Predetermined Change Control Plans for AI/ML Medical Devices: A Practical Drafting Guide

Why Your AI/ML Device Needs a PCCP Before You Submit

If your medical device incorporates artificial intelligence or machine learning, you already know the core regulatory tension: FDA clearance or approval locks in a specific device version, but your algorithm will inevitably need to change. Retraining on new data, performance drift corrections, expanding indications -- each of these can trigger a new submission under traditional frameworks. A Predetermined Change Control Plan, or PCCP, is FDA's answer to that problem, and drafting one correctly from the start can save your company years of regulatory delay.

This guide is written for founders, regulatory affairs leads, and VP Quality/Regulatory executives who need to understand not just what a PCCP is, but how to build one that will actually survive FDA review.

The Regulatory Foundation: What Authorizes PCCPs

PCCPs were formally authorized under Section 3308 of the Food and Drug Omnibus Reform Act of 2022 (FDORA), which amended Section 515C of the Federal Food, Drug, and Cosmetic Act. FDA followed up with its final guidance, 'Marketing Submission Recommendations for a Predetermined Change Control Plan for Artificial Intelligence-Enabled Device Software Functions,' finalized in December 2024. This guidance is your primary reference document -- not optional reading.

PCCPs are currently applicable to AI/ML-enabled Device Software Functions (AI/ML DSF) submitted via 510(k), De Novo, or PMA pathways. The PCCP, once approved as part of your marketing submission, allows you to implement defined modifications without submitting a new 510(k) or PMA supplement for each change, provided those modifications stay within the boundaries you defined upfront.

The Three Required Components of a Compliant PCCP

FDA's guidance is explicit about what a PCCP must contain. Missing or underdeveloped sections are among the most common reasons PCCPs receive a Not Substantially Equivalent determination or a Major Deficiency in PMA review. Every PCCP must include the following three elements:

1. Description of Modifications

This section defines the scope of what changes you are pre-authorizing. You must describe each planned modification with enough specificity that a reviewer can determine whether a future change falls inside or outside the PCCP's boundaries. Vague language like 'performance improvements' will not pass review. Instead, specify the type of modification -- for example, retraining on expanded demographic datasets to improve sensitivity in a defined subpopulation -- and articulate the upper bounds of that change. Think of this as writing a contract with FDA: precision protects you.

2. Modification Protocol

For each modification category described above, you must establish the specific methods and procedures you will use to implement and validate the change. This includes your data management practices, algorithm retraining procedures, performance testing methodology, and how you will assess whether the modified device still meets its predicate or original performance specifications. Reference your Design Controls under 21 CFR Part 820.30 here -- your PCCP protocol should align directly with your Quality Management System procedures, particularly if you are also ISO 13485 certified.

3. Impact Assessment

This is where many sponsors underinvest. The impact assessment must address how each modification type affects safety and effectiveness, including any changes to the device's risk profile. Reference your risk management file and align this section with ISO 14971 principles. FDA will scrutinize whether you have considered performance across subpopulations, potential failure modes introduced by retraining, and any cybersecurity implications of updated model files -- particularly relevant under FDA's 2023 cybersecurity guidance for device submissions.

Common Drafting Mistakes That Trigger FDA Deficiencies

• Scope creep in modification descriptions: Describing modifications so broadly that FDA cannot establish a reviewable boundary. Specificity is not a weakness -- it is what makes a PCCP approvable.
• Disconnected performance metrics: The performance thresholds in your modification protocol must match the predicate performance claims in your 510(k) or the approved specifications in your PMA. Inconsistency signals that your QMS is not integrated with your regulatory strategy.
• Ignoring the SaMD Pre-Specs and Algorithm Change Protocol legacy framework: FDA's 2019 discussion paper on AI/ML-based SaMD introduced the SaMD Pre-Specifications (SPS) and Algorithm Change Protocol (ACP) concepts. While the PCCP framework supersedes this for formal submissions, reviewers still think in terms of these concepts. Structuring your PCCP with this mental model will produce a cleaner, more reviewable document.
• Failing to address real-world performance monitoring: A PCCP without a post-deployment monitoring plan will raise red flags. Describe how you will detect performance drift in the field and how that data feeds back into your modification protocol triggers.

Strategic Considerations: When to Include a PCCP

Not every AI/ML device needs a PCCP at initial submission. If your algorithm is truly locked and you have no near-term plans to retrain it, adding a PCCP can introduce unnecessary complexity and scope into your submission. However, if your commercial strategy depends on continuous learning, expanded indications, or improving performance post-clearance, not including a PCCP means every meaningful update triggers a new submission -- a significant competitive disadvantage.

For De Novo applicants in particular, a well-constructed PCCP can be a differentiator. It signals to FDA that your organization has mature change management processes, which can positively influence reviewer confidence in your overall submission package.

Aligning Your PCCP With Your Quality System

A PCCP is not a standalone document -- it is a commitment that must be operationalized through your Quality Management System. Under 21 CFR Part 820 (and the updated Quality System Regulation aligned with ISO 13485), your CAPA procedures, design change controls, and software validation protocols must be capable of executing every protocol you describe in the PCCP. If your QMS cannot support the promises in your PCCP, you have a compliance gap that FDA will eventually find -- either at submission review or during a facility inspection.

Ready to Build a PCCP That Gets Approved?

At ADB Consulting and CRO Inc., we work with AI/ML device companies at every stage -- from pre-submission strategy through post-market compliance -- to build regulatory submissions that move forward, not sideways. Andre Butler and the ADB team have hands-on experience drafting PCCPs across multiple device classifications and FDA submission types.

If you are preparing an AI/ML device submission and want to get your PCCP right the first time, book a free discovery call with our team at adbccro.com. We will assess your current documentation, identify gaps, and give you a clear path forward -- no generic advice, no wasted time.