The FDA requires that any Predetermined Change Control Plan (PCCP) contain exactly three components: a Description of Modifications, a Modification Protocol, and an Impact Assessment. This structure comes directly from FDA’s final guidance, Marketing Submission Recommendations for a Predetermined Change Control Plan for Artificial Intelligence-Enabled Device Software Functions — originally issued December 4, 2024 and reissued with updates on August 18, 2025 (docket FDA-2022-D-2628). This guide walks through what belongs in each component, what kinds of modifications FDA will and won’t accept inside a PCCP, and how a PCCP moves through a marketing submission.
Last verified: August 16, 2026, against the FDA guidance document directly (fda.gov/media/166704/download). Because this is an actively developing area of FDA policy — the same guidance has already been revised once since its original issuance — confirm current status on FDA’s AI in SaMD page before relying on any specific detail below for a live submission.
What a PCCP is, in one sentence
A Predetermined Change Control Plan is documentation, submitted as part of a device’s original marketing authorization (PMA, 510(k), or De Novo), that pre-specifies future modifications to an AI-enabled device and the method for making them — so that a manufacturer can implement those specific, pre-authorized changes without filing a brand-new marketing submission each time the model updates. FDA reviews and authorizes the PCCP once, at the time of the original submission; every modification implemented “consistent with the authorized PCCP” afterward is covered by that original authorization.
The statutory basis is Section 515C of the Federal Food, Drug, and Cosmetic Act, added by the Food and Drug Omnibus Reform Act (FDORA). The term FDA uses for the regulated product is AI-DSF (AI-enabled device software function) — broader than “machine learning,” and the guidance applies to modifications implemented automatically (“continuous learning”), manually, or a combination of both.
The three required components of a PCCP
| Component | What it answers | What FDA reviews it for |
|---|---|---|
| Description of Modifications | Exactly which changes to the device are planned | Whether each modification is specific enough to be verified and validated, and whether it stays within the device’s intended use |
| Modification Protocol | How each modification will be developed, validated, and implemented | Data management, re-training, performance evaluation, and update-procedure methods for every modification listed |
| Impact Assessment | What the benefits, risks, and cumulative effect of the plan are | Whether the combination of proposed modifications is unlikely to introduce unmitigated risk |
FDA describes these as “interrelated” — the Impact Assessment exists specifically to tie the other two together, and the guidance recommends a traceability table linking each individual modification to the specific Modification Protocol methods that support it (see Table 1 in the guidance, reproduced in summary below).
1. Description of Modifications
This section lists each individual planned modification and the specific rationale for it. FDA recommends keeping the list limited to modifications that are specific and that can actually be verified and validated — a vague or open-ended description will not clear review. For each modification, the Description of Modifications should state:
- Whether the modification will be implemented automatically (by software, without a human step) or manually (requiring human input, action, review, or decision-making), or a combination of both
- Whether the modification will be applied uniformly across all devices on the market (“homogenous”/global changes) or differently on different devices based on local factors such as a specific clinical site or individual patient (“heterogenous”/local adaptations) — and, for local adaptations, what local factors justify the difference
- The expected frequency of updates — anywhere from an annual or less-frequent cadence (a largely “locked” device) to continuous adaptation during use
- Which labeling sections are anticipated to be affected by the modification
2. Modification Protocol — the four required sub-components
The Modification Protocol is where most of a PCCP’s substance sits. FDA’s guidance identifies four components it expects addressed for every modification listed in the Description of Modifications:
| Sub-component | Core question | Typical content |
|---|---|---|
| (1) Data management practices | Where does the new training/tuning/test data come from, and how is it controlled? | Collection protocols (inclusion/exclusion criteria, prospective vs. retrospective, sampling method), data-quality assurance, reference-standard determination method, and sequestration strategy keeping test data separate from training and tuning data |
| (2) Re-training practices | What parts of the AI model change, and how? | Which processing steps or architecture elements (hyperparameters, layers, nodes) are subject to change, the rationale for each, and the triggers that initiate re-training (e.g., data volume reached, drift detected, a fixed schedule) |
| (3) Performance evaluation | How is the modified device verified against the original and the last-modified version? | Study design, performance metrics, pre-defined acceptance criteria, and statistical tests for each modification — plus an affirmative statement that an unresolved failure against acceptance criteria means the modification is not implemented |
| (4) Update procedures | How is the change deployed, and how are users told? | Deployment mechanics (automatic/manual), labeling updates, user communication and training, and post-market surveillance/real-world monitoring plans |
For a PCCP covering multiple modifications, FDA recommends a traceability table that maps each modification to the specific method used in each of the four Modification Protocol components — for example, “Modification #1: data management Method A, re-training Method D, performance evaluation Method G, update procedure Method J.” This is the single artifact reviewers use to check that nothing in the Description of Modifications is left unsupported by the protocol.
