Locked vs. Adaptive AI/ML Algorithms: What FDA Clearance Really Means for Your Medical Device

Your AI Algorithm Got Cleared. Now What Happens When It Learns Something New?

Congratulations -- your AI-powered medical device just received FDA 510(k) clearance. The algorithm is performing well, your clinical team wants to retrain it on a larger dataset, and your data scientists are confident the new model is meaningfully better. So you update it and ship the improvement, right?

Not so fast. If your algorithm is classified as locked, that update may constitute a change that requires a new premarket submission before you touch a single line of production code. Getting this wrong is not a paperwork problem -- it is a regulatory enforcement risk that can shut down your commercial operation.

This post breaks down exactly what the FDA means by a locked algorithm, why the distinction matters for your 510(k) or De Novo clearance, and what your options are when the algorithm you cleared yesterday needs to improve tomorrow.

What Does 'Locked' Actually Mean Under FDA's Framework?

The FDA's foundational thinking on AI and machine learning in software as a medical device (SaMD) is captured in its April 2019 discussion paper and, more formally, in the January 2021 action plan titled 'Artificial Intelligence/Machine Learning (AI/ML)-Based Software as a Medical Device (SaMD) Action Plan.' These documents establish a critical binary distinction:

• Locked algorithms produce the same output every time they receive the same input. The model weights, decision thresholds, and logic are fixed at the time of clearance. Think of a traditional software algorithm or a trained neural network whose parameters are frozen before submission.
• Adaptive algorithms continue to learn and change their behavior after deployment -- either autonomously in real time or through periodic retraining cycles.

Under 21 CFR Part 820 (and its harmonized successor, the Quality System Regulation aligned with ISO 13485), your device's software is subject to design controls. The version of the algorithm that FDA reviewed is the version that is cleared. Any modification to that locked algorithm is a software change -- and software changes to cleared devices are governed by 21 CFR 820.30 and, critically, by the FDA's guidance document 'Deciding When to Submit a 510(k) for a Change to an Existing Device' (October 2017) as well as the software-specific companion, 'Deciding When to Submit a 510(k) for a Software Change to an Existing Device' (October 2017).

When a Model Update Triggers a New 510(k)

The 2017 software change guidance establishes a risk-based decision flowchart that every regulatory team should have memorized. For AI/ML devices specifically, the questions that matter most are:

• Does the change alter the intended use or indications for use?
• Does the change introduce new risks or significantly modify existing ones?
• Could the change affect the safety or effectiveness of the device in a way that was not already addressed in the cleared submission?

Retraining a locked algorithm on new patient populations, expanding the input data types, adjusting decision thresholds, or changing the model architecture are all changes that will almost certainly require you to work through this flowchart -- and many of them will land on the side of 'new 510(k) required.' The FDA has made clear that for high-risk AI functions, it expects changes to be evaluated with the same rigor as the original submission.

If your algorithm informs diagnosis, triage, or treatment decisions -- what FDA categorizes as SaMD at higher risk levels under the International Medical Device Regulators Forum (IMDRF) framework -- the bar is even higher.

The Predetermined Change Control Plan: Your Path to Iterative Improvement

Here is where strategy becomes invaluable. FDA's 2021 AI/ML action plan introduced the concept of a Predetermined Change Control Plan (PCCP), which was subsequently formalized in draft guidance issued in April 2023: 'Marketing Submission Recommendations for a Predetermined Change Control Plan for Artificial Intelligence-Enabled Device Software Functions.'

A PCCP allows a manufacturer to describe, within the original marketing submission, the types of algorithm changes it anticipates making post-clearance -- and to pre-specify the performance standards and validation protocols that will govern those changes. If FDA accepts the PCCP, manufacturers can implement those pre-defined changes without submitting a new 510(k), provided the changes stay within the approved boundaries and the associated testing confirms performance targets are met.

This is not a loophole. It is a rigorous, prospective regulatory commitment that requires you to:

• Define the scope of anticipated modifications with specificity
• Specify the performance metrics and acceptance criteria that must be met before any change is deployed
• Describe the data governance, retraining procedures, and monitoring plans that will keep the algorithm within its validated envelope

For startups building AI-native devices, the PCCP should be a day-one architectural and regulatory consideration -- not an afterthought once the product is already on the market.

