AI/ML SaMD Change Management: When to Use a PCCP vs. a Traditional Supplement

Post-Deployment Change Management for AI/ML SaMD: PCCP or Traditional Supplement?

If your company has deployed an artificial intelligence or machine learning-based Software as a Medical Device (AI/ML SaMD), you already know the product does not stand still after clearance. Models drift. Training data expands. Performance thresholds get refined. Clinical context evolves. The central regulatory question is not whether your software will change -- it is whether you have a lawful, defensible pathway to implement those changes without grinding your roadmap to a halt.

The FDA has provided two primary mechanisms: the Predetermined Change Control Plan (PCCP) and the traditional submission supplement (most commonly a Special 510(k) or a PMA Supplement). Choosing the wrong one costs time, money, and in some cases, market access. Here is how to think through the decision with precision.

The Regulatory Foundation You Need to Know

The authority for the PCCP framework flows from Section 515C of the Federal Food, Drug, and Cosmetic Act, as amended by the Consolidated Appropriations Act of 2023. FDA operationalized this through the final guidance document titled 'Marketing Submission Recommendations for a Predetermined Change Control Plan for Artificial Intelligence-Enabled Device Software Functions,' finalized in December 2024. This guidance replaced earlier draft versions and is now the governing document for sponsors seeking PCCP inclusion in a 510(k), De Novo, or PMA submission.

Separately, 21 CFR Part 807 governs 510(k) submissions and their supplements, while 21 CFR Part 814 governs PMA supplements. Traditional change pathways -- Special 510(k), Abbreviated 510(k), and PMA Supplements -- remain fully intact and are often the more appropriate route depending on the nature and scope of the change.

What a PCCP Actually Is -- and What It Is Not

A PCCP is not a blanket exemption from FDA oversight. It is a prospectively defined, FDA-reviewed and cleared plan that specifies: (1) the types of changes the manufacturer anticipates making, (2) the methodology for implementing those changes, and (3) the performance monitoring protocols that will govern ongoing validation.

Think of it as a pre-negotiated runway. FDA reviews and approves the scope of your anticipated modifications upfront as part of your marketing submission. Once cleared, you can implement changes within that scope without filing a new premarket submission -- provided you follow the protocols exactly as described and maintain your quality system documentation under 21 CFR Part 820 (or ISO 13485 if you are operating under the recognized standard).

A PCCP is most appropriate when your changes are:

• Iterative and data-driven, such as periodic retraining on expanded datasets
• Bounded by pre-specified performance criteria with measurable thresholds
• Limited to the AI/ML component and do not alter the device's intended use or indications for use
• Supported by a robust algorithmic impact assessment and change protocol methodology

When a Traditional Supplement Is the Right Answer

Do not default to PCCP simply because your product contains AI/ML. A traditional submission supplement is frequently the correct pathway -- and attempting to force a change into an existing PCCP when it does not fit can constitute a regulatory violation with serious consequences.

You should pursue a traditional supplement when:

• The change modifies the intended use or adds a new indication, triggering a new substantial equivalence analysis under 21 CFR 807.87
• The change falls outside the scope, methodology, or performance boundaries defined in your cleared PCCP
• Your cleared device does not have an approved PCCP, and the change is significant enough to require FDA review under 21 CFR 807.81(a)(3)
• Your product is PMA-approved and the change meets the threshold for a 180-day PMA Supplement under 21 CFR 814.39
• The modification introduces new cybersecurity risk surfaces that require independent FDA evaluation under the 2023 Cybersecurity guidance

A Special 510(k) is typically the fastest traditional route for AI/ML changes that do not alter intended use but fall outside PCCP scope -- assuming you have design controls and risk management documentation well-organized under ISO 14971.

The Gray Zone: SaMD That Learns Continuously

Continuously learning algorithms -- models that update their parameters in production using real-world data -- present the most complex change management scenario. Under current FDA guidance, locked algorithms are easier to govern through a PCCP because the change events are discrete and testable. Adaptive algorithms that retrain in the field require extraordinarily detailed PCCP methodology sections and robust post-market performance monitoring plans aligned with FDA's Digital Health Center of Excellence expectations. If you are operating an adaptive model and your PCCP does not explicitly address the retraining cadence, data governance controls, and rollback protocols, you are likely operating in a compliance gap right now.

Practical Decision Framework

Before your next product iteration, ask these four questions:

• Does our cleared marketing submission include an approved PCCP?
• Does the anticipated change fall within the scope, methodology, and performance parameters defined in that PCCP?
• Have we conducted and documented an algorithmic impact assessment demonstrating the change does not alter intended use?
• Are our SOP, design history file, and post-market surveillance processes updated to reflect the change protocol?

If the answer to any of the first two questions is no, you are in traditional supplement territory. Full stop.

The Compliance Cost of Getting This Wrong

Implementing an AI/ML change outside your cleared submission scope -- whether outside an approved PCCP or without filing an appropriate supplement -- is a violation of 21 CFR 807.81. It exposes your company to Form 483 observations, Warning Letters, and in egregious cases, injunction. More immediately, it creates product liability exposure and can complicate future fundraising due diligence when investors and acquirers review your regulatory history.

Work With Experts Who Know AI/ML SaMD Regulatory Strategy

At ADB Consulting and CRO Inc., Andre Butler and the team work directly with medical device startups and established manufacturers navigating the PCCP framework, Special 510(k) strategy, and post-market compliance for AI/ML SaMD. We help you make the right pathway decision the first time -- so your development timelines do not get derailed by avoidable regulatory missteps.

Book a free discovery call today at adbccro.com and get clarity on your AI/ML change management strategy before your next software iteration goes live.

