A predetermined change control plan (PCCP) is a section of an FDA marketing submission that describes specific changes a manufacturer plans to make to a device after authorization, how it will develop and validate them, and how it will assess their impact. Once the FDA authorizes the plan, changes made in accordance with it do not require a new 510(k), De Novo, or PMA supplement. For AI-enabled software as a medical device (SaMD), this means a model can be retrained or extended within agreed-upon limits without returning to the FDA for every update.
PCCPs have a legal basis in section 515C of the FD&C Act, and FDA’s final PCCP guidance for AI-enabled device software functions explains what to submit. Few companies use them yet: a 2026 study reported in RAPS found that 43 of 794 AI-enabled devices authorized from 2023 to 2025, or 5.4%, had a PCCP.
This guide covers what goes in a PCCP, how it fits a 510(k), and examples from FDA’s guidance and from cleared devices.
Where PCCPs come from
Date | Milestone |
|---|---|
December 29, 2022 | FDORA (section 3308 of the Consolidated Appropriations Act, 2023) adds section 515C to the FD&C Act, giving PCCPs a statutory basis for PMA and 510(k) devices |
April 2023 | FDA publishes a draft PCCP guidance for AI/ML-enabled device software functions |
October 2023 | FDA, Health Canada, and the UK MHRA publish five guiding principles for PCCPs for machine learning-enabled devices |
August 2024 | FDA publishes a draft PCCP guidance for all medical devices, not only AI. It was still a draft as of October 2026 |
December 4, 2024 | FDA finalizes the AI PCCP guidance, broadening its scope from machine learning to AI-enabled software functions |
August 18, 2025 | FDA reissues the final guidance, with the same title and structure |
The statute names PMAs and 510(k)s. FDA’s guidance adds that a PCCP can also be established through a De Novo request, in which case FDA would write special controls that may include PCCP-specific requirements.
The guidance applies to AI-enabled device software functions in both SaMD and software in a medical device (SiMD). It covers changes implemented manually and automatically. Changes to non-AI devices fall under the separate 2024 draft guidance for all devices.
Why PCCPs matter for AI SaMD
AI models are rarely finished at launch. Teams want to retrain on more data, support new scanners or sensors, or reduce false alarms once real-world performance data comes in. Without a PCCP, each change that could significantly affect safety or effectiveness generally needs a new 510(k), which can take months.
A PCCP moves that review to the front. FDA evaluates the planned changes and the method for validating them, along with the original device; then the manufacturer implements the changes according to the plan. The tradeoff is more work up front: a PCCP has to be specific enough for FDA to judge the risk of every change it covers.
What goes in a PCCP
FDA’s guidance says a PCCP should include three components.
Component | What it answers | What to include |
|---|---|---|
Description of Modifications | What will change? | Each planned modification, its rationale, whether it is implemented manually or automatically, and whether it applies globally or to specific sites or users |
Modification Protocol | How will you develop, validate, and release it? | Four parts: data management practices, re-training practices, performance evaluation, and update procedures |
Impact Assessment | What could go wrong, and how is it controlled? | Benefits and risks of each modification, the risk controls, and how the modifications interact with each other |
The Modification Protocol in detail
The Modification Protocol is where most of the effort goes because it is what lets the FDA trust that changes it will never see.
- Data management practices. How new training and test data will be collected, labeled, and kept separate, and how they will represent the intended-use population.
- Re-training practices. What parts of the model may change, such as weights, architecture, or preprocessing, and what triggers retraining.
- Performance evaluation. The test methods, metrics, and acceptance criteria each modification must meet, including subgroup analysis.
- Update procedures. How a validated change is deployed, how users are told about it, how the software is verified, and how real-world performance is monitored after release.
FDA recommends tracing each modification in the Description of Modifications to the parts of the Modification Protocol that support it. A traceability table is the clearest way to show that link.
The five guiding principles
The 2023 guiding principles from FDA, Health Canada, and the MHRA summarize what reviewers look for. A PCCP should be:
- Focused and bounded: specific changes within the device’s intended use
- Risk-based: designed and implemented using risk management
- Evidence-based: supported by scientifically and clinically justified methods and metrics
- Transparent: clear to users about what changed and how
- Total product lifecycle (TPLC) oriented: considering the device across its full life, including postmarket monitoring
What a PCCP can and cannot cover
Changes under a PCCP must keep the device within its intended use, and FDA generally expects them to stay within its indications for use.
