AI/ML SaMD Change Management: PCCP vs. Traditional Supplement — What FDA Actually Expects

The Post-Deployment Problem Nobody Warns You About

You have cleared or approved your AI/ML-based Software as a Medical Device (SaMD). Congratulations — now the real regulatory work begins. Unlike traditional medical devices that remain static after market entry, AI/ML SaMD is often designed to learn, adapt, and improve. That is precisely what makes it valuable. It is also precisely what makes it a regulatory minefield if your change management strategy is not locked in before your first model update.

The central question your regulatory team must answer is this: does the change you are planning require a new FDA submission — or can it be executed under a Predetermined Change Control Plan (PCCP)? Getting this wrong costs you time, money, and in some cases, your clearance.

The Regulatory Foundation: Why AI/ML SaMD Is Different

FDA's foundational thinking on this issue is laid out in the January 2021 action plan titled 'Artificial Intelligence/Machine Learning (AI/ML)-Based Software as a Medical Device (SaMD) Action Plan' and further operationalized in the April 2023 guidance document 'Marketing Submission Recommendations for a Predetermined Change Control Plan for Artificial Intelligence/Machine Learning-Enabled Device Software Functions.' These documents reflect FDA's acknowledgment that the traditional static device paradigm does not fit adaptive algorithms.

Under 21 CFR Part 807 (for 510(k) devices) and 21 CFR Part 814 (for PMA devices), any change that could affect safety or effectiveness triggers a submission obligation. For conventional hardware or static software, this framework works reasonably well. For an AI/ML model that may retrain on new real-world data quarterly, it creates a submission bottleneck that can make your product commercially unviable — unless you plan ahead.

What Is a PCCP — and What It Is Not

A Predetermined Change Control Plan is a prospective agreement with FDA, embedded within your initial marketing submission, that defines the types of changes you anticipate making to your AI/ML device function and the specific controls and performance standards you will use to manage those changes without requiring a new submission each time.

A PCCP has three required components according to FDA's 2023 guidance:

• Description of Modifications: A clear, specific articulation of the anticipated changes — algorithm retraining, architectural updates, new input data types, expanded indications, etc.
• Modification Protocol: The methodology, validation procedures, and performance benchmarks that govern each defined change — think locked test datasets, pre-specified performance thresholds, and statistical acceptance criteria.
• Impact Assessment: A documented analysis of how the proposed changes could affect device safety, effectiveness, and the benefit-risk profile across your intended use population.

What a PCCP is not: a blank check. FDA is explicit that a PCCP does not authorize unlimited model updates. If a change falls outside the boundaries you defined at submission, you are back to a traditional supplement pathway — full stop.

When a Traditional Supplement Still Applies

Even with a well-crafted PCCP in place, certain changes will always require a return to FDA. You must file a traditional 510(k) supplement or PMA supplement when:

• The intended use or indications for use are materially expanding beyond what the original submission covered
• The algorithm architecture changes in a way not contemplated or described in your PCCP
• Performance on a new patient population or clinical setting was not included in your original impact assessment
• A change to input data type (e.g., adding a new imaging modality or sensor signal) was not prospectively defined
• Post-market performance data reveals safety signals that invalidate your original benefit-risk conclusions

For PMA devices, the bar is particularly high. Under 21 CFR 814.39, PMA supplements are required for changes that affect safety or effectiveness, and FDA has not indicated that a PCCP eliminates this obligation for out-of-scope modifications. Sponsors of high-risk AI/ML devices should be especially conservative in how they scope PCCP boundaries.

Practical Strategy: How to Build a PCCP That Actually Works

The most common mistake startups make is treating the PCCP as an afterthought — something drafted in the final weeks before submission without input from the data science or clinical teams. A PCCP that does not reflect your actual product roadmap will either be rejected by FDA during review or will be too narrow to provide meaningful regulatory relief post-clearance.

A defensible PCCP strategy requires four things:

• Roadmap alignment: Your regulatory counsel must sit in the room with product and engineering leadership to understand what changes are realistically planned over a 24-to-36-month horizon
• Specificity over breadth: FDA responds better to narrowly defined, well-controlled change descriptions than to broad, ambiguous language that appears to be seeking open-ended flexibility
• Statistical rigor in the Modification Protocol: Pre-specified performance thresholds tied to clinically meaningful endpoints — not just internal benchmarks — carry significantly more weight during review
• Change control infrastructure: Your quality management system under 21 CFR Part 820 must have documented procedures that operationalize the PCCP commitments you made to FDA, including record-keeping, version control, and internal review gates

The Bottom Line for Founders and Regulatory Leaders

The PCCP framework represents one of the most significant regulatory innovations FDA has introduced for SaMD — but it is not a shortcut. It is a commitment. Devices that earn PCCP-enabled flexibility do so because their sponsors did the hard work upfront: rigorous impact assessment, defensible validation protocols, and honest scoping of anticipated changes.

If your AI/ML SaMD is heading toward a 510(k) or De Novo submission in the next six to eighteen months, the time to build your PCCP strategy is now — not after you have already locked your submission package.

Work With a Regulatory Partner Who Understands AI/ML SaMD

At ADB Consulting and CRO Inc., Andre Butler and the team work directly with medical device startups and growth-stage companies navigating the full arc of AI/ML SaMD regulatory strategy — from pre-submission planning through PCCP development, FDA Q-Sub meetings, and post-market change management. We understand both the regulatory framework and the commercial realities your team is operating under.

If you are unsure whether your planned algorithm updates require a new submission or can be managed under a PCCP, do not guess. Book a free discovery call with our team at adbccro.com and get a clear, expert-informed answer within a single conversation.

If this applies to your program, our AI/ML SaMD regulatory strategy guide walks through the process in detail.