Continuous Learning AI/ML Medical Devices: How FDA's Evolving Framework Impacts Your Regulatory Strategy

The Regulatory Ground Is Shifting Under AI-Driven Medical Devices

If your device uses a machine learning model that updates after commercialization, you are operating in one of the most scrutinized and rapidly evolving areas of FDA oversight. Continuous learning systems, sometimes called adaptive algorithms or continuously learning AI/ML, present a fundamental challenge to the traditional regulatory framework: how do you pre-specify a device's behavior when the algorithm is designed to change?

FDA has been wrestling with this question publicly since at least 2019, and the agency's thinking has matured considerably. If you are a founder, VP of Regulatory Affairs, or Quality leader at a small-to-mid-size device company, understanding where FDA stands today, and where it is heading, is not optional. It is a survival skill.

What FDA Means by 'Locked' vs. 'Adaptive' Algorithms

FDA's foundational document for this space is the April 2019 discussion paper titled 'Proposed Regulatory Framework for Modifications to Artificial Intelligence/Machine Learning-Based Software as a Medical Device' and the subsequent January 2021 action plan for AI/ML-based SaMD. These documents introduced a critical distinction that every regulatory professional should internalize.

• Locked algorithms produce the same output for the same input after deployment. These behave more like traditional software and can be evaluated under existing frameworks such as 21 CFR Part 820 and FDA's 2017 Software as a Medical Device (SaMD) guidance framework adapted from IMDRF.
• Adaptive algorithms continue to learn and change their behavior based on real-world data after deployment. These are the continuous learning systems that create the most regulatory complexity.

The core problem is structural: FDA clearance and approval processes under 21 CFR Part 807 (510(k)) and 21 CFR Part 814 (PMA) are designed to evaluate a device in a defined state. A model that retrains on live patient data post-market is, in a meaningful sense, a different device every time it updates.

The Predetermined Change Control Plan: FDA's Current Answer

FDA's most concrete response to this challenge is the Predetermined Change Control Plan (PCCP), which became the centerpiece of guidance finalized in December 2023 under the title 'Marketing Submission Recommendations for a Predetermined Change Control Plan for Artificial Intelligence-Enabled Device Software Functions.'

The PCCP framework allows manufacturers to prospectively define the types of modifications their AI/ML device may undergo without requiring a new premarket submission for each change, provided those modifications fall within the boundaries described in the plan. This is a significant regulatory accommodation, but it comes with rigorous expectations.

A compliant PCCP must include:

• Description of Planned Modifications: Specific, bounded descriptions of what types of changes are anticipated, including modifications to model architecture, training data, or intended use boundaries.
• Methodology for Modifications: A detailed explanation of the development, validation, and performance testing approach that will govern each modification type.
• Impact Assessment: An analysis of how planned changes affect safety and effectiveness, including consideration of algorithmic bias and performance across patient subpopulations.

Critically, FDA expects your PCCP to align with your Quality Management System under 21 CFR Part 820, now harmonized with ISO 13485 through the Quality System Regulation update finalized in February 2024. Change control for AI modifications is not a standalone regulatory artifact. It must live inside your QMS.

Real-Time Updates: Where FDA Has Not Yet Drawn Clear Lines

Here is where the practical complexity intensifies for continuous learning systems specifically. The 2023 PCCP guidance contemplates planned, defined modifications, not fully autonomous real-time retraining loops. If your system is designed to retrain automatically on streaming clinical data without human intervention at each update cycle, you are in territory the guidance does not fully address.

FDA has signaled through public statements and advisory committee discussions that fully autonomous continuous learning, where no human review gate exists before a model update goes live, raises significant concerns under the agency's Total Product Life Cycle (TPLC) approach. The agency's expectation, consistent with the 2021 AI/ML action plan, is that manufacturers maintain meaningful human oversight and performance monitoring tied to predefined safety thresholds.

Practically, this means your architecture decisions have regulatory consequences. Designing a human-in-the-loop validation checkpoint before each model version goes to production is not just good engineering practice. It is increasingly a regulatory expectation, particularly for devices in higher-risk classifications under 21 CFR Part 860.

