Small Change: FDA’s Final Predetermined Change Control Plan (PCCP) Guidance Ditches ML and Adds Some Details, But Otherwise Sticks Closely to the Draft

FDA recently released its final guidance for Predetermined Change Control Plans (PCCPs) for Artificial Intelligence-Enabled Device Software Functions (AI-DSF). The final guidance hasn’t changed much from the draft guidance with respect to the type of modifications FDA considers applicable for a PCCP and the required components of a PCCP (see our prior blog post on the draft guidance here).  The most noteworthy change is the title, which has been broadened to include AI-DSF, not just the subset of AI known as machine learning (ML). FDA defines Artificial Intelligence (AI) as a “machine-based system that can, for a given set of human-defined objectives, make predictions, recommendations, or decisions influencing real or virtual environments.”  Machine Learning is defined as a “set of techniques that can be used to train AI algorithms to improve performance at a task based on data.”  Consistent with the title change, the draft guidance’s references to ML-DSF have been replaced with AI-DSF,  which is now defined as a “device software function that implements an AI model” and omits references to ML models and techniques.

As we’ve previously blogged, a PCCP is a mechanism established by Congress under the Food and Drug Omnibus Reform Act (FDORA) to streamline post-market changes to medical devices. Sponsors can include a PCCP as part of their pre-market submission that describes an approach for making certain types of device modifications after the device is marketed. If FDA agrees to the PCCP, such changes can be made without a supplemental marketing submission.

While a PCCP can address many types of post-market device changes, FDA specifically recognizes that software development is an iterative process, and software developers continually try to improve and update devices. Therefore, this guidance builds on FDA’s commitment to “develop and apply innovative approaches to the regulation of [AI-enabled devices].”

Scope of Permissible PCCPs

The final guidance describes the scope of post market modifications to AI-DSF that are appropriate to include in a PCCP. In general, a modification must be within the device’s intended use and maintain the indications for use in order to be included in a PCCP. The final guidance does leave some ‘wiggle room,’ stating that “certain modifications to the indications for use” may be appropriate for inclusion in a PCCP. Examples of modifications to AI-DSF that may be appropriate for a PCCP include modifications to inputs, input sources, compatibility, and interoperability. However, the guidance states that FDA will evaluate a PCCP on a case-by-case basis, in light of the “benefit-risk profile” of the specific device when deciding if the proposed modification can be authorized in the marketing application, noting that “certain modifications that may be appropriate for inclusion in a PCCP for one device may not be appropriate for inclusion in a PCCP for another device.” The guidance encourages sponsors to engage with FDA using the Q-Submission Program prior to submitting a PCCP in order to obtain FDA feedback on if the proposed modification is suitable for inclusion in a PCCP and what information the PCCP will need to include.

Consistent with the draft guidance, the final guidance takes the position that PCCPs are only appropriate for the following submission types:

• Pre-market approval (PMA): Original, Modular, 180-day PMA supplement, Panel Track PMA supplement, Real-Time PMA Supplement (only when FDA agrees the review can be achieved in real-time)
• De Novo
• 510(k): Traditional and Abbreviated

Unfortunately, the final guidance continues to exclude Special 510(k)s (see our prior blog post here). In fact, eSTAR does not allow a PCCP to be included in a Special 510(k); attempting to do so results in the message  “if you are establishing a PCCP this should not be done in a Special 510(k).”  Modifications to previously authorized PCCPs can be submitted via a Special 510(k), and eSTAR recommends that the manufacturer submit a clean copy and redline of the PCCP as an attachment.

The final guidance emphasizes the importance of having a quality system in place, stating that FDA “may under certain case-by-case circumstances withhold clearance of a PCCP submitted in a 510(k) based on findings in the regulatory history of the manufacturer that demonstrate failure to comply with [Quality System regulation (QSR)].”  An analogous limitation is contained in the Special 510(k) guidance, which states that a Special 510(k) should not be submitted if the manufacturer has received a violative inspection report following a recent QS inspection that identified “observations related to design controls that are relevant to the design changes.” We wonder if the Agency will similarly reject a PCCP if a manufacturer has demonstrated a failure to comply with design controls, especially those related to design changes.

Components of a PCCP

The guidance identifies the following elements for inclusion in a PCCP:

• Modification Description
• Modification Protocol
• Impact Assessment

Modification Description

The Modification Description should describe the planned modification and the performance specifications. FDA recommends including only a “limited number” of modifications in the PCCP. The description should be sufficiently specific to allow verification and validation as defined in the Modification Protocol. The manufacturer should, in addition to stating whether the modification will be implemented manually or automatically, include details such as:

• End user actions needed, if any to implement the change,
• Timing of implementation,
• Extent of implementation in the install base, and
• Include references to expected labeling changes.

Modification Protocol

The Modification Protocol should describe the methods for developing, verifying, validating, and implementing the modifications described in the Modification Description. Manufacturers should develop the Modification Protocol consistent with their quality system and should follow their risk management processes. FDA expects four elements to be included in a Modification Protocol:

• Data management practices,
• Re-training practices,
• Performance evaluation protocols, and
• Update procedures.

FDA may request additional information during the review of the PCCP.

For most manufacturers, verification and validation protocols may only cover performance evaluations against pre-determined acceptance criteria, and they may need to pull data management practices and re-training practices from their development plans. Verifying and validating update procedures may be in a separate protocol from performance testing and should be included in the Modification Protocol section of the PCCP. Update practices and training of end users also need to be addressed.

