Medical device software no longer stays the same after launch. AI models improve, new clinical data becomes available, and performance can change over time. For manufacturers, the real challenge is not just building an effective AI-enabled device, but deciding how future updates will fit into FDA regulatory compliance without creating unnecessary regulatory hurdles.
One detail is worth clearing up from the beginning. An FDA PCCP (Predetermined Change Control Plan) is not something every AI medical device needs. It is an optional approach that manufacturers can use in specific situations. FDA published the final guidance on December 3, 2024, and the current guidance document is dated August 18, 2025, so older draft guidance should not be treated as the current framework.
If you are preparing an AI device submission, understanding when a PCCP makes sense is only the starting point. The bigger question is what the FDA expects you to document so future changes remain predictable, justified, and easier to manage. That is exactly what this guide covers.
Authorized under Section 3308 of the Food and Drug Omnibus Reform Act (FDORA) / Section 515C of the FD&C Act, an FDA PCCP establishes explicit prospective boundaries for post-market software changes.
Key Takeaways
- PCCPs work best for changes you can reasonably foresee before submission. Trying to leave the scope too open defeats the purpose.
- FDA wants clear boundaries around what can change, how far it can change, and what evidence will be used before release.
- Retraining is not just a model update. The data, triggers, testing process, and acceptance rules all need to be planned in advance.
- A passing model is not enough on its own. FDA also looks at how the change affects the rest of the device and its use in the clinical setting.
- Once a change moves outside the authorized PCCP, the regulatory advantage can disappear, and a new submission can become necessary.
What Is an FDA PCCP (Predetermined Change Control Plan)?
An FDA PCCP (Predetermined Change Control Plan) is a document submitted as part of a medical device marketing application, including an FDA 510(k) submission. It describes specific future modifications a manufacturer plans to make and the procedures that will be used to develop, validate, implement, and evaluate those changes. FDA reviews and authorizes the PCCP as part of the marketing submission process.
Its main advantage is regulatory efficiency. If a future modification falls within the FDA-authorized PCCP and follows the approved procedures, it can be implemented without another premarket submission. This does not give manufacturers unlimited freedom to modify an AI model. Changes outside the authorized scope still require FDA evaluation.
A manufacturer also cannot prepare an internal document, call it a PCCP, and use it to bypass future submissions. The plan has regulatory value only after FDA review and establishment of the appropriate marketing authorization.
Although PCCPs have received significant attention, they are not yet common in practice. A May 2026 JAMA Health Forum study found that only 43 of 794 AI-enabled medical devices (5.4%) authorized between 2023 and 2025 included an FDA-authorized PCCP. Most were cleared through the 510(k) pathway, and adoption increased to 9.7% of AI-enabled device authorizations by the fourth quarter of 2025.
Which AI/ML Medical Devices and FDA Submissions Can Use a PCCP?
The current FDA PCCP guidance applies broadly to AI-enabled device software functions that manufacturers expect to modify over time. It is not limited to a specific type of machine learning model. FDA considers manually implemented updates, automatically implemented modifications, and systems that combine both approaches.
A common misconception is that PCCPs only apply to permanently locked algorithms. FDA also allows planned automatic or adaptive modifications, provided the manufacturer clearly defines the permitted changes, supporting validation methods, and the evidence that will continue to demonstrate safety and effectiveness.
A PCCP can be established through an eligible marketing submission, including:
- Traditional 510(k)
- Abbreviated 510(k)
- Original De Novo request
- Original PMA
- Modular PMA
- Qualifying 180-Day, Panel Track, and Real-Time PMA supplements
A Special 510(k) is different. FDA does not identify it as a pathway for initially establishing a PCCP. It can be appropriate later to modify an already authorized PCCP if the Special 510(k) eligibility criteria are met and the modification consists solely of administrative or well-defined minor procedural updates.
If your PCCP involves complex modification boundaries, automatic adaptation, changes to intended use, site-specific adaptation, or nonstandard validation methods, FDA recommends using the Q Submission Program to obtain feedback before filing your marketing submission.
A Q Submission can help refine the proposal, but it cannot authorize a PCCP. Authorization only occurs through the appropriate marketing submission.
The Three Core FDA PCCP Requirements
The Predetermined Change Control Plan FDA guidance organizes every PCCP into three connected elements:
1. Description of Modifications
The Predetermined Change Control Plan: FDA expects this section to define the future modifications you want FDA to authorize. FDA recommends including only a limited number of modifications and describing each one with enough detail to support verification and validation.
For each planned modification, identify:
- The AI or software component that will change.
- The purpose of the modification.
- The performance or device characteristic that could change.
- What can change and what must remain unchanged.
- Whether implementation is manual or automatic.
