When is a PCCP typically required?

A PCCP is typically required when an AI/ML device is designed to adapt or be modified post-market in ways that directly impact its algorithm's behavior or performance. This plan outlines the scope, methods, and validation processes for these specific algorithmic changes.

Can cybersecurity updates be considered predetermined maintenance?

Yes, cybersecurity updates are generally considered predetermined maintenance. They maintain the security and functionality of the software without altering the fundamental algorithm that defines the device's medical function, as long as they are managed within a robust software development lifecycle.

How do regulatory bodies view the distinction between these two concepts?

Regulatory bodies like the FDA emphasize that this distinction is crucial for efficient oversight. Clearly defining what falls under routine maintenance versus a PCCP helps manufacturers manage post-market changes effectively and prevents unnecessary premarket submission burdens.

All terms

Software & AIAI / ML in Devices Connected & Cyber-Physical Devices Software Lifecycle

Predetermined Maintenance vs PCCP

Distinction between routine maintenance changes (cybersecurity patches, minor fixes) and PCCP-controlled algorithm changes.

Reviewed by Christian Espinosa, Founder, Blue Goat CyberLast reviewed September 19, 2026

Definition

Not every software change to an AI/ML device requires a PCCP - cybersecurity patches, bug fixes, and infrastructure updates often fall under standard software maintenance. PCCPs specifically govern pre-specified algorithm modifications. The key test is whether a change modifies the model's behavior or performance claims. Changes outside an authorized PCCP still follow FDA's guidance on deciding when to submit a 510(k) for a software change. Cybersecurity patches for cleared devices generally do not need a new submission unless they affect safety or effectiveness, in line with FDA's postmarket cybersecurity guidance.

What the regulation says

The FDA guidance "Content of Premarket Submissions for Device Software Functions" and "Marketing Submission Recommendations for Next Generation Sequencing (NGS) - Based SSoP" distinguish between changes necessitating a Predetermined Change Control Plan (PCCP) and routine software maintenance. Per the FDA, a PCCP is for planned modifications to an Artificial Intelligence/Machine Learning (AI/ML) device’s algorithm, while maintenance covers issues like cybersecurity updates or bug fixes, which typically do not require new premarket submissions if managed under established software lifecycle processes.

What this means in practice

Drawing the boundary clearly in the submission and SOPs prevents unnecessary submissions and confusion at audit time.

Examples

A manufacturer releases a software patch to address a newly discovered cybersecurity vulnerability in their AI-powered diagnostic imaging system, classifying it as predetermined maintenance rather than a PCCP change.
A company submits a PCCP outlining how its AI-driven diabetes management app will be updated annually to incorporate new clinical guidelines into its glucose prediction algorithm.
An infrastructure update to a cloud-based AI medical device, such as switching to a new server provider without altering the AI algorithm itself, is managed as predetermined maintenance.

Common pitfalls

•Confusing routine software maintenance activities with changes that require a PCCP can lead to unnecessary regulatory submissions and delays.
•Failing to clearly define the scope of a PCCP in relation to general software maintenance can result in regulatory non-compliance during audits.
•Assuming all AI/ML model retraining constitutes a PCCP-relevant change without distinguishing between performance-enhancing updates and core algorithm modifications is a common misstep.
•Not adequately documenting the rationale for classifying a software change as maintenance versus a PCCP-governed modification can create audit findings.
•Applying a PCCP to non-AI/ML software components or changes that do not alter the pre-specified algorithm is an inefficient regulatory strategy.

Frequently asked questions

Predetermined maintenance covers routine software updates such as cybersecurity patches, bug fixes, and infrastructure improvements that do not alter the core algorithmic function. A PCCP, conversely, specifically addresses pre-specified, planned modifications to an AI/ML device's algorithm, often related to its learning or adaptation capabilities.

Grouped by theme

Editor's picks

· Hand-selected related concepts

Software & AI

Predetermined Change Control Plan(PCCP)

FDA mechanism to pre-authorize specific modifications to AI/ML-enabled devices.

Software & AI

Software Maintenance Plan

IEC 62304 §6 documented plan for handling problem reports, changes, and releases over the software lifecycle.

More in Software & AI

· Same category

Software & AI

AAMI TIR45(TIR45)

AAMI Technical Information Report providing guidance on applying Agile software development practices within an IEC 62304-compliant medical device software lifecycle.

Software & AI

Adversarial Robustness

Resilience of an ML model to inputs deliberately crafted to cause misclassification.

Software & AI

AI/ML-Enabled Medical Device

Medical device that uses artificial intelligence or machine learning to perform its intended use.

Software & AI

Algorithm Change Protocol(ACP)

The detailed procedural section of a PCCP that specifies how planned modifications to an AI/ML model will be developed, validated, and implemented.

Cited by

Where this term appears across MedTech Terms.

Ecosystems (3)

Latest in MedTech

Sources

3 sources

Every citation below opens the original document. Each is graded against our source-tier hierarchy so you can see what rests on binding law versus commentary.

Tier 2Regulator guidance and consensus· 3

Link health: 3 verified· last checked 2026-06-20

FDA·1IMDRF·1MDCG·1

Inline markers like [1] jump to the matching reference above.

My progress

All terms0 / 513

Software & AI0 / 31

Saved on this device, and to your account when signed in. View studied terms

Full glossary

Browse all terms A to Z, each with a short definition.

On this term

Category: Software & AI
Sources: 3
Updated: 9/19/2026

Compare with another term

Learn in 60 seconds

Distinction between routine maintenance changes (cybersecurity patches, minor fixes) and PCCP-controlled algorithm changes.

·Drawing the boundary clearly in the submission and SOPs prevents unnecessary submissions and confusion at audit time.
·PCCPs specifically govern pre-specified algorithm modifications.
·The key test is whether a change modifies the model's behavior or performance claims.

Remember this

Watch out: Confusing routine software maintenance activities with changes that require a PCCP can lead to unnecessary regulatory submissions and delays.

Related terms

You may also need

Auto-suggested from Software & AI and shared keywords.

All Software & AI terms

From the Blue Goat network

Related resources and services on this topic.