FDA PCCP Guide for AI/ML Medical Devices

AI Devices Need a New Regulatory Model

Artificial intelligence in medical devices does not behave like traditional software. An AI model that diagnoses retinal disease, detects lung nodules, or predicts sepsis onset is designed to evolve — retrained on new data, refined with improved algorithms, adapted for new patient populations. Under the conventional regulatory framework, each meaningful algorithm change would require a new 510(k), PMA supplement, or De Novo submission. That cycle can take months, during which patients may receive care from an outdated model.

The FDA's Predetermined Change Control Plan (PCCP) framework, finalized in August 2025, addresses this tension. A PCCP allows manufacturers to pre-authorize specified future modifications to AI-enabled device software functions within the original marketing submission. If FDA authorizes the PCCP, the manufacturer can implement the described changes without filing a new application — provided the implementation follows the authorized plan exactly.

This guide covers the legal basis, structure, submission strategy, real-world data, and implementation roadmap for PCCPs under the final guidance.

Legal Foundation: Section 515C of the FD&C Act

The PCCP mechanism was established by Congress through Section 515C of the Federal Food, Drug, and Cosmetic Act (FD&C Act), enacted as part of the Food and Drug Omnibus Reform Act (FDORA) in December 2022. This provision explicitly authorizes FDA to review and authorize predetermined change control plans as part of marketing submissions.

Section 515C establishes that:

• FDA may approve a PCCP submitted with a PMA application

• FDA may clear a PCCP submitted with a 510(k)

• FDA may grant a PCCP submitted with a De Novo petition

• Once authorized, modifications implemented in accordance with the PCCP do not require new marketing submissions

• Changes outside the PCCP scope continue to require new submissions

• The device labeling must inform users of the PCCP and any changes implemented under it

Scope of the Final Guidance

The August 2025 final guidance, titled "Marketing Submission Recommendations for a Predetermined Change Control Plan for Artificial Intelligence-Enabled Device Software Functions," applies to AI-enabled device software functions (AI-DSFs) across all three marketing pathways.

FDA's Key Definitions

What Types of Modifications Can a PCCP Cover?

A modification must meet two conditions to be appropriate for inclusion in a PCCP:

1. It is within the device's intended use and maintains the indications for use (with limited exceptions)

2. It would otherwise require a new marketing submission

Examples of modifications that may be appropriate for PCCPs:

The Three Mandatory Components of a PCCP

Every PCCP must contain three components. FDA evaluates all three during the marketing submission review.

Component 1: Description of Modifications

This section describes what will change. It must specify:

• The modifications to be made — described with enough specificity that FDA can evaluate their scope and impact

• The boundaries of each modification — what is included and what is not

• Whether modifications are global or local — will changes apply to all deployed devices or specific sites?

• Whether updates are automatic or manual — will the AI model update autonomously or require human initiation?

• The trigger conditions — what data, events, or performance thresholds will initiate a modification?

• The frequency of potential modifications — how often might changes be implemented?

The description must be detailed enough that FDA can assess whether the modifications remain within the authorized scope. Vague or open-ended descriptions will not be authorized.

Component 2: Modification Protocol

This section describes how modifications will be implemented. It must include:

• Data requirements — what data will be used for retraining, validation, and testing? What are the data quality criteria?

• Training methodology — what algorithms, hyperparameters, and training procedures will be used?

• Validation and testing procedures — how will modified models be validated? What are the acceptance criteria?

• Performance metrics — what quantitative measures will demonstrate the modification maintains safety and effectiveness?

• Bias assessment methodology — how will the manufacturer evaluate and mitigate algorithmic bias?

• Labeling update procedures — how will device labeling be updated to reflect modifications?

• Cybersecurity considerations — how will security be maintained through the modification process?

• Deployment procedures — how will the modification be rolled out to deployed devices?

• Rollback procedures — if a modification fails, how will the device revert to the prior version?

Component 3: Impact Assessment

This section evaluates what the modifications will affect. It must address:

• Safety and effectiveness impact — how will each modification affect device safety and effectiveness?