- Whether deployment is global or site-specific.
- The permitted modification boundaries.
- Any triggering conditions or expected update frequency.
- Potential labeling impacts.
- The related Modification Protocol.
FDA indicates that suitable modifications can include retraining with representative data, predefined performance adjustments, additional compatible input sources, limited compatibility updates for hardware, software, operating systems, or cloud infrastructure, and certain changes for defined patient subpopulations. Whether a modification is suitable depends on the device, its intended use, and its risk profile.
2. Modification Protocol
The Modification Protocol explains how each planned modification will be developed, validated, implemented, and monitored. It should provide enough detail for FDA to understand how future updates will be carried out consistently and how the device will continue to meet safety and performance expectations.
Data Management
Your data management process should explain how data will be handled throughout its lifecycle. This typically includes:
- Collecting, reviewing, annotating, storing, and retaining new datasets.
- Keeping training, tuning, and testing datasets separate so model performance can be evaluated independently.
- Recording where the data comes from and confirming that it represents the intended patient population.
- Including clinically relevant characteristics, such as age, sex, race, ethnicity, disease severity, and other device-specific factors when evaluating model performance.
- Describing how reference labels are created, how reviewer disagreements are resolved, and how missing data is managed.
- Periodically reviewing datasets to confirm they remain suitable as clinical practice, patient populations, or standards of care change.
Model Retraining
If your PCCP includes model retraining, explain the objective of retraining and identify which model components are allowed to change. Depending on the planned modification, this can include model weights, preprocessing methods, tuning parameters, architecture, hyperparameters, or other predefined components.
The protocol should also describe how training and evaluation datasets will remain separate during retraining. Define the conditions that trigger retraining, such as collecting a predefined volume of qualified data or identifying data drift.
Clearly distinguish between:
- A monitoring threshold that prompts further investigation.
- A retraining trigger that starts model redevelopment.
- An acceptance criterion that determines whether the updated model is suitable for release.
For systems that retrain automatically, include controls that define the allowable range of model changes and the review process before deployment.
Performance Evaluation and Acceptance Criteria
The performance evaluation plan should show that the modified AI function in the AI SaMD meets its intended specifications, that unaffected functions continue to perform as expected, and that the complete device remains safe and effective.
If the AI influences other software or hardware functions, testing should evaluate the overall device rather than only the model.
Define the evaluation approach before any modification is implemented. It should include:
- When testing will be performed.
- The test population and independent test dataset.
- The study design and endpoints.
- Performance metrics and statistical methods.
- Hypotheses, where applicable.
- Planned subgroup analyses.
- Device-specific acceptance criteria.
FDA also recommends comparing the updated model with both the original device and the most recently released version. This helps confirm that performance remains consistent as multiple PCCP modifications accumulate over time.
Deployment, User Communication, and Monitoring
After a model meets the predefined acceptance criteria, define how it will be released into production. Specify whether deployment is manual or automatic, and whether updates are distributed across all users or introduced site by site. The protocol should also identify the version and configuration controls used to track every deployed release.
Any change that affects device use should be communicated to users. Depending on the modification, this can include updated labeling, revised instructions, additional training, changes in expected performance, new limitations, or the current software version.
Postmarket activities should not end with adverse event reporting. Continue monitoring real-world performance for safety, effectiveness, model drift, subgroup performance, environment-specific behaviour, and newly identified risks. This helps confirm that the modified device continues to perform as intended after deployment.
3. Impact Assessment
The Impact Assessment explains why the planned modifications can be implemented without reducing the device’s safety or effectiveness. It should evaluate:
- How each modification compares with the original device.
- The expected benefits and risks.
- Whether the proposed verification and validation activities are sufficient.
- How one planned modification could affect another.
- The overall impact after multiple modifications are implemented.
The assessment should consider the complete device, not only the AI model. Review the effect of each modification on connected software, hardware behavior, clinical workflow, user interaction, and other affected components.
Risk analysis should be specific to the proposed modifications. For example, explain how validation and other controls address risks such as dataset shift, subgroup underperformance, unintended bias, overfitting, unstable retraining, reference standard errors, input incompatibility, or interactions between successive modifications. Avoid listing risks without showing how they are mitigated.
How to Prepare and Trace a PCCP in the FDA Submission
FDA recommends including the PCCP as a separate section in the marketing submission. Assign it a clear title and document controls so reviewers can easily identify the correct plan.
Include:
- Document title.
- Version number.
- Applicable device or AI model.
- Baseline software version.
- Modification history.
The PCCP should also be referenced consistently throughout the submission. FDA recommends:
- Mentioning it in the cover letter.
- Listing it in the table of contents.
- Cross-referencing it from the device description.
- Linking it to relevant labeling and supporting evidence.
