FDA PCCP final guidance: how to pre-authorize AI device updates without a new 510(k) or PMA

A Predetermined Change Control Plan (PCCP) lets an AI-enabled medical device manufacturer pre-authorize a set of future modifications at the time of initial marketing submission, so those modifications can be implemented without a new 510(k), De Novo, or PMA supplement. FDA finalized Marketing Submission Recommendations for a Predetermined Change Control Plan for Artificial Intelligence-Enabled Device Software Functions on December 3, 2024 (Federal Register 2024-28361). The final guidance expanded scope from machine-learning-only devices to all AI-enabled devices and set three required components: a Description of Modifications, a Modification Protocol, and an Impact Assessment. For any device that will iterate its model after launch, a PCCP is now the primary regulatory path to iterate without re-filing.

What a PCCP is and why it matters

AI and ML-enabled devices are not static. Models are retrained, performance is re-evaluated, and input modalities expand. Under the traditional framework, any modification that could significantly affect safety or effectiveness requires a new 510(k), De Novo submission, or PMA supplement (21 CFR 807.81(a)(3)). For a device that retrains monthly, that cadence is incompatible with regulatory submission timelines.

A PCCP resolves the tension. The manufacturer specifies upfront, in the marketing submission, the range of future modifications the device may undergo, the methodology that will be used to develop and validate each modification, and the expected impact. FDA reviews the PCCP alongside the device. If authorized, the manufacturer can then implement any modification inside the PCCP envelope without a new marketing submission, provided the modification is executed exactly as the PCCP describes.

The legal basis is Section 515C of the FD&C Act, added by the Food and Drug Omnibus Reform Act (FDORA) in December 2022. The December 3, 2024 guidance is the FDA's operational interpretation of that statutory authority for AI-enabled devices.

Scope: what the final guidance covers

The draft guidance (April 2023) limited PCCPs to machine-learning-enabled devices. The final guidance broadens scope to all AI-enabled devices (FDA final guidance page).

Non-AI device modifications continue under the separate FDA PCCP guidance for medical devices for non-AI software and hardware. The December 2024 guidance is specifically the AI-enabled branch.

The three required components

Every PCCP must include three interlocking sections. FDA reviews each for completeness and internal consistency before authorizing the plan.

1. Description of Modifications

Specifies exactly what will change in the authorized AI-enabled device. Typical modification categories:

• Retraining with new data from additional patient populations
• Input expansion (new image modalities, new sensor types)
• Output refinement (updated classification thresholds, new risk scores)
• Performance improvements within the existing indications for use
• Device compatibility updates

Each modification must be specific enough that a reviewer can tell whether a future implementation stays inside the PCCP envelope or requires a new submission. Vague descriptions ("performance improvements") are rejected; defined descriptions ("retraining on up to 20,000 additional chest X-ray images from age 18 to 90 across the approved indications") are acceptable.

2. Modification Protocol

Describes how each modification will be developed, validated, and implemented. The protocol must cover:

• Data management: source, acquisition, labeling, and quality control procedures for new training or evaluation data
• Retraining and development: model retraining methodology, hyperparameter bounds, frozen versus updateable layers
• Performance evaluation: pre-specified metrics, acceptance criteria, and held-out test set protocol
• Impact on other aspects: cybersecurity review, usability review, software verification
• Implementation: versioning, rollback, deployment to installed base, user communication

A strong Modification Protocol reads like a standard operating procedure. A reviewer should be able to verify, post-implementation, that the manufacturer executed the protocol exactly as described.

3. Impact Assessment

Evaluates the benefits, risks (including bias), and mitigations of each modification, both individually and cumulatively. The assessment must address:

• Clinical performance impact on the approved indications for use
• Bias and fairness impact across demographic subgroups
• Cybersecurity impact from retraining infrastructure
• Usability impact on healthcare providers
• Interaction effects if multiple modifications are implemented in sequence

The cumulative analysis is the piece manufacturers most often under-specify. Two individually minor modifications can compound into a material shift in performance or risk profile. The Impact Assessment must model this explicitly.