• Clinical performance — how will clinical performance be maintained or improved?

• Patient population impact — will the modification affect performance across different demographic groups?

• Benefit-risk profile — does the modification maintain an acceptable benefit-risk balance?

• Interoperability impact — will the modification affect device interaction with other systems?

• Cybersecurity impact — will the modification introduce new cybersecurity risks?

Submission Strategy by Pathway

510(k) with PCCP

A PCCP submitted with a 510(k) is reviewed as part of the substantial equivalence determination. FDA evaluates whether the device (with the PCCP) is substantially equivalent to the predicate. The authorized PCCP becomes part of the device description.

Predicate strategy consideration: Under Section 515C, only the pre-PCCP version of a device can serve as a predicate for a new 510(k). If Device A has versions V1 (pre-PCCP) and V2 (modified under PCCP), only V1 is valid as a predicate. A competitor cannot use V2 as a predicate device. This has significant implications for competitive positioning.

De Novo with PCCP

A PCCP submitted with a De Novo petition is reviewed during the classification evaluation. FDA expects that if it authorizes an AI-DSF with a PCCP via De Novo, it would develop appropriate special controls that may include specific PCCP requirements.

PMA with PCCP

A PCCP submitted with a PMA is reviewed during the approval evaluation. Under Section 515C, FDA must deny PCCP approval if the manufacturing facilities and controls do not conform to QMSR requirements.

Real-World PCCP Data: What Has Been Authorized

A study published on medRxiv in August 2025 analyzed all AI/ML-enabled medical devices with authorized PCCPs through May 30, 2025:

All 26 authorized PCCP devices received Class II designations, indicating that the framework has been applied primarily to moderate-risk AI devices. No PMA-class devices have yet received PCCP authorization, though the framework is legally available for Class III devices.

FDA's AI/ML Device Landscape (Broader Context)

The FDA maintains a public list of AI/ML-enabled medical devices. As of December 2025:

• 1,451 total AI/ML devices have been authorized since 1995

• 350 devices authorized in 2025 alone — a 48% increase from 2024's 236

• Radiology dominates with approximately 76% of all AI device authorizations

• GE HealthCare leads with 120 cumulative AI device authorizations, followed by Siemens Healthineers (89), Philips (50), and Canon (45)

How to Develop a PCCP: Step-by-Step Implementation

Step 1: Identify Foreseeable Modifications

Before writing the PCCP, conduct a thorough analysis of the modifications you anticipate making to the AI-DSF over its lifecycle:

• What clinical data will become available that could improve model performance?

• What new imaging systems or data sources might need to be supported?

• What patient subpopulations may benefit from model refinement?

• What cybersecurity updates will be required?

• What bias-related adjustments might be needed?

Prioritize modifications that are sufficiently predictable to be described in advance but significant enough to otherwise require a new submission.

Step 2: Define Modification Boundaries

For each modification, establish clear boundaries:

• What is included in the modification scope

• What is explicitly excluded

• The minimum and maximum extent of the change

• The conditions under which the modification will be triggered

• The conditions under which the modification would be aborted

Step 3: Develop Validation Protocols

Create detailed protocols for validating each modification:

• Define the datasets to be used for validation (including minimum sample sizes)

• Specify statistical methods and acceptance criteria

• Include subgroup analyses for demographic groups relevant to the device

• Establish performance thresholds that must be met before deployment

• Define how clinical validation will be maintained or improved

Step 4: Conduct Impact Assessments

For each modification, assess the impact on:

• Device safety and effectiveness

• Clinical performance across patient populations

• Benefit-risk profile

• Cybersecurity posture

• Interoperability with connected systems

• User interface and workflow

Step 5: Prepare the PCCP Submission Package

Compile the three components into a structured submission. Consider using the Q-Submission program to seek early FDA feedback on the PCCP scope and methodology before the formal marketing submission.