What Your Team Should Be Doing Right Now

The regulatory path for continuous learning devices is navigable, but it requires deliberate strategy early in your development cycle. Here is what we advise clients to prioritize:

• Classify your algorithm changes early. Work with regulatory counsel to determine whether your anticipated model updates constitute major, moderate, or minor modifications under FDA's existing software change guidance and the PCCP framework.
• Build your PCCP before your submission, not after. FDA reviewers want to see a PCCP that reflects genuine engineering constraints and clinical risk thinking, not a document retrofitted to describe what you have already built.
• Establish performance monitoring infrastructure. FDA expects ongoing surveillance of AI/ML device performance post-market. Under 21 CFR Part 803 and your MDR obligations, degraded algorithm performance resulting in patient harm has reporting implications. Your monitoring system should be designed to detect drift proactively.
• Address algorithmic bias explicitly. FDA has been explicit in multiple guidance documents that performance disparities across race, sex, age, and other demographic factors are a safety issue, not a fairness abstraction. Your validation datasets and ongoing monitoring must reflect this.

The Strategic Reality for Startups and Growth-Stage Companies

For founders building AI-driven diagnostics, clinical decision support tools, or autonomous treatment devices, the PCCP framework is genuinely enabling. It creates a mechanism to innovate post-market without returning to FDA for every model refinement. But it also means your regulatory strategy must be co-developed with your product and engineering teams from day one.

The companies that struggle are those that treat regulatory affairs as a documentation exercise at the end of development. The companies that succeed are those that build regulatory intelligence into their architecture decisions, their data governance frameworks, and their change management processes while the product is still being designed.

At ADB Consulting and CRO Inc., we work directly with founders and regulatory teams navigating exactly this landscape. Whether you are preparing a first submission for an AI-enabled device, developing a PCCP strategy, or responding to FDA questions about your adaptive algorithm architecture, our team brings the technical and regulatory depth your program needs.

Book a free discovery call with Andre Butler at adbccro.com. Bring your toughest AI/ML regulatory questions. That is exactly what we are here for.

For related guidance, see our Software as a Medical Device regulatory support.

The Regulatory Problem No One Warned You About When You Built a Learning Algorithm

You built a smarter device. Your AI model improves with every patient encounter, refining its outputs in real time. That is exactly what your investors wanted to hear. But here is the question your regulatory counsel should have asked before you locked your architecture: does FDA consider each model update a new submission?

For most medical device companies developing Software as a Medical Device (SaMD) with adaptive algorithms, this is not a hypothetical. It is an active compliance risk. And the regulatory framework governing it, while maturing, still leaves significant gray area that can derail your commercialization timeline if you are not navigating it proactively.

How FDA Currently Classifies AI/ML-Based SaMD

FDA regulates AI/ML-based SaMD under the same statutory authority as other medical devices under the Federal Food, Drug, and Cosmetic Act (FD&C Act), with software-specific guidance layered on top. The foundational document you must understand is FDA's January 2021 action plan titled 'Artificial Intelligence/Machine Learning (AI/ML)-Based Software as a Medical Device (SaMD) Action Plan,' which built on the 2019 proposed regulatory framework discussion paper.

The core tension FDA identified is this: traditional premarket pathways -- whether 510(k) under 21 CFR Part 807, De Novo under 21 CFR Part 860, or PMA under 21 CFR Part 814 -- were designed for locked software. A device clears or approves based on a defined, static set of specifications. A continuously learning algorithm, by design, violates that assumption. Its behavior at month 18 post-clearance may differ materially from what FDA reviewed at submission.

Locked vs. Adaptive Algorithms: The Distinction That Drives Your Strategy

FDA draws a critical line between two algorithm types:

• Locked algorithms: The model does not change after deployment. Any update requires a new submission or at minimum a change assessment under your predetermined change control plan.
• Adaptive algorithms: The model continues to learn and update from real-world data after deployment. These are what FDA calls 'continuous learning systems' and they present the highest regulatory complexity.

