MedTech Terms
    The authoritative reference
    All terms

    Predetermined Maintenance vs PCCP

    Distinction between routine maintenance changes (cybersecurity patches, minor fixes) and PCCP-controlled algorithm changes.

    Reviewed by Christian Espinosa, Founder, Blue Goat CyberLast reviewed May 5, 2026

    Definition

    Not every software change to an AI/ML device requires a PCCP - cybersecurity patches, bug fixes, and infrastructure updates often fall under standard software maintenance. PCCPs specifically govern pre-specified algorithm modifications.
    What the regulation says
    The FDA guidance "Content of Premarket Submissions for Device Software Functions" and "Marketing Submission Recommendations for Next Generation Sequencing (NGS) - Based SSoP" distinguish between changes necessitating a Predetermined Change Control Plan (PCCP) and routine software maintenance. Per the FDA, a PCCP is for planned modifications to an Artificial Intelligence/Machine Learning (AI/ML) device’s algorithm, while maintenance covers issues like cybersecurity updates or bug fixes, which typically do not require new premarket submissions if managed under established software lifecycle processes.

    What this means in practice

    Drawing the boundary clearly in the submission and SOPs prevents unnecessary submissions and confusion at audit time.

    Examples

    • A manufacturer releases a software patch to address a newly discovered cybersecurity vulnerability in their AI-powered diagnostic imaging system, classifying it as predetermined maintenance rather than a PCCP change.
    • A company submits a PCCP outlining how its AI-driven diabetes management app will be updated annually to incorporate new clinical guidelines into its glucose prediction algorithm.
    • An infrastructure update to a cloud-based AI medical device, such as switching to a new server provider without altering the AI algorithm itself, is managed as predetermined maintenance.
    Common pitfalls
    • •Confusing routine software maintenance activities with changes that require a PCCP can lead to unnecessary regulatory submissions and delays.
    • •Failing to clearly define the scope of a PCCP in relation to general software maintenance can result in regulatory non-compliance during audits.
    • •Assuming all AI/ML model retraining constitutes a PCCP-relevant change without distinguishing between performance-enhancing updates and core algorithm modifications is a common misstep.
    • •Not adequately documenting the rationale for classifying a software change as maintenance versus a PCCP-governed modification can create audit findings.
    • •Applying a PCCP to non-AI/ML software components or changes that do not alter the pre-specified algorithm is an inefficient regulatory strategy.

    Frequently asked questions

    Predetermined maintenance covers routine software updates such as cybersecurity patches, bug fixes, and infrastructure improvements that do not alter the core algorithmic function. A PCCP, conversely, specifically addresses pre-specified, planned modifications to an AI/ML device's algorithm, often related to its learning or adaptation capabilities.
    Grouped by theme

    Primary references

    3 sources
    Link health: 3 verified· last checked 2026-06-20
    FDA·1IMDRF·1MDCG·1
    1. 1
      FDA PCCP Guidance
      Verified
      FDAfda.gov
    2. 2
      IMDRF - Software as a Medical Device
      Verified
      IMDRFimdrf.org
    3. 3
      MDCG Software Guidance
      Verified
      MDCGhealth.ec.europa.eu

    Inline markers like [1] jump to the matching reference above.