For related guidance, see our Software as a Medical Device regulatory support.

The Post-Deployment Problem Nobody Warns You About

You have cleared or approved your AI/ML-based Software as a Medical Device (SaMD). Congratulations — now the real regulatory work begins. Unlike traditional medical devices that remain static after market entry, AI/ML SaMD is often designed to learn, adapt, and improve. That is precisely what makes it valuable. It is also precisely what makes it a regulatory minefield if your change management strategy is not locked in before your first model update.

The central question your regulatory team must answer is this: does the change you are planning require a new FDA submission — or can it be executed under a Predetermined Change Control Plan (PCCP)? Getting this wrong costs you time, money, and in some cases, your clearance.

The Regulatory Foundation: Why AI/ML SaMD Is Different

FDA's foundational thinking on this issue is laid out in the January 2021 action plan titled 'Artificial Intelligence/Machine Learning (AI/ML)-Based Software as a Medical Device (SaMD) Action Plan' and further operationalized in the April 2023 guidance document 'Marketing Submission Recommendations for a Predetermined Change Control Plan for Artificial Intelligence/Machine Learning-Enabled Device Software Functions.' These documents reflect FDA's acknowledgment that the traditional static device paradigm does not fit adaptive algorithms.

Under 21 CFR Part 807 (for 510(k) devices) and 21 CFR Part 814 (for PMA devices), any change that could affect safety or effectiveness triggers a submission obligation. For conventional hardware or static software, this framework works reasonably well. For an AI/ML model that may retrain on new real-world data quarterly, it creates a submission bottleneck that can make your product commercially unviable — unless you plan ahead.

What Is a PCCP — and What It Is Not

A Predetermined Change Control Plan is a prospective agreement with FDA, embedded within your initial marketing submission, that defines the types of changes you anticipate making to your AI/ML device function and the specific controls and performance standards you will use to manage those changes without requiring a new submission each time.

A PCCP has three required components according to FDA's 2023 guidance:

• Description of Modifications: A clear, specific articulation of the anticipated changes — algorithm retraining, architectural updates, new input data types, expanded indications, etc.
• Modification Protocol: The methodology, validation procedures, and performance benchmarks that govern each defined change — think locked test datasets, pre-specified performance thresholds, and statistical acceptance criteria.
• Impact Assessment: A documented analysis of how the proposed changes could affect device safety, effectiveness, and the benefit-risk profile across your intended use population.

What a PCCP is not: a blank check. FDA is explicit that a PCCP does not authorize unlimited model updates. If a change falls outside the boundaries you defined at submission, you are back to a traditional supplement pathway — full stop.

When a Traditional Supplement Still Applies

Even with a well-crafted PCCP in place, certain changes will always require a return to FDA. You must file a traditional 510(k) supplement or PMA supplement when:

• The intended use or indications for use are materially expanding beyond what the original submission covered
• The algorithm architecture changes in a way not contemplated or described in your PCCP
• Performance on a new patient population or clinical setting was not included in your original impact assessment
• A change to input data type (e.g., adding a new imaging modality or sensor signal) was not prospectively defined
• Post-market performance data reveals safety signals that invalidate your original benefit-risk conclusions

For PMA devices, the bar is particularly high. Under 21 CFR 814.39, PMA supplements are required for changes that affect safety or effectiveness, and FDA has not indicated that a PCCP eliminates this obligation for out-of-scope modifications. Sponsors of high-risk AI/ML devices should be especially conservative in how they scope PCCP boundaries.

Practical Strategy: How to Build a PCCP That Actually Works

The most common mistake startups make is treating the PCCP as an afterthought — something drafted in the final weeks before submission without input from the data science or clinical teams. A PCCP that does not reflect your actual product roadmap will either be rejected by FDA during review or will be too narrow to provide meaningful regulatory relief post-clearance.

A defensible PCCP strategy requires four things:

• Roadmap alignment: Your regulatory counsel must sit in the room with product and engineering leadership to understand what changes are realistically planned over a 24-to-36-month horizon
• Specificity over breadth: FDA responds better to narrowly defined, well-controlled change descriptions than to broad, ambiguous language that appears to be seeking open-ended flexibility
• Statistical rigor in the Modification Protocol: Pre-specified performance thresholds tied to clinically meaningful endpoints — not just internal benchmarks — carry significantly more weight during review
• Change control infrastructure: Your quality management system under 21 CFR Part 820 must have documented procedures that operationalize the PCCP commitments you made to FDA, including record-keeping, version control, and internal review gates

The Bottom Line for Founders and Regulatory Leaders

The PCCP framework represents one of the most significant regulatory innovations FDA has introduced for SaMD — but it is not a shortcut. It is a commitment. Devices that earn PCCP-enabled flexibility do so because their sponsors did the hard work upfront: rigorous impact assessment, defensible validation protocols, and honest scoping of anticipated changes.

If your AI/ML SaMD is heading toward a 510(k) or De Novo submission in the next six to eighteen months, the time to build your PCCP strategy is now — not after you have already locked your submission package.

Work With a Regulatory Partner Who Understands AI/ML SaMD

At ADB Consulting and CRO Inc., Andre Butler and the team work directly with medical device startups and growth-stage companies navigating the full arc of AI/ML SaMD regulatory strategy — from pre-submission planning through PCCP development, FDA Q-Sub meetings, and post-market change management. We understand both the regulatory framework and the commercial realities your team is operating under.

If you are unsure whether your planned algorithm updates require a new submission or can be managed under a PCCP, do not guess. Book a free discovery call with our team at adbccro.com and get a clear, expert-informed answer within a single conversation.

If this applies to your program, our AI/ML SaMD regulatory strategy guide walks through the process in detail.