3. Impact Assessment
FDA’s guidance specifies the Impact Assessment must do five things for each marketing submission containing a PCCP:
- Compare the version of the device with each modification implemented individually against the version without any modifications implemented
- Discuss the benefits and risks of each individual modification, including risk of harm and unintended bias
- Discuss how the verification and validation activities in the Modification Protocol continue to reasonably ensure the device’s safety and effectiveness
- Discuss how implementing one modification affects the implementation of another
- Describe the cumulative impact of implementing all the modifications together
For combination products, the Impact Assessment must also address how modifications to the device constituent part (the AI-DSF) affect the drug or biologic constituent part and the combination product as a whole.
What’s in scope for a PCCP — and what isn’t
| Generally appropriate for a PCCP | Generally NOT appropriate for a PCCP |
|---|---|
| Quantitative performance improvements from re-training on new data within the same intended use population and the same type/range of input signal | Modifications that would change the device’s intended use |
| New sources of the same input signal type (e.g., a different make/model of imaging system) or limited new input types (e.g., adding an age field, data normalization) | Modifications that, for a 510(k) device, would make it no longer substantially equivalent to the predicate |
| Compatible hardware, software, or infrastructure updates (updated OS, cloud infrastructure, interoperable devices) | Most changes to the device’s indications for use — FDA says these are generally too hard to assess prospectively (narrow exceptions exist, e.g. authorizing use with an additional compatible device) |
| Authorizing a specific subpopulation within the already-indicated population, based on re-training on a larger dataset for that subpopulation | Minor changes that would not have required a new marketing submission in the first place — those are handled under the Quality System Regulation (21 CFR Part 820), not a PCCP |
| Whatever FDA determines is not appropriate for a specific device’s risk profile — appropriateness is evaluated case by case, not just by modification type |
FDA is explicit that this is a risk-based, device-specific determination: a modification acceptable in one device’s PCCP may not be acceptable in another’s, and some modifications may not belong in any PCCP. The guidance recommends using the Q-Submission Program to get FDA feedback on a proposed PCCP’s scope before filing — FDA will discuss scope in a Pre-Submission meeting, but will not authorize a PCCP there; authorization only happens as part of an actual marketing submission decision.
Where a PCCP fits in a marketing submission
- Eligible submission types: original PMA application, modular PMA (PCCP as its own review module), 180-day PMA supplement, panel-track PMA supplement, real-time PMA supplement (for minor PCCP changes only); traditional or abbreviated 510(k); original De Novo request. A Pre-Submission is not an eligible vehicle for authorizing a PCCP.
- Format: the PCCP should appear as a standalone, titled, version-numbered section of the submission, referenced in the cover letter and table of contents as “Predetermined Change Control Plan.”
- Public disclosure: PCCP details belong in the device’s public-facing summary documents — the PMA summary of safety and effectiveness (SSED), the 510(k) summary, or the De Novo decision summary — including planned modifications, testing methods, validation activities and acceptance criteria, and how users will be told about implemented changes.