FDA recommends documenting traceability in a structured format so reviewers can quickly connect each planned modification with its supporting evidence. A traceability matrix is an effective way to organize this information and avoid inconsistencies across the submission.
| Modification ID | Planned Change | Risk | Dataset | Retraining Trigger | Validation Method | Acceptance Criteria | Deployment | Labeling | Monitoring |
| MOD 001 | Example change | Associated risk | Dataset used | Trigger | Validation activity | Release criteria | Manual or automatic | Labeling update | Monitoring plan |
What Happens After FDA Authorizes the PCCP?
1. When a Modification Passes Validation
Completing validation does not end the regulatory process. The modification must still be implemented according to the FDA-authorized Modification Protocol, including the approved deployment process and any defined operational controls.
Before the updated model is released, manufacturers should complete any required version control, labeling updates, user communication, deployment activities, and postmarket monitoring described in the PCCP.
2. When a Modification Fails Acceptance Criteria
If a planned modification does not meet the predefined acceptance criteria, it should not be implemented. The failure should be documented, investigated, and corrected where possible. Repeat testing only when there is a scientifically justified reason to do so.
For manufacturers using an FDA PCCP for AI/ML Medical Devices, prospective authorization does not allow a model that fails validation to be released. If the modification cannot meet the approved acceptance criteria or falls outside the authorized PCCP, it should be evaluated under FDA’s standard device modification requirements before implementation.
3. When the Change Falls Outside the PCCP
Not every future change can be implemented under an authorized PCCP. If a modification goes beyond the approved Description of Modifications, or if it is carried out differently from the authorized Modification Protocol, it is no longer covered by the plan.
At that point, the modification should be assessed under FDA’s standard device modification framework. Because PCCPs are intended to cover changes that might otherwise require premarket review, a new marketing submission will likely be needed in many of these situations.
How Qualysec Can Support Cybersecurity Validation for AI-Enabled Medical Devices
A PCCP often covers planned software updates, API changes, cloud migrations, operating environment changes, or connected device integrations. While these modifications are evaluated for safety and performance, they can also introduce new cybersecurity exposure that deserves independent validation.
FDA’s Premarket Cybersecurity Guidance requires that software update paths, cloud APIs, and over-the-air (OTA) deployments do not introduce new security vulnerabilities or compromise device functionality.
Under an authorized Modification Protocol, any infrastructure or communication interface modification must maintain robust threat modeling, secure patch mechanisms, and rigorous vulnerability assessments.
This is where Qualysec fits into the process. We perform penetration testing across web applications, APIs, mobile applications, cloud environments, external networks, and IoT systems to identify security weaknesses before changes are released. Our assessments combine manual expertise with automated testing and include validated findings, severity ratings, reproduction steps, remediation guidance, and retesting support.
If your Predetermined change Control plans for medical devices include software or infrastructure changes that require independent cybersecurity validation, Qualysec can help you build stronger technical evidence for your FDA submission.
Conclusion
A PCCP is most effective when it is planned early, not added just before submission. The future modifications, supporting evidence, and control methods all need to be defined before the device reaches FDA review, making the planning process as important as the modification itself.
As AI-enabled medical devices continue to evolve, manufacturers that invest in well-scoped change plans, clear validation strategies, and disciplined lifecycle management will be better prepared to implement future updates while remaining within FDA-authorized boundaries.
FAQs
1. Does every AI modification under a PCCP need a new 510(k)?
No. If a modification is included in the FDA-authorized PCCP, stays within the approved boundaries, and follows the authorized Modification Protocol, it can generally be implemented without another 510(k). Changes outside the authorized scope should be evaluated under FDA’s normal device modification requirements.
2. Can a PCCP change the intended use of a medical device?
Generally, no. Changes to intended use or indications for use usually require additional FDA review because they can significantly affect the device’s safety and effectiveness. FDA also encourages early discussion through the Q Submission Program when these changes are being considered.
3. What happens if an AI model fails PCCP acceptance criteria?
A failed modification should be documented and investigated before any further action is taken. It should not be deployed unless the issue is resolved and the predefined acceptance criteria are met. If it cannot meet those requirements, the modification should be evaluated outside the PCCP.
4. Can manufacturers modify an FDA-authorized PCCP later?
Yes, but the authorized PCCP cannot be changed informally. Manufacturers must submit the modified PCCP through an appropriate FDA marketing submission, and FDA will review the proposed changes before they become authorized.
5. Should manufacturers use an FDA Q Submission for a PCCP?
A Q Submission is useful when manufacturers need FDA feedback on complex modifications, automatic adaptation, or other challenging PCCP proposals before filing a marketing submission. However, a Q Submission provides feedback only and does not authorize the PCCP.