Under current guidance, an adaptive algorithm that changes its intended function or performance in a clinically meaningful way will likely trigger a new premarket submission. The challenge is that 'clinically meaningful' is not yet precisely defined in regulation, which means your risk assessment and change control documentation carry enormous strategic weight.

The Predetermined Change Control Plan (PCCP): Your Most Important Regulatory Tool

The most significant development for continuous learning systems is the PCCP framework. FDA issued its final guidance on 'Marketing Submission Recommendations for a Predetermined Change Control Plan for Artificial Intelligence-Enabled Device Software Functions' in December 2024. This guidance operationalizes what FDA had been signaling since 2021: manufacturers can prospectively describe anticipated algorithm changes and the controls governing them, and FDA can evaluate that plan as part of the original submission.

A well-constructed PCCP submitted with your 510(k) or De Novo request can allow you to implement certain post-market algorithm modifications without returning for a new clearance -- provided the changes fall within the scope and boundaries you defined upfront. This is not a loophole. It is a rigorous framework requiring you to specify:

• The description of planned modifications and the rationale for why they are bounded
• The methodology for implementing and validating each change
• The performance monitoring approach, including drift detection and statistical process controls
• The data governance protocols governing what training data can be used post-market

If your PCCP is vague or overly broad, FDA will not accept it. If you do not have one and your algorithm is updating in the field, you may already be in violation of 21 CFR Part 820 quality system requirements and the device modification rules under 21 CFR 807.81(a)(3).

Real-World Performance Monitoring Is Now an Expectation, Not a Best Practice

FDA's 2022 guidance on 'Good Machine Learning Practice for Medical Device Development' and subsequent Digital Health Center of Excellence communications have made clear that post-market performance monitoring for AI/ML SaMD is expected at the same level of rigor as clinical post-market surveillance. This means your quality management system under 21 CFR Part 820 -- or ISO 13485 if you are pursuing international alignment -- must include AI-specific surveillance procedures that catch model drift, demographic performance disparities, and distributional shift in input data before they become patient safety events.

Failure to detect and respond to performance degradation in a continuously learning system is not just a quality gap. It is a reportable event risk under 21 CFR Part 803 if patient harm results.

What Device Startups and Small Companies Get Wrong

The most common mistake ADB Consulting sees from early-stage and growth-stage companies is treating the PCCP as a document to generate late in the submission process. It is a design input. Your data architecture, retraining pipelines, versioning infrastructure, and validation protocols all need to be built in alignment with the PCCP you intend to file. Retrofitting this after the fact is expensive and often requires architectural changes that delay your clearance by six to twelve months.

The second most common mistake is assuming that because your model update is minor, it does not require documentation under your change control process. FDA does not assess significance based on your internal engineering judgment alone. Your quality system must include a defined, risk-based algorithm change assessment procedure that produces documented rationale for every decision not to submit.

The Path Forward for Your AI/ML Device Program

The regulatory landscape for continuous learning systems is the most dynamic area of medical device law today. FDA is actively issuing guidance, convening public workshops, and signaling through pre-submission feedback what it expects from sponsors. Companies that engage with FDA early -- through the Q-Sub process under 21 CFR Part 807 Subpart B pre-submission procedures -- are consistently better positioned to define the boundaries of their PCCP and avoid surprise requests for additional information that stall their clearance timeline.

If your SaMD has any adaptive component, the time to build your regulatory strategy around it is before your IDE, before your pivotal data collection, and certainly before your submission. The framework exists. The question is whether your team is using it correctly.

Work With a Firm That Knows AI/ML SaMD Regulatory Strategy

At ADB Consulting and CRO Inc., Andre Butler and the team work directly with medical device startups and established manufacturers to build submission-ready regulatory strategies for AI/ML-based SaMD -- including PCCP development, pre-submission meeting preparation, and post-market surveillance program design. We do not hand you a template. We help you build a defensible, FDA-aligned strategy for the specific adaptive architecture your product uses.

If you are building a continuously learning medical device and you are not certain your regulatory approach is airtight, book a free discovery call today at adbccro.com. Thirty minutes of expert input now can save you a year of remediation later.

Related reading: our AI/ML SaMD consulting practice covers this in more depth.