How does a PCCP change the traditional 510(k) or De Novo review process?

Without a PCCP, any modification to an AI/ML model that affects its inputs, algorithm, or performance characteristics typically requires a new or supplemental submission before the change can be marketed. With an authorized PCCP, the manufacturer can implement the described modifications and update labeling without a new submission, provided the change stays within the pre-specified modification protocol and passes the pre-specified verification methods. This shifts FDA's review burden earlier, into scrutinizing the plan's modification protocol and impact assessment, rather than reviewing each individual model update after the fact.

How does a PCCP relate to Good Machine Learning Practice?

Good Machine Learning Practice principles, covering data management, model training, and performance monitoring, inform how a manufacturer designs the modification protocol described in a PCCP, since FDA expects the plan to reflect sound methodology for retraining and revalidating models. A PCCP is a regulatory submission mechanism, while Good Machine Learning Practice is a set of engineering and quality principles, and a weak GMLP foundation typically results in a PCCP that FDA finds insufficiently specific to authorize. Manufacturers should treat GMLP as the technical basis that makes a defensible PCCP possible, not as a separate or optional exercise.

What happens if a real-world model update falls outside the authorized PCCP?

If a proposed change exceeds the boundaries of the modification protocol, such as a new intended use, a materially different algorithm architecture, or performance drift outside pre-specified acceptance criteria, the manufacturer must submit a new marketing submission rather than implement the change under the existing PCCP. Continuing to deploy an out-of-scope change under the PCCP's authority would constitute an unauthorized modification and expose the manufacturer to regulatory action. This is why FDA guidance stresses that the pre-specified performance boundaries and monitoring plan within a PCCP must be conservative and well justified, since exceeding them mid-lifecycle forces a submission the manufacturer was trying to avoid.

Back to AI/ML Devices Deep Dive

Software & AIAI / ML in Devices Software Lifecycle Global MarketsPCCP

Predetermined Change Control Plan

FDA mechanism to pre-authorize specific modifications to AI/ML-enabled devices.

Reviewed by Christian Espinosa, Founder, Blue Goat CyberLast reviewed September 19, 2026

Definition

A Predetermined Change Control Plan (PCCP) is a document, included in a marketing submission, that describes planned modifications to an AI/ML-enabled device, the methods used to develop, validate, and implement those modifications, and the impact on the device. A PCCP has three parts: a description of modifications, a modification protocol (data management, retraining, performance evaluation and update procedures) and an impact assessment. Once authorized, changes made in line with the plan do not need a new submission. FDA finalized its guidance on PCCPs for AI-enabled device software functions in December 2024, and section 515C of the FD&C Act, added in 2022, gives FDA the authority to approve them for all devices.

What the regulation says

Section 515C of the Federal Food, Drug, and Cosmetic Act, added by the Consolidated Appropriations Act, 2023, signed into law on December 29, 2022, provides FDA’s statutory authority for PCCPs. That authority is not limited to AI-enabled devices. FDA’s final guidance, Marketing Submission Recommendations for a Predetermined Change Control Plan for Artificial Intelligence-Enabled Device Software Functions, issued in December 2024, explains its recommendations for this specific technology. The guidance is nonbinding and describes how manufacturers should present a PCCP for review within a marketing submission. For MedTech manufacturers, the recommended PCCP contains three connected elements: a description of specific planned modifications; a modification protocol covering data management, retraining, performance evaluation, and implementation procedures; and an impact assessment addressing benefits, risks, and interactions between modifications. Authorization is not blanket permission to change a device. Modifications implemented consistently with the FDA-authorized PCCP can proceed without the otherwise-required new marketing submission. Changes outside its scope must be assessed under the applicable submission requirements. Manufacturers remain responsible for documenting implementation, maintaining appropriate quality controls, and meeting applicable postmarket obligations.

What this means in practice

PCCPs let manufacturers update AI/ML models within an authorized envelope without a new submission, while preserving safety and effectiveness controls.

Examples

A diagnostic AI that identifies anomalies in medical images has a PCCP to allow for retraining of its underlying model with new, anonymized patient data to improve its sensitivity for rare conditions.
An AI-powered surgical planning tool has a PCCP to incorporate minor algorithm adjustments based on performance data gathered from a broader user base, without changing its intended use.
A continuous glucose monitoring system with an AI component has a PCCP enabling routine updates to its prediction algorithm as new evidence on metabolic responses becomes available, ensuring improved accuracy over time.

Use cases

1 scenario

Continuous learning chest-X-ray triage SaMD

ML & RA team

The sponsor includes a Predetermined Change Control Plan in the 510(k): allowed modifications (retraining cadence, new sites), the protocol (data governance, performance thresholds), and impact assessment.

OutcomeAfter clearance, the team retrains quarterly under the PCCP without filing a new submission for each update.

