unlock flexibility, patient welfare remains paramount. Each PCCP-approved update must be justified by data and risk analysis. The evidence and oversight mechanisms we have detailed are designed precisely to uphold safety. If implemented conscientiously, PCCPs promise the best of both worlds: continual improvement of AI/ML medical devices and regulatory assurance.

---

References: Regulatory documents, peer-reviewed studies, and expert analyses were used throughout. Citation numbers ([8†L47–L54], etc.) correspond to sources as indicated above. All claims are supported by credible sources, including FDA guidances, legislation, and published research (^[3]) (^[1]) (^[39]) (^[17]) (^[6]) (see inline citations for details).