Guidance Breakdown: PCCPs for AI-Enabled Device Software Functions
The FDA's long-awaited final guidance maps out how AI/ML devices can evolve post-market. We break down the new PCCP guidance.
This guidance breakdown is available for paid subscribers. Only paid subscribers get regular full access to our guidance breakdowns and other analyses. If you’re not already a paid subscriber, you can upgrade here.
The FDA has released its long-anticipated guidance on predetermined change control plans for AI-enabled device software functions.
PCCPs are essentially roadmaps for how a device might change after approval. The FDA can prospectively approve PCCPs to allow changes within a defined set of criteria. That’s especially (though not exclusively) useful for devices using AI since the device might change because of new data used to train the AI.
The guidance sets out the recommendations for the information to be included in a PCCP as part of a marketing submission for a device that incorporates one or more artificial intelligence-enabled device software functions (AI-DSFs). It’s recommended that the PCCP detail the planned modifications to the AI-DSFs, the methodology for developing, validating, and implementing those modifications, and an assessment of their impact. The FDA has also announced an upcoming webinar on the guidance set for January 14.
Here’s our breakdown.
Introduction and regulatory context
Grounded in section 515C of the FD&C Act, this guidance establishes a framework that allows manufacturers to modify their AI-enabled devices through pre-planned changes without requiring additional marketing submissions.
This approach tackles one of the industry's most pressing challenges: enabling continuous improvement of AI-enabled devices while maintaining rigorous safety standards.
Backing up: what’s a PCCP?
A PCCP is more than a simple modification strategy — it’s a comprehensive framework integrated into a device's marketing authorization. Every PCCP is built on three interconnected components: the Description of Modifications, the Modification Protocol, and the Impact Assessment. Together, these components ensure that device modifications preserve safety and effectiveness while enabling technological advancement.
The Description of Modifications requires manufacturers to delineate their planned changes with unprecedented specificity. Instead of providing general outlines, manufacturers must detail exactly how their AI-enabled device software functions (AI-DSFs) will evolve. This includes specifying whether modifications will be implemented automatically or manually, whether changes will apply uniformly across all devices or vary by site, and the expected frequency of updates. The guidance underscores the importance of setting clear boundaries and guardrails, particularly for automatic updates.
The Modification Protocol acts as the operational backbone of the PCCP, comprising four critical elements that work in harmony:
Data Management Practices — detailing inclusion criteria, quality assurance methods, and more.
Re-Training Practices — specifying triggers for model updates and validation approaches.
Performance Evaluation Protocols — defining metrics and acceptance criteria.
Update Procedures — outlining implementation methods and communication strategies.
For data management practices, the guidance provides significantly more detailed requirements than might be apparent.
Manufacturers must establish explicit protocols for separating training, tuning, and test datasets, specifically emphasizing data sequestration strategies that prevent access to test data during the development process.
The guidance also emphasizes the need for detailed documentation of reference standard determination, including explicit protocols for when clinical interpretation is used and how to handle cases where results may be equivocal or missing.
Quality assurance processes must address not just data completeness but also strategies for handling obsolete data and preventing unauthorized manipulation of datasets.
Performance evaluation requirements extend beyond basic metrics.
Manufacturers must develop comprehensive statistical analysis plans, establish protocols for evaluating challenging edge cases, and create specific procedures for handling variability in reference standards.
The guidance emphasizes that performance evaluation should consider not just overall metrics, but also performance across different subpopulations and use conditions.
The Impact Assessment ties everything together, requiring manufacturers to analyze both the individual and cumulative effects of proposed modifications. This includes comparing modified versions to the original device, evaluating benefits and risks, and ensuring that changes uphold device safety and effectiveness. A key focus is assessing the interaction effects between multiple modifications and their impact on overall device functionality.
Implementation pathways and quality system integration
The FDA has (thoughtfully) integrated PCCPs into existing regulatory frameworks, allowing authorization through several established pathways:
PMA routes, including original applications, modular applications, and various supplement types
Traditional and abbreviated 510(k) submissions
Original De Novo requests
However, the guidance makes clear that successful implementation requires more than just regulatory approval. PCCPs must be fully integrated into a manufacturer's quality system, with robust documentation in the device master record and comprehensive version control. This integration extends to cybersecurity measures, adverse event tracking, and real-world performance monitoring.
The integration with quality systems requires more specific documentation than typical device modifications. Manufacturers must maintain detailed records in the device master record that include not just the modifications themselves but also the complete validation history, performance data, and decision-making processes that led to each implementation. The guidance emphasizes integration with existing CAPA processes, requiring clear procedures for how PCCP modifications interact with ongoing quality system activities.
Labeling and communication requirements
The guidance places significant emphasis on transparency and communication. Manufacturers must ensure their labeling clearly identifies AI/ML components, describes the authorized PCCP, and provides detailed information about potential software updates.