Predetermined Change Control Plans for AI/ML Medical Devices: What FDA Expects and How to Get It Right

Why Your AI/ML Device Needs a PCCP Before You Submit

If you are developing a machine learning-based medical device and you have not yet thought seriously about a Predetermined Change Control Plan (PCCP), you are already behind. FDA has made it clear that the traditional premarket submission model -- submit once, make a change, resubmit -- does not scale for AI/ML software that learns, adapts, and improves over time. The PCCP framework is FDA's answer to that problem, and it is now one of the most consequential strategic decisions a regulatory team can make during product development.

This post breaks down what a PCCP actually is, what FDA requires, and how to build one that holds up under scrutiny -- not just at submission, but throughout your device's lifecycle.

What Is a PCCP and Where Does the Authority Come From?

A Predetermined Change Control Plan is a document -- submitted as part of a 510(k), De Novo, or PMA -- that describes modifications a manufacturer anticipates making to an AI/ML device after authorization, along with the methodology used to implement and validate those changes without requiring a new premarket submission each time.

The statutory authority for PCCPs was codified under Section 3308 of the Food and Drug Omnibus Reform Act (FDORA) of 2022, which amended the Federal Food, Drug, and Cosmetic Act (FD&C Act) by adding Section 515C. This legislation directed FDA to issue guidance on PCCPs, which materialized in the agency's January 2025 final guidance: 'Predetermined Change Control Plans for Artificial Intelligence-Enabled Devices.'

This final guidance supersedes the draft guidance issued in April 2023 and represents FDA's current, enforceable thinking. If your regulatory strategy is still based on the 2023 draft, you need to update it now.

The Three Core Components FDA Expects in Your PCCP

FDA's final guidance identifies three foundational elements that every PCCP must address. Weak execution on any one of these is enough to trigger a substantive deficiency letter or an outright refusal to accept.

1. Description of Planned Modifications

You must clearly articulate what types of changes are anticipated. This is not a wish list -- it is a scoped, bounded description of modification types, such as retraining the algorithm on expanded datasets, updating performance thresholds, or modifying the intended patient population. Vague language like 'improvements to model performance' will not survive FDA review. Each modification type must be specific enough that a reviewer can understand exactly what is and is not included.

2. Modification Protocol

This is the technical heart of the PCCP. The modification protocol must describe the specific methods, datasets, testing procedures, and performance benchmarks that will govern each planned change. FDA expects you to define your training, tuning, and test dataset requirements; your statistical performance metrics; and the acceptable performance boundaries that, if crossed, would trigger a new submission rather than PCCP implementation. Reference to recognized consensus standards, such as those from ANSI/AAMI or ISO 13485:2016 quality system requirements, strengthens the credibility of your protocol.

3. Impact Assessment

You must demonstrate that you have systematically evaluated the risks introduced by each modification type. This includes changes to device safety, effectiveness, and -- critically -- any potential for introducing or amplifying algorithmic bias. FDA has been explicit in its guidance that health equity considerations are part of a credible impact assessment. Ignoring this will draw scrutiny.

PCCP and Your Quality System: The 21 CFR Part 820 Connection

A PCCP does not exist in a vacuum. FDA expects the change management activities described in your PCCP to be embedded in your Quality Management System. Under 21 CFR Part 820 (now aligned with ISO 13485 through the 2024 Quality System Regulation update), your design controls, CAPA procedures, and post-market surveillance activities must be structured to support PCCP execution. If your QMS cannot generate the data outputs your modification protocol requires -- things like real-world performance metrics, adverse event signals, or dataset drift indicators -- your PCCP is aspirational at best and non-compliant at worst.

Common Mistakes That Sink PCCPs at Submission

• Scope creep in the modification description: Trying to cover every conceivable future change makes the PCCP unmanageable and signals to FDA that you lack disciplined development governance.
• Undefined performance boundaries: If you do not specify the quantitative thresholds that trigger a new submission, FDA has no way to confirm your device will remain safe and effective after a change.
• Disconnected from clinical validation: Changes to an AI/ML device often affect clinical performance. Your PCCP must address how clinical validity will be reassessed under the modification protocol, especially for higher-risk devices under PMA.
• Treating the PCCP as a submission checkbox: FDA will evaluate PCCP compliance during inspections. Manufacturers who draft a PCCP for submission and then ignore it operationally are creating significant regulatory exposure.

Start Early, Build Strategically

The companies that succeed with PCCPs are the ones that begin the planning process during design and development -- not during submission prep. The decisions you make about model architecture, dataset governance, and performance metrics early in development directly determine how robust your PCCP can be. Retrofitting a PCCP onto a poorly documented development history is painful, expensive, and often unconvincing to FDA reviewers.

At ADB Consulting and CRO Inc., Andre Butler and the team work directly with medical device startups and established manufacturers to build regulatory strategies that treat the PCCP as a competitive asset, not a bureaucratic hurdle. Getting this right the first time reduces submission cycles, protects your post-market flexibility, and positions your device for the kind of iterative improvement that AI/ML technology demands.

If you are preparing a 510(k), De Novo, or PMA for an AI/ML device -- or if you already have a cleared device and need to build a PCCP for future modifications -- now is the time to get expert eyes on your strategy.

Book a free discovery call with Andre Butler at adbccro.com to discuss your specific device, your submission timeline, and what a compliant PCCP looks like for your program. Do not let regulatory uncertainty slow down your innovation.