Common pitfalls

•Misunderstanding that a PCCP grants blanket approval for any change; only modifications explicitly covered and detailed in the authorized plan are permitted without new submission.
•Failing to adequately specify validation methods or performance evaluation procedures in the PCCP, leading to potential FDA rejection or challenges during post-market implementation.
•Assuming PCCPs eliminate all regulatory oversight for AI/ML updates; significant deviations or changes outside the scope of the authorized plan still require new regulatory review.
•Underestimating the level of detail required in the PCCP, particularly regarding data management and retraining protocols, which are crucial for successful implementation.

Frequently asked questions

A PCCP can pre-authorize specific, well-defined modifications to an AI/ML-enabled device, such as retraining a model on new data within a defined performance envelope or updating an algorithm's input data sources, along with the verification and validation methods that will be used to confirm each modification is safe and effective. It cannot be used as a blanket authorization for open-ended or unspecified future changes, and any modification that falls outside the described modification protocol or that changes the device's intended use still requires a new marketing submission. FDA guidance emphasizes that the plan must describe the modifications, the methodology for implementing them, and the impact assessment in enough detail to be independently evaluated at the time of the original submission.

Cross-references

Used by

Things that build on this term.

Editor's picks

· Hand-selected related concepts

Software & AI

Good Machine Learning Practice(GMLP)

Guiding principles for the development of AI/ML-enabled medical devices.

Software & AI

Software as a Medical Device(SaMD)

Software intended for medical purposes that performs without being part of a hardware device.

SaMD & AI/ML Devices

· From this learning path

Software & AI

Clinical Decision Support(CDS)

Software providing healthcare professionals with knowledge and patient-specific information.

Adjacent lesson

Software & AI

Software in a Medical Device(SiMD)

Software embedded in or required to operate a hardware medical device.

Software & AI

Software of Unknown Provenance(SOUP)

Software not developed for medical device use, or lacking adequate development records, incorporated into a device.

Software & AI

Software Safety Classification

IEC 62304 classes A, B, C reflecting potential harm from software failure.

Software Team Onboarding

· From this learning path

Standards

IEC 62304

Lifecycle requirements for medical device software.

Cybersecurity

Threat Modeling

A structured analysis that identifies how an attacker could compromise a medical device and what controls mitigate each threat.

Adjacent lesson

Cybersecurity

Section 524B of the FD&C Act(524B)

The federal statute that gives FDA explicit premarket authority over cybersecurity for cyber devices.

Cybersecurity

Secure Product Development Framework(SPDF)

A documented, risk-based set of processes that build cybersecurity into a medical device across its full lifecycle.

AI/ML Devices Deep Dive

· From this learning path

Software & AI

AI/ML-Enabled Medical Device

Medical device that uses artificial intelligence or machine learning to perform its intended use.

Adjacent lesson

Software & AI

Explainability and Interpretability

Methods (SHAP, saliency maps, prototype explanations) that help users understand why a model made a given prediction.

Software & AI

Foundation Model (Healthcare)

Large pretrained model adaptable to many downstream clinical tasks via fine-tuning or prompting.

Software & AI

Generative AI in Medical Devices

Devices that use LLMs or diffusion models to generate text, images, or recommendations within a clinical workflow.

Cited by

Where this term appears across MedTech Terms.

Learning paths (3)

Ecosystems (3)

Latest in MedTech

Sources

3 sources

Every citation below opens the original document. Each is graded against our source-tier hierarchy so you can see what rests on binding law versus commentary.

Tier 2Regulator guidance and consensus· 3

Link health: 3 verified· last checked 2026-06-20

FDA·2IMDRF·1

Inline markers like [1] jump to the matching reference above.

My progress

All terms0 / 513

Software & AI0 / 31

Saved on this device, and to your account when signed in. View studied terms

Full glossary

Browse all terms A to Z, each with a short definition.

On this term

Category: Software & AI
Acronym: PCCP
Sources: 3
Use cases: 1
Updated: 9/19/2026

Compare with another term

Learn in 60 seconds

FDA mechanism to pre-authorize specific modifications to AI/ML-enabled devices.

·PCCPs let manufacturers update AI/ML models within an authorized envelope without a new submission, while preserving safety and effectiveness controls.
·A PCCP has three parts: a description of modifications, a modification protocol (data management, retraining, performance evaluation and update procedures) and an impact assessment.
·Once authorized, changes made in line with the plan do not need a new submission.

Remember this

Watch out: Misunderstanding that a PCCP grants blanket approval for any change; only modifications explicitly covered and detailed in the authorized plan are permitted without new submission.

Related terms

You may also need

Auto-suggested from Software & AI and shared keywords.

All Software & AI terms

From the Blue Goat network

Related resources and services on this topic.

Definition

What this means in practice

Examples

Use cases

Continuous learning chest-X-ray triage SaMD

Frequently asked questions

Used by

See also

Related terms

Editor's picks

SaMD & AI/ML Devices

Software Team Onboarding

AI/ML Devices Deep Dive

Latest in MedTech

Sources