Generally appropriate for a PCCP | Generally needs a new submission |
|---|---|
Retraining on new data from the same intended population to improve performance | A new intended use |
Supporting new input sources of the same type, such as additional scanner or stethoscope models | A new clinical claim, such as adding a predictive or diagnostic output |
Limited changes for specific subpopulations, supported by data | Changes that would take the device outside its indications for use |
Use with an additional device or component, where the plan specifies the validation | Changes to the PCCP itself, which may be handled through a Special 510(k) |
How a PCCP fits a 510(k)
1. Talk to FDA first
FDA “highly encourages early engagement regarding a proposed PCCP,” usually through a Pre-Submission (Q-Sub). A Pre-Sub can give feedback, but “FDA does not authorize a PCCP in a Pre-Submission.” Authorization happens only in the marketing submission.
2. Include the PCCP in the 510(k)
FDA recommends that the PCCP be a standalone section titled “Predetermined Change Control Plan,” listed in the table of contents and mentioned in the cover letter. FDA considers the PCCP “part of the technological characteristics of the device,” so it is reviewed as part of the substantial equivalence decision. The statute requires that devices changed under a PCCP “remain substantially equivalent to the predicate.”
3. Authorization
“A PCCP is authorized as part of the device marketing authorization.” The clearance letter cites the PCCP by title and version number, and the public 510(k) summary should describe it.
4. Implement changes according to the plan
Changes made in accordance with the authorized PCCP do not require a new 510(k). They still go through your quality system: design controls, verification and validation, and records showing each change met the Modification Protocol’s acceptance criteria.
5. Update the labeling
FDA recommends that labeling state that the device includes machine learning and has an authorized PCCP. After each change is implemented, the labeling should describe it and how users are told. FDA also recommends that labeling not describe modifications that have not yet been implemented.
6. Know the predicate rule
A device with an authorized PCCP can serve as a predicate, but only for a specific version. Under the statute, “only the version of the device cleared or approved, prior to changes made under the predetermined change control plan, may be used” as a predicate. A version changed under the PCCP becomes an eligible predicate only after it is cleared in a later submission of its own.
7. Changes outside the plan need a new submission
If a change does not fit the authorized PCCP, the usual modification rules apply. Exo’s AI Platform 2.2 (K260217, February 2026) is an example: the device already had a PCCP, but the changes in that submission were “outside the scope of the PCCP,” so they went through a new 510(k).
PCCP examples
Examples from FDA’s guidance
Appendix B of the guidance walks through six example scenarios: patient monitoring software, skin lesion software, ventilator settings software, an image acquisition assistance device, feeding tube placement radiograph analysis software, and an optical imaging system co-packaged with an imaging drug. Two show the line clearly:
- Patient monitoring software. Retraining the model to reduce false alarms while keeping sensitivity within a set non-inferiority margin falls within a PCCP. Adding a new predictive claim needs a new submission.
- Optical imaging system with an imaging drug. Retraining for faster lesion detection fits within a PCCP. Changing the drug’s dosing regimen needs a new submission.
Cleared devices with a PCCP
Device | Company | Submission | Decision | What the PCCP covers |
|---|---|---|---|---|
AI Platform 2.0 | Exo Imaging | August 5, 2024 | Planned changes to its ultrasound AI tools | |
ArteraAI Prostate | Artera | Announced August 13, 2025 | Validating additional slide scanners | |
eMurmur Heart AI 2.2 | CSD Labs | December 19, 2025 | Adding new stethoscope models | |
qXR-Detect | Qure.ai | January 16, 2026 | Retraining on US chest X-ray data and replacing the CNN encoder with a Vision Transformer | |
Ejection Fraction AI | Clarius | March 2, 2026 | Planned model updates, reviewed and cleared with the device |
These examples show the most common PCCP patterns: new input hardware, retraining on more data, and architecture changes with fixed acceptance criteria. Qure.ai’s plan stands out because it covers a change to the model architecture, not only new training data.
FDA’s list of AI-enabled medical devices lacks a PCCP filter, so the only way to find these devices is to read the decision summaries. For broader trends, see our analysis of FDA AI medical device authorizations.
