Overview

In August 2024, FDA issued a cross‑cutting draft on Predetermined Change Control Plans (PCCPs) for all devices, establishing policy under FD&C Act §515C (FDORA 2022). In December 2024 FDA finalized the AI‑specific PCCP guidance for AI‑enabled device software functions and then updated it on August 18, 2025—adding clarifications, examples, and implementation detail. Net effect: you can ship defined, validated AI model updates without a new submission—but only inside an authorized PCCP with rigorous controls.

Key Details

1) This document updates the AI PCCP playbook

• AI‑specific guidance was originally issued Dec 4, 2024 and reissued Aug 18, 2025 (same docket, expanded content and appendices). Expect explicit examples and tighter expectations for traceability, validation, and rollout.

• It builds on the Aug 2024 general PCCP draft that set the umbrella policy for all devices. Think of the general draft as the statutory baseline and the AI guidance as the operational “how.”

2) Statutory authority now explicit

FD&C Act §515C (21 U.S.C. 360e‑4) authorizes FDA to approve/clear PCCPs in PMA and 510(k). If a modification stays within an authorized PCCP, no new PMA supplement or 510(k) is required; outside the plan or changing the plan triggers a submission.

3) What your PCCP must contain (and how FDA reviews it)

FDA expects three components in your marketing submission: Description of Modifications, Modification Protocol, and Impact Assessment. The guidance spells out AI‑specific expectations for data governance, retraining, performance evaluation (including subgroups), update procedures, rollback, version control, and labeling updates.

4) Process mechanics to cut risk and surprises

• Q‑Submission (Q‑Sub) program: FDA finalized an updated Q‑Sub guidance in May 2025—use it to align scope, evidence, and test plans before you lock your PCCP.

• QMS alignment: FDA’s QMSR (Part 820) harmonized with ISO 13485 is effective Feb 2, 2026. Your SOPs, records, and CAPA must support PCCP execution and audits to that bar.

5) Scope and pathways

The AI PCCP guidance applies to AI‑enabled device software functions—including device‑led combination products—across 510(k), De Novo, and PMA pathways; the PCCP is reviewed as part of the marketing submission.

Strategic Impacts for the Next 12–36 Months

Practical Recommendations

1) Decide if a PCCP fits—and right‑size it

Target specific, limited, testable AI modifications (e.g., threshold tuning, pre‑specified retraining within defined data envelopes, constrained pre/post‑processing changes). Avoid open‑ended categories.

2) Author the Description of Modifications

Enumerate each change with hard guardrails: inputs affected, model families, acceptable performance deltas, dataset/domain boundaries, and disallow lists tied to intended use. Define triggers for when an update can proceed (e.g., drift bounds, inclusion criteria).

3) Build the Modification Protocol

• Data governance: provenance, deduplication, site/scanner mix, representativeness; predefine inclusion/exclusion for retraining.

• Validation: locked test sets; a priori metrics/acceptance criteria; robustness (hardware/firmware/version), cybersecurity effects; human‑factors where relevant; rollback drills.

• Implementation: config management, release gating, labeling/version notes, distribution controls, and immutable audit trails.

4) Complete the Impact Assessment

Quantify benefit–risk per modification; map mitigations to failure modes; test subgroup performance and bias with corrective actions if thresholds fail. Align evidence with recognized risk‑management practices (e.g., map to NIST AI RMF GOVERN/MAP/MEASURE/MANAGE functions).

5) Lock regulatory alignment early

Use the Q‑Sub process to confirm PCCP scope, datasets, metrics, and acceptance criteria. Bring draft PCCP sections and validation plans; memorialize agreements.

6) Upgrade your QMS for QMSR/ISO 13485

Translate PCCP operations into SOPs, templates, and training: data curation, model versioning, validation protocols, change control, labeling updates, complaint handling, and CAPA linkages—effective by Feb 2, 2026.

7) Plan submissions smartly

Changes outside an authorized PCCP—or changes to the PCCP itself—require new submissions (e.g., 510(k) under 21 CFR 807.81(a)(3), PMA supplement under 21 CFR 814.39(a)). Design your plan to minimize future re‑filings.

8) Operationalize post‑market monitoring

Set drift detection, sentinel metrics, re‑validation cadence, clinician communications, and field analytics. Maintain verifiable audit trails for every update decision and rollback.

How Gesund.ai Helps

• PCCP Builder & Audit Trail: Structured authoring for Description/Protocol/Impact, with immutable, time‑stamped records and artifact versioning suitable for inclusion in submissions.

• Validation Workbench: Reproducible test plans with locked datasets, predefined metrics, subgroup/bias analyses, and exportable FDA‑aligned evidence packages.

• Data & Drift Governance: Dataset lineage, harmonization, drift monitoring, alerts, and rollback hooks—mapped to NIST AI RMF functions.

• QMS Integration: Traceability to SOPs/CAPA under QMSR/ISO 13485, aligned with the Feb 2026 effective date.

• Regulatory Packaging: One‑click exports for PCCP sections and Q‑Sub briefing packages to streamline pre‑submission engagement.

Treat PCCP Governance as Core Infrastructure:

Contact us to review your PCCP and validation strategy or book a demo.

Bibliography

• Marketing Submission Recommendations for a Predetermined Change Control Plan for AI‑Enabled Device Software Functions (originally issued Dec 4, 2024, updated Aug 18, 2025). U.S. Food and Drug Administration

• Predetermined Change Control Plans for Medical Devices — Draft Guidance, Aug 2024. U.S. Food and Drug Administration

• Statute: FD&C Act §515C (21 U.S.C. 360e‑4)—PCCP authority. uscode.house.gov

• QMS harmonization: Medical Devices; Quality System Regulation Amendments—final rule effective Feb 2, 2026. Federal Register

• FDA interactions: Q‑Submission Program—final guidance notice (May 29, 2025). Federal Register

• Risk management reference: NIST AI Risk Management Framework 1.0. NIST Publications