Step 6: Build QMS Support for PCCP Implementation

Ensure your quality management system can support PCCP implementation:

• Design controls that accommodate iterative AI updates

• Change control procedures that distinguish PCCP-compliant changes from changes requiring new submissions

• Post-market surveillance procedures aligned with ISO 13485 and the QMSR (effective February 2, 2026)

• Bias monitoring and reporting processes

• Record retention for all PCCP modifications and associated validation data

Step 7: Plan Labeling and Transparency

The final guidance requires that device labeling:

• Informs users of the presence of a PCCP

• Describes the types of modifications that may be implemented

• Explains how users will be notified of modifications

• Discloses whether modifications are implemented automatically or manually

Common Pitfalls and How to Avoid Them

Comparison: PCCP vs. Traditional Change Control

International Considerations

The PCCP concept is not unique to the FDA. The International Medical Device Regulators Forum (IMDRF) has published guiding principles on PCCPs for machine learning-enabled medical devices, and several jurisdictions are developing their own frameworks:

For manufacturers marketing AI devices globally, developing PCCPs that can accommodate multiple jurisdictional requirements — including data residency, clinical evidence standards, and post-market monitoring expectations — is increasingly important.

FAQ

What is the difference between the AI-specific PCCP guidance and the general device PCCP draft guidance?

The August 2025 final guidance applies specifically to AI-enabled device software functions. A separate draft guidance covering PCCPs for all medical devices (not limited to AI) was released for comment in September 2024. The AI-specific guidance is finalized; the general guidance remains in draft form as of April 2026.

Can a PCCP cover hardware changes to an AI device?

The final guidance focuses on AI-enabled device software functions. Hardware modifications are not within the scope of the AI-specific PCCP guidance. However, the general PCCP draft guidance (once finalized) may address broader device modifications.

What happens if we need to make a change that is not in our authorized PCCP?

You must submit a new marketing application (510(k), PMA supplement, or De Novo) for any change that is not described in the authorized PCCP. You cannot expand the PCCP scope after authorization without a new submission that includes the expanded PCCP.

Can a PCCP be modified after FDA authorization?

Yes, but only through a new marketing submission that includes the modified PCCP. The original PCCP cannot be unilaterally expanded or altered by the manufacturer.

Does ISO 13485 certification guarantee PCCP approval?

No. While a robust QMS aligned with ISO 13485 (now incorporated into QMSR) is necessary to support PCCP implementation, PCCP authorization depends on the quality of the modification description, protocol, and impact assessment — not just the quality system.

Are there PCCPs for continuously learning AI systems (autonomous adaptation)?

The guidance addresses both human-supervised and automatically updated AI models. For continuous learning systems, the PCCP must describe the automated update mechanism, the safeguards that prevent unsafe modifications, and the monitoring that ensures ongoing safety and effectiveness.

How does the PCCP interact with the QMSR (effective February 2, 2026)?

PCCP implementation must occur within a quality management system that complies with QMSR requirements, which incorporate ISO 13485:2016. Post-market surveillance (PMS) under ISO 13485 is particularly relevant — manufacturers must gather performance data, evaluate trends, and integrate findings into product development and risk management. The final guidance explicitly references PMS requirements in the context of PCCP monitoring.

What is the benefit of using the Q-Submission program before filing a PCCP?

The Q-Submission program allows manufacturers to obtain FDA feedback on the planned PCCP scope, validation methodology, and data requirements before committing to a full marketing submission. This early engagement can identify issues that would delay authorization and help refine the PCCP components. FDA specifically recommends Q-Submission engagement for higher-risk devices, automatic/local adaptations, and novel AI approaches.

Key Takeaways

The FDA's PCCP framework, finalized in August 2025 and grounded in Section 515C of the FD&C Act, enables manufacturers to pre-authorize future AI algorithm modifications within the original marketing submission. The framework requires three components: a detailed description of modifications, a rigorous modification protocol, and a comprehensive impact assessment. Twenty-six devices had authorized PCCPs as of May 2025, all through the 510(k) and De Novo pathways. Manufacturers should identify foreseeable AI modifications early, develop robust validation protocols, engage FDA through the Q-Submission program, and ensure their QMS supports iterative PCCP implementation.