Practical Steps for Teams Managing Locked Algorithms Today

If you are already cleared and working with a locked algorithm, here is how to protect your clearance while building toward future improvements:

• Document every proposed change using a formal software change request process tied to your design control procedures under 21 CFR 820.30.
• Run the 2017 software change guidance flowchart for every change, and keep written records of your rationale. FDA investigators will ask for this during inspections.
• Assess whether a PCCP can be incorporated into an upcoming submission -- either a new clearance for the next generation or a PMA supplement if your device is Class III.
• Engage FDA early through Pre-Sub meetings (formally governed by FDA's 2021 Pre-Sub guidance) if you are unsure whether a specific algorithm change requires a new submission. These meetings are free, and the written responses carry significant weight.
• Align your software development lifecycle (SDLC) with IEC 62304, which FDA recognizes as the standard for medical device software development and is directly relevant to how you document algorithm versioning and change management.

The Bottom Line

A locked algorithm is not a limitation -- it is a regulatory contract between you and the FDA. The version that was cleared is the version that is safe and effective for its cleared indication. When you improve on it, you have an obligation to validate that the improvement does not introduce new risks and, in many cases, to tell FDA about it before deployment.

The companies that navigate this well are the ones that build their regulatory strategy alongside their AI development pipeline -- not after the fact. A PCCP negotiated upfront can be the difference between a nimble, continuously improving product and one that is frozen in time because the regulatory pathway for updates was never planned.

At ADB Consulting and CRO Inc., we work with medical device startups and established manufacturers to build AI/ML regulatory strategies that are designed for the real world -- where algorithms need to get better, markets evolve, and FDA expectations are constantly maturing. Whether you are preparing your first 510(k) for an AI-enabled device or managing post-market changes to a cleared algorithm, we can help you move fast without breaking your clearance.

Book a free discovery call with Andre Butler today at adbccro.com and let's map out a regulatory strategy that keeps your AI on the market and ahead of the curve.

Related reading: our AI/ML SaMD consulting practice covers this in more depth.

Your AI Algorithm Got FDA Clearance. Now What Happens When It Learns Something New?

Congratulations -- your AI-powered medical device cleared FDA. That is a genuine milestone. But if your team is already talking about retraining the model, improving sensitivity, or pushing a performance update, you need to understand one concept before you touch a single line of code: what it means for your algorithm to be locked.

This is not a technicality. Getting it wrong can expose your company to enforcement action, invalidate your clearance, and -- most critically -- put patients at risk. Here is what you actually need to know.

What 'Locked' Means Under FDA's Framework

FDA's 2021 guidance document, 'Artificial Intelligence/Machine Learning (AI/ML)-Based Software as a Medical Device (SaMD): Action Plan,' and the earlier 2019 proposed regulatory framework both use the term 'locked' to describe an algorithm whose logic, parameters, and outputs are fixed after the device is deployed. A locked algorithm produces the same output for the same input, every time, without modification based on new data encountered in the field.

When you submitted your 510(k) or De Novo request, FDA reviewed a specific version of your algorithm -- its architecture, training data characteristics, performance validation data, and intended use. That reviewed version is what is cleared. The cleared algorithm is, by definition, locked.

This matters because FDA regulates medical devices under 21 CFR Part 820 (Quality System Regulation, now aligned with ISO 13485 under the 2024 Quality Management System Regulation) and evaluates software changes under the 21 CFR 807.81(a)(3) standard -- which requires a new premarket submission when a change could significantly affect safety or effectiveness.

When a Change to Your Algorithm Requires a New Submission

FDA's 'Deciding When to Submit a 510(k) for a Software Change to an Existing Device' guidance (2017) is the foundational document for this analysis. It lays out a decision framework for determining whether a software modification triggers a new 510(k). For AI/ML devices, the analysis is more nuanced but the core question is the same: does the change introduce new risks or affect clinical performance?

