FDA Pre-Cert (Software Precertification)

Pre-Cert was FDA's attempt to design a regulatory model fit for software. The traditional device pathway (510(k), De Novo, PMA) reviews a static product at a fixed configuration. SaMD updates monthly, sometimes weekly, sometimes (with continuously-learning ML) effectively continuously. Reviewing every update under the traditional pathway is operationally impossible.

The Pre-Cert thesis was to flip the unit of evaluation: instead of reviewing each product, evaluate the developer's Culture of Quality and Organizational Excellence (CQOE). A developer that meets CQOE expectations — patient safety, product quality, clinical responsibility, cybersecurity responsibility, proactive culture — receives precertification at one of two levels and earns a streamlined or possibly waived premarket review for SaMD products that fit within that precertification.

• July 2017 — FDA announces the Pre-Cert Pilot under the Digital Health Innovation Action Plan.
• Sept 2017 — Nine pilot participants selected: Apple, Fitbit, Johnson & Johnson, Pear Therapeutics, Phosphorus, Roche, Samsung, Tidepool, Verily.
• 2018–2019 — Working Model v0.1, v1.0 published; Excellence Appraisal, Review Pathway Determination, Streamlined Review, Real-World Performance components fleshed out.
• 2019 — FDA Test Plan released, comparing Pre-Cert reviews to traditional 510(k) reviews on the same products.
• 2020 — Test Plan results published; FDA flags statutory and resource limitations.
• Sept 2022 — FDA releases 'Tailored Total Product Lifecycle Approaches and Key Findings' report, formally closes the pilot, and states that Pre-Cert in its piloted form cannot be implemented under current FD&C Act authorities.
• Oct 2023 — FDA establishes the Digital Health Advisory Committee (DHAC) to advise on SaMD, AI/ML, cybersecurity, decentralised clinical trials and digital therapeutics.
• Dec 2024 — FDA finalises the PCCP guidance for AI/ML-enabled devices, which carries forward the Pre-Cert idea of pre-authorising bounded changes.

The 2022 report identifies three blockers. First, statutory authority: the FD&C Act ties premarket review to the device, not to the developer. FDA cannot grant a blanket precertification that exempts future devices from premarket review without new legislation. Second, resources: real-world performance monitoring at the scale Pre-Cert envisioned would require FDA infrastructure that does not exist. Third, the device universe has diverged: cybersecurity, AI/ML and SaMD-as-a-platform raised new questions that the 2017 Pre-Cert model did not address.

FDA was explicit that the pilot was not a failure — the concepts (organisational excellence, streamlined review, real-world performance, total product lifecycle) live on in PCCP, the Cybersecurity Premarket guidance, the AI/ML Action Plan and the DHAC's remit. But the formal Pre-Cert programme has ended.

The Predetermined Change Control Plan (PCCP) is the most concrete survivor. Authorised by FDORA 2022 §3308 and operationalised in FDA's December 2024 final guidance, a PCCP lets a sponsor pre-authorise specific, bounded changes to an AI/ML-enabled device at the time of initial marketing submission. Changes within the authorised PCCP can be implemented without a new submission — the same conceptual move Pre-Cert tried to make at the developer level, now made at the product level.

The Digital Health Advisory Committee, chartered October 2023 and seated through 2024, advises CDRH on SaMD, AI/ML, cybersecurity, decentralised clinical trials and digital therapeutics. It is the standing forum where the post-Pre-Cert questions are now worked.

Total Product Lifecycle (TPLC) framing — that a SaMD's regulatory obligations span design, premarket review, post-market surveillance and end-of-support — is now embedded in CDRH's organisational structure (the Office of Product Evaluation and Quality, OPEQ) and in expectations across submissions.

1. There is no precertification to apply for. Premarket pathway for SaMD remains 510(k), De Novo or PMA based on classification.
2. If your device is AI/ML-enabled and you expect to update the model post-clearance, build a PCCP into the initial submission. The bounded changes you authorise upfront are the changes you can ship without a new 510(k).
3. Treat the Pre-Cert CQOE expectations as the de facto FDA quality benchmark for SaMD developers even though they are not enforceable. They have informed inspector expectations, particularly around software lifecycle (IEC 62304), risk management (ISO 14971), usability (IEC 62366-1) and cybersecurity (Section 524B / 2023 premarket guidance).
4. Plan for real-world performance reporting. Even outside PCCP, FDA expects SaMD sponsors to monitor post-market performance and report material change in performance via MDR and via PCCP commitments where applicable.
5. Engage DHAC discussions. The committee's published advice is the closest current signal to where SaMD regulation is heading.

• 'Pre-Cert is still a pathway.' It is not. The pilot is closed.
• 'Pre-Cert was replaced by PCCP.' Partially — PCCP carries one concept (pre-authorised changes) but operates at the product level and is narrower than Pre-Cert was.
• 'If we got into the pilot, our devices are precertified.' No. No regulatory benefit flowed from pilot participation.
• 'SaMD does not need 510(k) anymore.' False. SaMD that meets the device definition still needs a premarket pathway.
• 'Pre-Cert principles are non-binding so they do not matter.' The CQOE expectations have shaped FDA inspector behaviour and the bar for software submissions even without statutory force.