FDA's predetermined change control plan (PCCP) guidance for AI-enabled medical devices, explained

AI-enabled device development is iterative by nature — a manufacturer may want to retrain or tune a model's performance after it's already on the market, which under FDA's normal process would mean a new marketing submission for each meaningful change. FDA's guidance states a PCCP is intended to let manufacturers plan for such modifications while still providing a reasonable assurance of safety and effectiveness, "without necessitating additional marketing submissions for implementing each modification described in the PCCP" — authorizing the change process itself, up front, rather than authorizing each individual future change one at a time.

FDA's guidance recommends a PCCP comprise at least three sections:

A PCCP is reviewed and authorized as part of the same marketing submission as the device itself — FDA does not authorize a PCCP separately during the pre-submission (Q-Submission) process, though manufacturers are encouraged to use a Q-Submission to get FDA feedback on a planned PCCP before filing it formally.

The guidance applies across the De Novo, premarket approval (PMA), and premarket notification (510(k)) pathways — whichever route a given AI-enabled device software function uses to reach market. It replaces an April 2023 draft guidance that covered only machine-learning-enabled devices; the final version broadens scope to all AI-enabled device software functions (AI-DSFs), aligning FDA's "artificial intelligence" and "machine learning" definitions with Executive Order 14110 (30 October 2023) and FDA's own September 2024 Digital Health and Artificial Intelligence Glossary. FDA is explicit, though, that most PCCPs it has reviewed in practice remain for the machine-learning subset of AI-DSFs specifically — devices that benefit from preapproved modifications tied to continued learning on new data.

A PCCP addresses planned AI modifications; it does not substitute for the separate cybersecurity content Section 524B of the FD&C Act already requires in a cyber device's premarket submission — an SBOM, a vulnerability-monitoring plan, and a secure-update process, covered in our guide to FDA premarket cybersecurity for medical devices. An AI-enabled connected device is very often a cyber device under that separate definition too, which means a manufacturer can need both a PCCP (for the AI modification pathway) and the full Section 524B cybersecurity package (SBOM, disclosure process, patch plan) in the same submission, each reviewed against its own guidance. FDA's older postmarket cybersecurity guidance and its QMSR under 21 CFR Part 820 continue to apply after clearance regardless of whether a PCCP is in place.

FDA's guidance reiterates that labeling for an AI/ML-enabled device with an authorized PCCP should clearly state that the device incorporates machine learning and operates under an authorized PCCP — so a clinician or user understands the device may receive software updates, implemented automatically ("continuous learning"), manually, or a mix of both, that change its performance, inputs or use after the device first reaches the field. This is a continuing-transparency obligation that runs alongside the PCCP's technical content, not a one-time disclosure made only at clearance.

Manufacturers selling an AI-enabled medical device into both the US and EU face a structurally similar but legally separate problem on the EU side: the EU MDR's own cybersecurity expectations under Annex I, plus the EU AI Act's cybersecurity-specific requirements for high-risk AI systems covered in our guide to the EU AI Act's cybersecurity requirements. Neither EU regime has a direct PCCP equivalent today — a planned post-market AI modification in the EU still runs through MDR's own significant-change assessment rather than a pre-authorized change-control envelope — so a PCCP-covered US submission does not automatically clear the equivalent EU bar for the same planned modification.

SoftWSP builds SBOMs from AI-enabled device firmware, matches components against known vulnerabilities, and helps structure the vulnerability-monitoring and modification-impact documentation an AI-enabled device submission needs: see device & firmware security services and PSIRT as a service.

This guide is general information, not legal or regulatory advice. It does not constitute FDA regulatory or legal counsel; confirm the current guidance document and submission requirements directly with FDA before relying on them.