Data management practices should include how the manufacturer plans to obtain and use training, tuning, and test data to support each AI-DSF modification. FDA provides definitions for the three datasets. Although data scientists sometimes refer to the tuning dataset as the ‘validation dataset,’ FDA encourages using terminology consistent with the Agency’s Artificial Intelligence Glossary.  Test data should be independent of the training and tuning data and come from multiple sites representing the intended use population.

Re-training practices should identify the “objective of the re-training process,” describe the AI model and the AI-DSF modification, and identify any “triggers for re-training.”

Performance evaluation protocols should include the planned verification and validation activities for each AI-DSF modification separately and, in total, including all planned modifications. This will ensure each AI-DSF modification does not have an adverse impact on the overall device performance. The Modification Protocol should “affirmatively state that if there is an unresolvable failure in performance evaluation for a specific modification (e.g., the predefined acceptance criteria for a specific modification are not met), the failure(s) will be recorded, and the specific modification(s) will not be implemented.” The final guidance clarifies that only an “unresolvable failure” should preclude implementation; if the failure is resolvable the modification may be implemented after retesting. Additionally, a failure is NOT considered unresolvable “if a root cause analysis of the failure reveals it is not related to specific aspects of the PCCP.”  In such cases, performance testing may be conducted again.

The update procedures should include how the AI-DSF modifications will be implemented and communicated to end users. The update procedures should include plans for required labeling changes and training provided to end users. The final guidance added information on updating the UDI as part of the planned labeling changes when there is a new version of the device. In addition, the final guidance recommends the Modification Protocol include the manufacturer’s “post-market surveillance plans and procedures,”  which reflects a change from the draft guidance’s recommendation for “real-world monitoring.” The final guidance adds that such post-market surveillance plans “may include real-world monitoring and notification requirements if the device does not function as intended pursuant to the authorized PCCP.” Post-market surveillance plans and procedures (PMS) are a requirement under ISO 13485 which will be adopted into FDA’s Quality Management System Regulation in 2026. PMS requires manufacturers to gather information from various sources, evaluate the data for trends, and integrate the data into product development, risk management and design updates. This change in language seems to suggest a more formal approach to monitoring to ensure the modified AI-device remains safe and effective.

FDA recommends that the PCCP include a traceability table containing each proposed AI-DSF modification and the location within the Modification Protocol for each of the four elements described above.

Impact Assessment

The Impact Assessment documents the benefits and risks of implementing the AI-DSF and the mitigations for the identified risks. The Impact Assessment should:

1. Compare the version of the device with each modification implemented individually to the version of the device without modifications implemented;
2. Discuss the benefits and risks, including risks of harm and unintended bias, of each individual modification;
3. Discuss how the verification and validation activities proposed within the Modification Protocol continue to reasonably ensure the safety and effectiveness of the device;
4. Discuss how the implementation of one modification impacts the implementation of another; and
5. Describe the cumulative impact of implementing all modifications.

The final guidance goes beyond considerations of harm and includes unintended bias when discussing the benefits and risks of the modification. The guidance states that the Impact Assessment can be a stand-alone document, incorporated into the manufacturer’s Risk Assessment, or included in the Modification Protocol.

The final guidance includes references to combination products and indicates the Impact Assessment should address the impact of the device modification to the biologic or drug constituent part. In fact, the final guidance includes an example of a combination product in Appendix B.

Post Authorization

When FDA grants marketing authorization for a device that includes a PCCP, the PCCP will be referenced by title and version number in the authorization letter. Details of the PCCP will be publicly available (i.e., PMA summary of safety and effectiveness document (SEED) and approval order, 510(k) Summary, De Novo decision summary). FDA recommends that the following information be made public regarding the PCCP as appropriate: planned modifications, testing methods, validation activities and performance requirements to meet before implementation, and means by which users will be informed of the implementation of the modification.

Modifications that deviate from the authorized PCCP and are implemented without a market authorization may render the device “adulterated and misbranded” and result in enforcement action by FDA, including “seizure on injunction.”

If you need to modify the PCCP, you must submit a revised PCCP to the FDA for authorization prior to implementing the modification. As stated previously, when submitting a revision to an authorized PCCP, you should provide both a clean copy and redline of the revised PCCP and also include a reference to the submission that authorized the prior version of the PCCP.

The final guidance hasn’t changed much from the draft guidance with respect to the type of modifications eligible for a PCCP or the required components of a PCCP. Consistent with the draft guidance, it contains a significant level of detail on the fundamental principles that should govern the design and development of AI-based software. The placement of this information is odd and would seem to fit better in the recently released draft guidance on AI-DSFs: Lifecycle Management and Marketing Submission Recommendations (Lifecycle Management guidance), which we blogged about here. Unlike the PCCP guidance, which is focused specifically on post-market changes, the ostensible focus of the Lifecycle Management guidance should be a comprehensive foundation for the design and development of AI-enabled devices. Manufacturers of AI-based software would expect to find this level of detail in the Lifecycle Management guidance would not think to look for additional details in the PCCP guidance. Ideally, the Lifecycle Management guidance would have been finalized before the PCCP guidance, however since that is not the case, it would seem to make sense to transfer design and development information from the PCCP guidance into the Lifecycle Management guidance or, at the very least ensure the Lifecycle Management guidance cross-references the PCCP guidance, where applicable. In HPM’s next blog we will take a deep dive into setting up a successful data management strategy, which is critical to achieving market authorization for both the device and any associated PCCPs.