PCCPPredetermined Change Control Plan

A Predetermined Change Control Plan is a section of a marketing submission — 510(k), De Novo, or PMA — in which a manufacturer specifies, in advance, the modifications they intend to make to an AI/ML-enabled device software function after FDA authorisation, the methodology for implementing those modifications, and an impact assessment. If FDA authorises the PCCP at the time of clearance, modifications later made within the scope of the PCCP do not require a new marketing submission.

The mechanism solves a specific regulatory problem: AI/ML devices benefit from frequent retraining on new data and from refinement of decision thresholds, but every meaningful modification to a cleared device historically triggered the 'significant change' analysis under 21 CFR 807.81 and often required a new 510(k). For an actively maintained ML model, the result was either a backlog of unfiled improvements or a heavy submission cadence. The PCCP shifts the regulatory review to before the changes happen — once — and lets the manufacturer execute within that scope on a normal release cadence.

PCCP authority was added to the Federal Food, Drug, and Cosmetic Act by §3308 of the Food and Drug Omnibus Reform Act of 2022 (FDORA, signed December 29, 2022), which inserted §515C into the FD&C Act. §515C authorises FDA to clear, approve or grant marketing authorisation for a device with a PCCP, and provides that changes consistent with an authorised PCCP do not require a supplemental application.

FDA issued draft guidance in April 2023 ('Marketing Submission Recommendations for a Predetermined Change Control Plan for Artificial Intelligence/Machine Learning-Enabled Device Software Functions') and finalised it on December 4, 2024 with a revised title that drops 'machine learning' from the official name but keeps the AI/ML scope clear in the text. The 2024 final version supersedes the draft.

1. Description of Modifications

An itemised, specific list of the modifications the manufacturer intends to make under the PCCP. Each modification must be defined narrowly enough that a reviewer can evaluate, in advance, what the change is and what its impact will be. Examples FDA accepts: retraining the model on additional data from the same intended population; adjusting a decision threshold within a bounded range; modifying the user interface within specified constraints; expanding compatibility to additional hardware platforms that meet the original compatibility specification.

2. Modification Protocol

For each modification described, the protocol that will be followed to implement, verify, and validate it — data management practices (what data will be used to retrain, how it is collected, how representative it is), re-training methodology, performance evaluation including pre-specified acceptance criteria, update procedures (how the modification is deployed to fielded devices), and any clinical evaluation that will be performed.

3. Impact Assessment

An analysis of the potential impact of each modification on the safety and effectiveness of the device, including the risks introduced or mitigated and how the modification protocol addresses them. The impact assessment is the bridge between what the modification is and how the manufacturer will ensure that the modification, once executed, does not change the safety and effectiveness profile FDA evaluated at clearance.

PCCPs are not a free pass for any future change. FDA's 2024 guidance is explicit: a PCCP must be limited to modifications that the manufacturer can specify in advance with enough detail for FDA to perform a meaningful pre-market review of the modification protocol and the impact assessment.

• Typically eligible: model retraining on new data of the same type and population, threshold tuning within a bounded range, performance improvements that do not change intended use, expansion to compatible hardware platforms, minor UI refinements that do not change clinical decision support.
• Typically NOT eligible: change to intended use, new clinical indication, new patient population, fundamentally new ML architecture, new input data modality, change in workflow that affects clinical interpretation, anything that introduces a new risk not addressed in the original 510(k)/PMA risk file.

Authorising a PCCP shifts the regulatory load from submission filings to internal change control. The manufacturer's QMS now has to demonstrate, on every modification made under the PCCP, that the modification was within scope, that the modification protocol was followed, that the impact assessment held, and that the change was executed under design control (21 CFR 820.30, soon to be ISO 13485 §7.3 under QMSR). FDA inspectors will look at exactly this evidence during routine inspections.

The PCCP is a US-specific mechanism. Other jurisdictions are taking different routes. FDA, Health Canada and the UK MHRA jointly published Good Machine Learning Practice (GMLP) guiding principles in October 2021 — a principles-level alignment, not a regulatory mechanism. Health Canada is piloting predetermined change plans modelled on the FDA approach. The MHRA (UK) published a Software and AI as a Medical Device Change Programme roadmap in 2022.

The EU situation is more complex. Under MDR Article 120 and the AI Act (Regulation EU 2024/1689), most AI/ML SaMDs are simultaneously medical devices (MDR/IVDR scope) and high-risk AI systems (AI Act scope when Class IIa or above). The EU does not yet have a PCCP-equivalent mechanism; significant changes to AI/ML SaMDs require notified body involvement under MDR. Manufacturers planning a global AI/ML release should design the PCCP with US scope and plan parallel MDR change-control workflows for EU markets.