Locked vs. Adaptive AI/ML Algorithms: What FDA Clearance Really Means for Your Medical Device

Your AI Algorithm Got FDA Clearance. Now What Happens When It Changes?

Congratulations -- your AI-powered medical device cleared FDA. You have a 510(k) in hand, a predicate, and a product you can legally market in the United States. But your data science team is already talking about retraining the model. Your clinical team wants to expand the indicated population. And your CTO just asked whether you need to 'go back to FDA' every time you update the algorithm.

The short answer: it depends entirely on whether your algorithm is locked -- and what kind of change you are making. Getting this wrong is not a minor compliance issue. It is the difference between a lawful device modification and marketing an adulterated or misbranded device under 21 CFR Part 820 and Section 501 of the Federal Food, Drug, and Cosmetic Act.

What 'Locked' Actually Means Under FDA's Framework

FDA formally defined the concept of a locked algorithm in its 2021 guidance document, Artificial Intelligence/Machine Learning (AI/ML)-Based Software as a Medical Device (SaMD) Action Plan, and reinforced it in the Marketing Submission Recommendations for a Predetermined Change Control Plan for Artificial Intelligence-Enabled Devices guidance issued in December 2024.

A locked algorithm is one that does not change its behavior once it is deployed. After training and validation, the model's weights, architecture, decision thresholds, and outputs are fixed. When you feed it the same input, you get the same output -- every time, indefinitely. This is what most traditionally cleared AI/ML devices are today.

A continuously learning or adaptive algorithm, by contrast, is one that continues to train or update based on new real-world data after deployment. FDA has been cautious about these, and for good reason: an algorithm that changes post-market is, functionally, a different device over time.

When your cleared 510(k) describes a locked algorithm, FDA has evaluated that specific version -- its training data, its performance characteristics, its validation datasets, its intended use, and its risk profile. That is what was cleared. Not an evolving model. That specific model.

When a Change Requires a New FDA Submission

Under 21 CFR 807.81(a)(3), a new 510(k) is required when a modification could significantly affect safety or effectiveness, or when a major change in intended use occurs. For AI/ML devices, FDA's guidance makes clear that certain algorithm changes will almost always clear that bar.

Changes that typically trigger a new submission include:

• Retraining on new data that materially alters model performance -- especially if sensitivity, specificity, or AUC metrics shift beyond your originally validated performance bounds
• Changes to the intended patient population -- for example, expanding from adult to pediatric use, or adding a new disease subtype
• Changes to inputs or outputs -- new imaging modalities, additional biomarkers, or new clinical decision outputs
• Architecture changes -- moving from a convolutional neural network to a transformer-based model, or changing the decision threshold that drives device output
• Changes that affect the device's risk classification or indications for use

Changes that may not require a new submission -- but still require documented evaluation -- include minor software bug fixes, UI changes that do not affect algorithmic output, and performance optimizations that do not change device behavior. These still fall under your design control process per 21 CFR 820.30 and require a documented change assessment.

The Predetermined Change Control Plan: Your Path Forward

FDA's December 2024 guidance on Predetermined Change Control Plans (PCCPs) is one of the most important regulatory developments for AI/ML device makers in years. A PCCP allows you to prospectively define -- within your marketing submission -- the types of algorithm updates you anticipate making, how you will validate them, and under what conditions those changes will not require a new 510(k).

This is not a loophole. It is a structured, transparent agreement between you and FDA about how your device will evolve. A well-crafted PCCP includes:

• A Description of Planned Modifications -- specific, bounded changes you anticipate making post-clearance
• A Methodology for Implementing Modifications -- your validation protocols, performance benchmarks, and testing datasets
• A Performance Monitoring Protocol -- how you will surveil the algorithm in real-world use and detect performance drift

The PCCP must be realistic and bounded. FDA will not approve a PCCP that says 'we may retrain the model on any new data at any time.' They will approve one that says 'we may retrain using additional CT images from the same scanner types, provided sensitivity remains above 92% on the locked reference test set.'

Practical Implications for Your Development Roadmap

If you are in pre-submission or early 510(k) development right now, this is the moment to think strategically about your algorithm's lifecycle -- not after clearance.

Ask your team: How frequently do we expect to retrain? What will trigger a retrain? What data sources will we use? What performance bounds are clinically acceptable? The answers to these questions should shape whether you pursue a standard locked-algorithm submission, or invest the upfront effort in a PCCP that gives you regulatory flexibility post-market.

If you have already cleared a locked algorithm and are now facing pressure to update it, do not assume you can retrain quietly and redeploy. Conduct a formal change assessment, document it under your design controls, and engage a regulatory consultant before you modify the production model.

Work With a Consultant Who Knows AI/ML Device Regulation

The regulatory landscape for AI/ML medical devices is evolving faster than most internal quality teams can track. At ADB Consulting and CRO Inc., we help medical device startups and growth-stage companies navigate FDA submissions, change assessments, and PCCP strategy with precision -- not generic templates.

Whether you are planning your first AI/ML 510(k) or trying to understand what your post-clearance update process should look like, we can help you build a regulatory strategy that protects your clearance and accelerates your product roadmap.

Book a free discovery call with Andre Butler today at adbccro.com. Let's talk through where your algorithm stands -- and what it takes to keep it compliant as it evolves.

Related reading: our AI/ML SaMD consulting practice covers this in more depth.