Try this in RegAid: What must a PCCP Modification Protocol include for an AI-enabled medical device?

Labeling requirements

Labeling of an AI or ML-enabled device with an authorized PCCP must state clearly that the device incorporates AI, has an authorized PCCP, and may be updated over time. Users must understand that the device they operate today may receive software updates that modify performance, inputs, or indications within the authorized envelope.

The labeling section is often under-estimated in early PCCP submissions. Reviewers expect explicit language, not passive references buried in a user manual. The final guidance PDF provides example language.

How a PCCP changes your submission strategy

For AI-enabled devices, a PCCP is no longer optional strategy, it is the operational prerequisite for post-market iteration. Three strategic implications:

Plan the PCCP envelope at product definition. The modifications you want to make in years 2 to 5 of the device lifecycle must be anticipated at your initial 510(k) or PMA. Retrofitting a PCCP later is possible but expensive; a PCCP submitted at initial authorization captures the fullest envelope.

Invest in the Modification Protocol early. The protocol is where most submission time is spent. It requires a cross-functional team (data science, regulatory, clinical, QA, cybersecurity) and detailed documentation. Sponsors that start the protocol after the rest of the submission is drafted will face the longest review cycles.

Align global strategy. The FDA PCCP concept has parallel frameworks emerging at Health Canada and MHRA under the joint guiding principles issued in 2023. Design your PCCP to satisfy FDA today while preserving compatibility with the Canadian and UK approaches.

Common pitfalls

Writing vague Descriptions of Modifications: "future performance improvements" is not acceptable. Reviewers need operationally verifiable language: specific data types, quantitative bounds, defined input and output ranges.

Treating the Modification Protocol as a white paper: the protocol is an SOP the manufacturer will execute and that inspectors will audit against. It must be specific enough that a different engineer could execute it and produce equivalent results.

Under-specifying the Impact Assessment: FDA expects a probabilistic analysis covering clinical, bias, cybersecurity, and usability dimensions, both individually and cumulatively. Descriptive narratives without pre-specified acceptance criteria are a frequent deficiency.

Forgetting the cumulative case: three individually approvable modifications may cumulatively exceed the authorized risk profile. The Impact Assessment must consider interaction effects and specify a cumulative threshold that triggers a new submission.

Silent labeling: devices with an authorized PCCP must say so in labeling. Submissions that omit or bury the PCCP disclosure fail the labeling review regardless of the technical strength of the plan.

Overreach outside the envelope: once authorized, manufacturers can implement only modifications that fit inside the PCCP exactly as described. Any deviation requires a new marketing submission. Keep an internal log of each modification mapped to the PCCP clause it falls under.

Key takeaways

• FDA finalized the PCCP guidance for AI-enabled device software on December 3, 2024, under FD&C Act Section 515C
• Scope broadened from ML-only (draft) to all AI-enabled devices (final)
• Three required components: Description of Modifications, Modification Protocol, Impact Assessment
• Labeling must clearly state the device has an authorized PCCP
• PCCPs eligible for 510(k), De Novo, PMA, and HDE submissions; IDE is out of scope
• A PCCP is now the primary path for post-market iteration of AI-enabled devices; plan the envelope at initial product definition, not after
• Health Canada and MHRA have parallel PCCP frameworks under the joint 2023 guiding principles; design for global alignment

How RegAid helps

RegAid covers the FDA December 2024 PCCP final guidance, the underlying FD&C Act Section 515C statutory basis, the joint FDA/Health Canada/MHRA PCCP guiding principles, and the FDA Good Machine Learning Practice (GMLP) principles. Ask "What are the three required components of an FDA PCCP for AI-enabled devices?" or "How does an FDA PCCP interact with EU MDR requirements for software as a medical device?" and get a cited answer with links to the primary FDA guidance, Federal Register notice, and supporting source documents.