Common PCCP mistakes
- Plans that are too broad. “We may retrain the model to improve performance” is not reviewable. Name the change, the data, the metrics, and the acceptance criteria.
- Acceptance criteria without subgroups. Overall accuracy can hide drops in specific populations. Set criteria for the subgroups that matter to your intended use.
- No link between modifications and protocol. Every planned change should trace to the data, retraining, testing, and update steps that support it.
- Ignoring how changes interact. The Impact Assessment should cover combined effects, not only each change alone.
- Forgetting the user. Plan how users will learn about each update, and keep labeling in step with what has actually been implemented.
- Treating the PCCP as only a regulatory document. A PCCP is only as good as the quality system that implements it.
Pre-submission checklist
- Each modification is listed with its rationale and whether it is manual or automatic
- Each modification traces to data management, retraining, performance evaluation, and update procedures
- Acceptance criteria are set before any data is collected, including subgroup criteria
- Test data stays separate from training data, with a plan to prevent reuse
- The Impact Assessment covers each change and how the changes interact
- The labeling plan covers the PCCP statement and how users are told about updates
- The PCCP is a standalone section, listed in the table of contents and the cover letter
- Feedback from a Pre-Submission is reflected in the plan
How a PCCP fits your quality system
A PCCP sets the rules; your quality management system proves you followed them. Under the QMSR, effective February 2, 2026, each change made under a PCCP still requires design and development controls, verification and validation records, and risk management updates.
- Software lifecycle. Run each change through your IEC 62304 process, including regression testing and release records.
- Risk management. Update the ISO 14971 risk file for each modification, using the Impact Assessment as a starting point.
- Design documentation. Keep the evidence for each change in the design and development file, so an inspector can trace it from the PCCP to the released version. See our guide to the design history file for medical device software.
- Postmarket monitoring. Watch real-world performance, and use the data to decide when the next planned change is needed.
Automated traceability helps here. When requirements, risks, tests, and releases are linked in one system, showing that a change followed the plan becomes a matter of reporting rather than a project. See how automated documentation supports that.
Beyond the US
- Canada and the UK co-published the 2023 guiding principles with FDA.
- The EU has no PCCP mechanism under the MDR or IVDR. The EU AI Act, in Article 43(4), states that changes to a high-risk AI system that keeps learning are not a substantial modification if the provider sets them out in advance during the initial conformity assessment and documents them in the technical documentation. MDCG 2025-6, published in June 2025, states that such predetermined changes should be documented in the technical documentation prior to conformity assessment.
For more on the differences between the two systems, see US and EU SaMD regulations.
Frequently asked questions
What is a predetermined change control plan?
A predetermined change control plan (PCCP) is part of an FDA marketing submission that describes specific changes a manufacturer plans to make to a device, how it will develop and validate them, and how it will assess their impact. Once FDA authorizes it, changes made according to the plan do not need a new submission.
What are the three components of a PCCP?
FDA’s guidance lists three: a Description of Modifications, a Modification Protocol, and an Impact Assessment. The Modification Protocol covers data management practices, re-training practices, performance evaluation, and update procedures.
Can a PCCP be included in a 510(k)?
Yes. Section 515C of the FD&C Act allows PCCPs in 510(k)s and PMAs, and FDA’s guidance says they can also be established through a De Novo request. FDA reviews the PCCP as part of the device’s technological characteristics, and the authorized plan becomes part of the clearance.
Can a device modified under a PCCP be used as a predicate?
Only the version cleared before any PCCP changes can be used as a predicate. A version changed under the PCCP becomes an eligible predicate only after it is cleared in a later submission of its own.
Is FDA’s PCCP guidance final?
Yes. FDA finalized the PCCP guidance for AI-enabled device software functions on December 4, 2024, and reissued it on August 18, 2025. A separate draft guidance on PCCPs for all medical devices, published in August 2024, was still a draft as of October 2026.
Build PCCP-ready AI SaMD with Sequenex
A PCCP works only when the software and the records behind it can carry out the plan. That means modular architecture that isolates the model, automated verification and release pipelines, and traceability from each planned change to its test evidence.
Sequenex builds that software and documentation for medical device companies under a design-first, IEC 62304 process. Your team owns the AI model; we build the regulated software, pipelines, and design records around it, using AI-assisted engineering to speed up implementation and traceability checks. See our SaMD development services or contact us to discuss your project.