- Labeling: device labeling for an AI-DSF with an authorized PCCP should disclose that the device incorporates machine learning and has an authorized PCCP, so users understand the device may update and that updates can change performance, inputs, or use.
What counts as a deviation from an authorized PCCP
Once a PCCP is authorized, FDA expects the manufacturer to implement only the modifications it specifies, and only using the methods in the Modification Protocol. Two situations count as a deviation:
- A modification is implemented that was never included in the authorized PCCP at all
- A modification was included in the PCCP, but was not implemented using the specified Modification Protocol methods
FDA states a deviation could significantly affect the device’s safety or effectiveness and, in that circumstance, would generally cause the device to be considered adulterated and misbranded under sections 501(f)(1) and 502(o) of the FD&C Act — with the associated enforcement exposure under section 301(a). If a deviation occurs, the practical path forward is usually a new marketing submission, either to authorize a modification to the PCCP itself or to authorize the modified device directly.
Modifying a PCCP after it’s authorized
FDA generally treats a change to an already-authorized PCCP itself as significant enough to require a new marketing submission — typically a PMA supplement, a traditional 510(k), or (where the change is to the manufacturer’s own device and PCCP using well-established evaluation methods) a special 510(k). FDA recommends including a summary of the changes and, where practicable, a tracked-changes version compared to the currently authorized PCCP. FDA has said it intends to focus review on the parts of the device that are most significantly modified, not re-litigate the whole submission.
Frequently asked questions
Is a PCCP required for every AI-enabled medical device?
No. A PCCP is optional — it is a mechanism a manufacturer can choose to use for a device it plans to modify over time. A device without a PCCP simply follows the standard rule: any modification that could significantly affect safety or effectiveness, or that changes the intended use, needs its own new marketing submission (PMA supplement, 510(k), etc.) before it’s implemented.
Does a PCCP replace normal quality-system change control?
No. Modifications made under an authorized PCCP still must be documented consistent with the manufacturer’s quality system under 21 CFR Part 820 — including design-control review and approval and recording the change in the device master record. The PCCP addresses whether a new marketing submission is needed; it doesn’t remove the manufacturer’s underlying quality-system obligations.
Can a PCCP cover modifications to a device’s indications for use?
Generally not. FDA states that most modifications to indications for use would be difficult to assess prospectively within a PCCP, though it acknowledges narrow exceptions — for example, a change specifying use of the device together with an additional device or component. FDA recommends discussing any proposed indications-for-use modification through the Q-Submission Program before including it in a PCCP.
Does FDA allow PCCPs for modifications that happen automatically, without human review?
Yes, FDA will consider PCCPs covering automatically implemented modifications (“continuous learning”), while noting this carries additional complexity. FDA recommends manufacturers clearly define the boundaries or guardrails around the range of automatic updates and discuss the approach through the Q-Submission Program.
What happens if a modification under a PCCP fails its performance evaluation?
The Modification Protocol should affirmatively state that an unresolved failure against the pre-defined acceptance criteria means that specific modification is not implemented, and the failure is recorded. A failure is not “unresolvable” if a root-cause analysis shows it isn’t related to the PCCP itself — in that case, testing can be repeated.
Is FDA’s PCCP guidance final, or still draft?
Final. It was originally issued December 4, 2024, and FDA issued a revised version of the same final guidance on August 18, 2025 (still under docket FDA-2022-D-2628). This is distinct from FDA’s broader, still-draft guidance on AI-enabled device lifecycle management and marketing submissions generally — see CASRAI’s FDA AI guidance overview for how the PCCP guidance fits into FDA’s wider AI regulatory framework, including the separate CDER/CBER track for AI used in drug and biologic development.
Related CASRAI guides
- FDA AI Guidance: The Regulatory Framework for AI in Drug Development and Medical Devices — the two-track overview (CDRH device track and CDER/CBER drug/biologic track) that this guide’s PCCP framework sits inside
- Software as a Medical Device (SaMD): Definition, Classification, and Regulatory Pathways — the underlying device classification an AI-DSF with a PCCP must still satisfy
