How the FDA lets an AI device update itself without a new clearance

A predetermined change control plan, or PCCP, is a document a medical-device maker files with the US Food and Drug Administration that spells out, in advance, exactly how an artificial-intelligence device will be allowed to change after it is on the market — and the methods that will be used to validate each of those changes [s1]. Its purpose is narrow and specific: the FDA reviews the plan as part of the original marketing submission so that the manufacturer can later implement the modifications it describes "without necessitating additional marketing submissions" for each one [s1].

That solves a problem baked into machine learning. A conventional cleared device is fixed; a significant change to it normally triggers a fresh review. But an AI model is built to be retrained — on more data, from new sites, to correct drift — and treating every retraining as a new device would be unworkable. The PCCP is the FDA's attempt to let a model improve on a leash rather than freeze it in place.

What a plan actually contains

Under the final guidance, published in the Federal Register on 4 December 2024, a PCCP has three parts [s1]. It describes the planned modifications to the AI-enabled device software functions — what the manufacturer intends to change. It sets out the methodology to develop, validate and implement those modifications — how each change will be tested before it reaches users. And it includes an assessment of the impact of the modifications — what could go wrong and how the plan guards against it [s1].

The through-line is pre-specification. A PCCP is not permission to alter a device however the maker later sees fit; it is permission to make a bounded, described, pre-validated set of changes. Anything outside the envelope — a new intended use, a modification the plan did not anticipate — still requires the FDA to review it the normal way. The leash is the point.

How it got here

The concept moved through the usual two-step. The FDA issued the draft version on 3 April 2023, then still titled for "Artificial Intelligence/Machine Learning-Enabled Device Software Functions" [s2]. The final guidance, nearly 20 months later, quietly dropped "Machine Learning" from the title in favour of the broader "Artificial Intelligence-Enabled Device Software Functions" — a small edit that tracks how fast the terminology, and the technology under it, was shifting [s1][s2].

A month after the PCCP guidance was finalised, the FDA followed with a companion draft on 7 January 2025 covering the wider "lifecycle management" of AI device software — the total-product-lifecycle thinking a PCCP sits inside [s3]. Together the documents sketch a regime in which an AI device is regulated less as a finished object and more as a managed process, with the change plan as the contract between the agency and the manufacturer.

Why it matters, and where the strain is

For patients and clinicians, the PCCP is the mechanism that decides how a cleared AI tool is allowed to evolve while it is making decisions about their care — which is why it belongs alongside the FDA's other moves to define what an AI or software function counts as a regulated device and how clinical-decision-support software escapes that net. It is a genuinely novel piece of regulatory design, and it carries a genuinely novel risk.

The risk is that the strength of a PCCP is only as good as the pre-specified validation inside it. A plan that commits to rigorous, independent testing of every update is a real safeguard; a plan that commits to something thinner still lets a model change under a clearance the public first saw years earlier. That is the same gap the site has flagged elsewhere between an AI device being authorised and its performance being demonstrated in the real-world settings where it is used, and between an approval and the post-market reporting that would catch a device drifting. The guidance shifts a large share of the oversight from a one-time review to the quality of a plan and the diligence of whoever audits it later.

What to watch

Whether the FDA publishes worked examples and enforcement actions that show where the boundary of an acceptable PCCP actually lies — the difference between a plan that meaningfully constrains a model and one that rubber-stamps continuous change. The lifecycle-management guidance was still a draft when it was issued in January 2025 [s3]; how it is finalised, and how tightly PCCPs are policed in practice, will determine whether this framework is a safeguard or a formality.

This article is informational and is not medical or regulatory advice.

Sources

• [s1] US Food and Drug Administration. "Marketing Submission Recommendations for a Predetermined Change Control Plan for Artificial Intelligence-Enabled Device Software Functions; Guidance for Industry and Food and Drug Administration Staff; Availability." Federal Register, 89 FR, notice of availability, 4 December 2024. https://www.federalregister.gov/documents/2024/12/04/2024-28361/marketing-submission-recommendations-for-a-predetermined-change-control-plan-for-artificial
• [s2] US Food and Drug Administration. "Marketing Submission Recommendations for a Predetermined Change Control Plan for Artificial Intelligence/Machine Learning-Enabled Device Software Functions; Draft Guidance; Availability." Federal Register, 3 April 2023. https://www.federalregister.gov/documents/2023/04/03/2023-06786/marketing-submission-recommendations-for-a-predetermined-change-control-plan-for-artificial
• [s3] US Food and Drug Administration. "Artificial Intelligence-Enabled Device Software Functions: Lifecycle Management and Marketing Submission Recommendations; Draft Guidance; Availability." Federal Register, 7 January 2025. https://www.federalregister.gov/documents/2025/01/07/2024-31543/artificial-intelligence-enabled-device-software-functions-lifecycle-management-and-marketing