AI/ML SaMD Change Management: When to Use a PCCP vs. a Traditional Supplement

Post-Deployment Change Management for AI/ML SaMD: PCCP or Traditional Supplement?

If your company has deployed an artificial intelligence or machine learning-based Software as a Medical Device (AI/ML SaMD), you already know the product does not stand still after clearance. Models drift. Training data expands. Performance thresholds get refined. Clinical context evolves. The central regulatory question is not whether your software will change -- it is whether you have a lawful, defensible pathway to implement those changes without grinding your roadmap to a halt.

The FDA has provided two primary mechanisms: the Predetermined Change Control Plan (PCCP) and the traditional submission supplement (most commonly a Special 510(k) or a PMA Supplement). Choosing the wrong one costs time, money, and in some cases, market access. Here is how to think through the decision with precision.

The Regulatory Foundation You Need to Know

The authority for the PCCP framework flows from Section 515C of the Federal Food, Drug, and Cosmetic Act, as amended by the Consolidated Appropriations Act of 2023. FDA operationalized this through the final guidance document titled 'Marketing Submission Recommendations for a Predetermined Change Control Plan for Artificial Intelligence-Enabled Device Software Functions,' finalized in December 2024. This guidance replaced earlier draft versions and is now the governing document for sponsors seeking PCCP inclusion in a 510(k), De Novo, or PMA submission.

Separately, 21 CFR Part 807 governs 510(k) submissions and their supplements, while 21 CFR Part 814 governs PMA supplements. Traditional change pathways -- Special 510(k), Abbreviated 510(k), and PMA Supplements -- remain fully intact and are often the more appropriate route depending on the nature and scope of the change.

What a PCCP Actually Is -- and What It Is Not

A PCCP is not a blanket exemption from FDA oversight. It is a prospectively defined, FDA-reviewed and cleared plan that specifies: (1) the types of changes the manufacturer anticipates making, (2) the methodology for implementing those changes, and (3) the performance monitoring protocols that will govern ongoing validation.

Think of it as a pre-negotiated runway. FDA reviews and approves the scope of your anticipated modifications upfront as part of your marketing submission. Once cleared, you can implement changes within that scope without filing a new premarket submission -- provided you follow the protocols exactly as described and maintain your quality system documentation under 21 CFR Part 820 (or ISO 13485 if you are operating under the recognized standard).

A PCCP is most appropriate when your changes are:

• Iterative and data-driven, such as periodic retraining on expanded datasets
• Bounded by pre-specified performance criteria with measurable thresholds
• Limited to the AI/ML component and do not alter the device's intended use or indications for use
• Supported by a robust algorithmic impact assessment and change protocol methodology

When a Traditional Supplement Is the Right Answer

Do not default to PCCP simply because your product contains AI/ML. A traditional submission supplement is frequently the correct pathway -- and attempting to force a change into an existing PCCP when it does not fit can constitute a regulatory violation with serious consequences.

You should pursue a traditional supplement when:

• The change modifies the intended use or adds a new indication, triggering a new substantial equivalence analysis under 21 CFR 807.87
• The change falls outside the scope, methodology, or performance boundaries defined in your cleared PCCP
• Your cleared device does not have an approved PCCP, and the change is significant enough to require FDA review under 21 CFR 807.81(a)(3)
• Your product is PMA-approved and the change meets the threshold for a 180-day PMA Supplement under 21 CFR 814.39
• The modification introduces new cybersecurity risk surfaces that require independent FDA evaluation under the 2023 Cybersecurity guidance

A Special 510(k) is typically the fastest traditional route for AI/ML changes that do not alter intended use but fall outside PCCP scope -- assuming you have design controls and risk management documentation well-organized under ISO 14971.

The Gray Zone: SaMD That Learns Continuously

Continuously learning algorithms -- models that update their parameters in production using real-world data -- present the most complex change management scenario. Under current FDA guidance, locked algorithms are easier to govern through a PCCP because the change events are discrete and testable. Adaptive algorithms that retrain in the field require extraordinarily detailed PCCP methodology sections and robust post-market performance monitoring plans aligned with FDA's Digital Health Center of Excellence expectations. If you are operating an adaptive model and your PCCP does not explicitly address the retraining cadence, data governance controls, and rollback protocols, you are likely operating in a compliance gap right now.

Practical Decision Framework

Before your next product iteration, ask these four questions:

• Does our cleared marketing submission include an approved PCCP?
• Does the anticipated change fall within the scope, methodology, and performance parameters defined in that PCCP?
• Have we conducted and documented an algorithmic impact assessment demonstrating the change does not alter intended use?
• Are our SOP, design history file, and post-market surveillance processes updated to reflect the change protocol?

If the answer to any of the first two questions is no, you are in traditional supplement territory. Full stop.

The Compliance Cost of Getting This Wrong

Implementing an AI/ML change outside your cleared submission scope -- whether outside an approved PCCP or without filing an appropriate supplement -- is a violation of 21 CFR 807.81. It exposes your company to Form 483 observations, Warning Letters, and in egregious cases, injunction. More immediately, it creates product liability exposure and can complicate future fundraising due diligence when investors and acquirers review your regulatory history.

Work With Experts Who Know AI/ML SaMD Regulatory Strategy

At ADB Consulting and CRO Inc., Andre Butler and the team work directly with medical device startups and established manufacturers navigating the PCCP framework, Special 510(k) strategy, and post-market compliance for AI/ML SaMD. We help you make the right pathway decision the first time -- so your development timelines do not get derailed by avoidable regulatory missteps.

Book a free discovery call today at adbccro.com and get clarity on your AI/ML change management strategy before your next software iteration goes live.

For related guidance, see our Software as a Medical Device regulatory support.