Changes that almost certainly require a new submission include:

• Retraining the model on new data that materially changes its performance characteristics
• Modifying the algorithm's intended use or indications for use
• Changing the model architecture in ways that affect outputs
• Expanding the patient population or imaging modality the algorithm was assessed on
• Updating decision thresholds that alter sensitivity or specificity

Changes that may not require a new submission -- but still require documented evaluation -- include bug fixes that do not affect clinical function, UI changes, and backend infrastructure updates that leave the model itself untouched. Even these require a formal change control analysis under your QMS.

The Predetermined Change Control Plan: Your Strategic Exit Ramp

Here is where forward-thinking regulatory strategy pays off. FDA introduced the concept of the Predetermined Change Control Plan (PCCP) specifically to address the operational reality that AI/ML algorithms need to evolve. The 2023 draft guidance on PCCPs outlines how sponsors can prospectively define the types of changes they anticipate making -- and the performance guardrails and validation protocols they will follow -- so that certain future modifications do not require a new premarket submission.

A well-constructed PCCP submitted with your initial 510(k) or De Novo essentially pre-negotiates with FDA the conditions under which your algorithm can be updated without triggering a new review. This is not a loophole. It is a rigorous commitment to:

• Defining the specific modifications you anticipate (e.g., retraining on additional scanner types)
• Establishing performance boundaries that must be maintained
• Describing the validation methodology you will use to confirm the change stays within those bounds
• Committing to transparency through your labeling and post-market monitoring

If you did not include a PCCP in your original submission, you can still submit one as a separate 510(k) or as part of a subsequent modification submission. It is never too late to build this infrastructure -- but it is always more expensive to do it reactively.

Post-Market Obligations Do Not Stop at Clearance

Even with a locked algorithm, your obligations under 21 CFR Part 803 (MDR) and 21 CFR Part 806 remain active. If real-world performance data surfaces unexpected failure modes -- demographic subpopulations where the algorithm underperforms, for example -- that information may require you to act, even if the model itself has not changed. Your post-market surveillance plan should include AI-specific metrics tied to the performance claims in your cleared submission.

What Founders and Regulatory Teams Get Wrong

The most common mistake we see at ADB Consulting is companies treating their cleared AI algorithm the way they treat cleared hardware -- as something static that just gets used. AI models are living artifacts. Your team needs change control processes, algorithm version governance, and a regulatory trigger analysis workflow before the first post-clearance update ever happens. Waiting until the engineering team has already retrained the model is the wrong time to ask the regulatory question.

Ready to Build a Regulatory Strategy That Scales With Your Algorithm?

At ADB Consulting and CRO Inc., we help medical device companies navigate AI/ML regulatory submissions, draft Predetermined Change Control Plans, and build the internal frameworks that keep cleared devices compliant as they evolve. Whether you are pre-submission or already cleared and looking ahead, we can help you move faster without cutting corners.

Book a free discovery call with Andre Butler today at adbccro.com. Let's make sure your next algorithm update does not become your next regulatory problem.

For related guidance, see our Software as a Medical Device regulatory support.

Your AI Algorithm Got FDA Clearance. Now What Happens When It Changes?

Congratulations -- your AI-powered medical device cleared FDA. You have a 510(k) in hand, a predicate, and a product you can legally market in the United States. But your data science team is already talking about retraining the model. Your clinical team wants to expand the indicated population. And your CTO just asked whether you need to 'go back to FDA' every time you update the algorithm.

The short answer: it depends entirely on whether your algorithm is locked -- and what kind of change you are making. Getting this wrong is not a minor compliance issue. It is the difference between a lawful device modification and marketing an adulterated or misbranded device under 21 CFR Part 820 and Section 501 of the Federal Food, Drug, and Cosmetic Act.

What 'Locked' Actually Means Under FDA's Framework

FDA formally defined the concept of a locked algorithm in its 2021 guidance document, Artificial Intelligence/Machine Learning (AI/ML)-Based Software as a Medical Device (SaMD) Action Plan, and reinforced it in the Marketing Submission Recommendations for a Predetermined Change Control Plan for Artificial Intelligence-Enabled Devices guidance issued in December 2024.

