PCCP Modification Protocol: What FDA Requires in This Critical Section

What Has to Go in a PCCP Modification Protocol Section?

If you are developing an AI/ML-based Software as a Medical Device (SaMD) and pursuing a Predetermined Change Control Plan (PCCP), you already know the concept is designed to give manufacturers flexibility to improve their algorithms post-market without filing a new submission for every update. But the Modification Protocol section is where most submissions either earn credibility with FDA reviewers or fall apart entirely. Getting this section right is not optional -- it is the structural backbone of your entire PCCP.

This post breaks down exactly what FDA expects to see in the Modification Protocol, grounded in the agency's January 2025 final guidance on PCCPs for AI/ML-enabled devices and the underlying statutory authority at Section 515C of the FD&C Act.

Why the Modification Protocol Section Matters So Much

The PCCP framework allows manufacturers to pre-specify modifications that can be implemented without a new 510(k), De Novo, or PMA supplement -- provided those changes fall within the boundaries FDA has already reviewed and accepted. The Modification Protocol is where you define those boundaries explicitly. It tells FDA: here is what we plan to change, here is how we will execute that change, and here is how we will verify we have not degraded safety or performance.

A weak Modification Protocol forces FDA reviewers to make assumptions. Assumptions invite additional information (AI) requests, major deficiencies, or outright rejection of the PCCP. A strong one tells a complete, self-consistent story that a reviewer can follow without having to read between the lines.

The Required Elements: What FDA Expects to See

According to FDA's final PCCP guidance, the Modification Protocol must include the following components. These are not suggestions -- they are the minimum content FDA reviewers are evaluating your submission against.

1. Description of Planned Modifications

You must clearly articulate the specific types of modifications you intend to make. Vague language like 'performance improvements' will not pass muster. FDA expects you to specify whether you are retraining the model on new data, updating feature inputs, changing model architecture, refining output thresholds, or some combination. Each category of modification should be described in enough detail that a technically qualified reviewer can understand the scope without supplemental explanation.

2. Modification Execution Process

This subsection describes how you will actually implement the modification. It should cover your development workflow, version control practices, data governance procedures, and the roles and responsibilities of personnel involved. If you have a quality management system aligned to 21 CFR Part 820 or ISO 13485, your Modification Protocol should map directly to those procedures. Orphaned processes that do not connect back to your QMS will raise red flags.

3. Performance Evaluation Protocol

This is often the most technically dense part of the Modification Protocol, and rightfully so. You must specify the metrics you will use to evaluate whether a modified algorithm meets your pre-established performance standards. This includes:

• The specific statistical metrics (e.g., AUC, sensitivity, specificity, F1 score) and their acceptance thresholds
• The reference dataset or holdout test set you will evaluate against, including how that dataset was constructed and why it is representative
• Subgroup analyses where relevant (e.g., demographic subgroups, imaging equipment types)
• Failure mode analysis and how you will handle edge cases that degrade performance

FDA is particularly attentive to whether your evaluation dataset can actually detect meaningful performance degradation. If your test set is too small or not well-characterized, reviewers will push back.

4. Data Management Practices

FDA expects transparency around the data that will be used to retrain or update your model. Your Modification Protocol should describe data provenance, curation standards, de-identification practices, and how you ensure the training data does not introduce bias or distribution shift. This is directly tied to FDA's expectations under 21 CFR Part 11 for electronic records and broader expectations around algorithmic transparency articulated in the agency's AI/ML action plan.

5. Update Procedure

Once a modification passes evaluation, how does it get deployed? This section must describe your internal review and approval process before any updated algorithm reaches the market. It should specify the decision authority (e.g., a designated review board or senior regulatory and quality leadership), the documentation artifacts generated, and how the update is communicated to users if labeling changes are involved.

6. Transparency Reporting

FDA requires that manufacturers maintain transparency with both the agency and device users. Your Modification Protocol should address how you will document implemented modifications, what information will be communicated to clinicians or end users, and how records will be maintained in a manner that supports post-market surveillance and any future FDA audit.

Common Mistakes That Sink a PCCP Modification Protocol

After reviewing and preparing numerous PCCP submissions, several patterns emerge in deficient Modification Protocols:

• Overly broad modification scope: Trying to cover every conceivable future change makes your PCCP look like a blank check, which FDA will not accept.
• Disconnected evaluation criteria: Performance thresholds that do not tie back to your device's intended use and clinical context are unconvincing.
• Missing data governance detail: Saying you will 'use high-quality data' without specifying what that means operationally is not sufficient.
• No link to your QMS: A PCCP that floats in isolation from your Part 820 or ISO 13485 procedures will generate deficiencies.
• Inadequate subgroup analysis plans: FDA is increasingly scrutinizing algorithmic equity and expects you to have thought about performance across patient subpopulations.

A Final Word on Framing

Think of the Modification Protocol not as a regulatory hurdle, but as a quality agreement you are making with FDA about how you will be a responsible steward of a continuously learning device. The more clearly you demonstrate that your team has the processes, data discipline, and technical rigor to execute modifications safely, the more confidence FDA has in granting you the flexibility the PCCP framework is designed to provide.

FDA's willingness to accept a PCCP is ultimately a trust exercise. The Modification Protocol is your primary vehicle for building that trust before your device is ever modified.

Ready to Build a PCCP That FDA Will Accept?

At ADB Consulting and CRO Inc., Andre Butler and the team work directly with AI/ML device developers to design PCCP submissions that are technically rigorous, strategically sound, and aligned with current FDA expectations. Whether you are preparing your first submission or responding to deficiencies on an existing one, we can help you get it right.

Book a free discovery call at adbccro.com and let's talk about your PCCP strategy today.

Related reading: our AI/ML SaMD consulting practice covers this in more depth.