A locked algorithm is one that does not change its behavior once it is deployed. After training and validation, the model's weights, architecture, decision thresholds, and outputs are fixed. When you feed it the same input, you get the same output -- every time, indefinitely. This is what most traditionally cleared AI/ML devices are today.

A continuously learning or adaptive algorithm, by contrast, is one that continues to train or update based on new real-world data after deployment. FDA has been cautious about these, and for good reason: an algorithm that changes post-market is, functionally, a different device over time.

When your cleared 510(k) describes a locked algorithm, FDA has evaluated that specific version -- its training data, its performance characteristics, its validation datasets, its intended use, and its risk profile. That is what was cleared. Not an evolving model. That specific model.

When a Change Requires a New FDA Submission

Under 21 CFR 807.81(a)(3), a new 510(k) is required when a modification could significantly affect safety or effectiveness, or when a major change in intended use occurs. For AI/ML devices, FDA's guidance makes clear that certain algorithm changes will almost always clear that bar.

Changes that typically trigger a new submission include:

• Retraining on new data that materially alters model performance -- especially if sensitivity, specificity, or AUC metrics shift beyond your originally assessed performance bounds
• Changes to the intended patient population -- for example, expanding from adult to pediatric use, or adding a new disease subtype
• Changes to inputs or outputs -- new imaging modalities, additional biomarkers, or new clinical decision outputs
• Architecture changes -- moving from a convolutional neural network to a transformer-based model, or changing the decision threshold that drives device output
• Changes that affect the device's risk classification or indications for use

Changes that may not require a new submission -- but still require documented evaluation -- include minor software bug fixes, UI changes that do not affect algorithmic output, and performance optimizations that do not change device behavior. These still fall under your design control process per 21 CFR 820.30 and require a documented change assessment.

The Predetermined Change Control Plan: Your Path Forward

FDA's December 2024 guidance on Predetermined Change Control Plans (PCCPs) is one of the most important regulatory developments for AI/ML device makers in years. A PCCP allows you to prospectively define -- within your marketing submission -- the types of algorithm updates you anticipate making, how you will assesses them, and under what conditions those changes will not require a new 510(k).

This is not a loophole. It is a structured, transparent agreement between you and FDA about how your device will evolve. A well-crafted PCCP includes:

• A Description of Planned Modifications -- specific, bounded changes you anticipate making post-clearance
• A Methodology for Implementing Modifications -- your validation protocols, performance benchmarks, and testing datasets
• A Performance Monitoring Protocol -- how you will surveil the algorithm in real-world use and detect performance drift

The PCCP must be realistic and bounded. FDA will not approve a PCCP that says 'we may retrain the model on any new data at any time.' They will approve one that says 'we may retrain using additional CT images from the same scanner types, provided sensitivity remains above 92% on the locked reference test set.'

Practical Implications for Your Development Roadmap

If you are in pre-submission or early 510(k) development right now, this is the moment to think strategically about your algorithm's lifecycle -- not after clearance.

Ask your team: How frequently do we expect to retrain? What will trigger a retrain? What data sources will we use? What performance bounds are clinically acceptable? The answers to these questions should shape whether you pursue a standard locked-algorithm submission, or invest the upfront effort in a PCCP that gives you regulatory flexibility post-market.

If you have already cleared a locked algorithm and are now facing pressure to update it, do not assume you can retrain quietly and redeploy. Conduct a formal change assessment, document it under your design controls, and engage a regulatory consultant before you modify the production model.

Work With a Consultant Who Knows AI/ML Device Regulation

The regulatory landscape for AI/ML medical devices is evolving faster than most internal quality teams can track. At ADB Consulting and CRO Inc., we help medical device startups and growth-stage companies navigate FDA submissions, change assessments, and PCCP strategy with precision -- not generic templates.

Whether you are planning your first AI/ML 510(k) or trying to understand what your post-clearance update process should look like, we can help you build a regulatory strategy that protects your clearance and accelerates your product roadmap.

Book a free discovery call with Andre Butler today at adbccro.com. Let's talk through where your algorithm stands -- and what it takes to keep it compliant as it evolves.

Related reading: our AI/ML SaMD consulting practice covers this in more depth.