Predetermined Change Control Plans (PCCP) for AI/ML Devices: What FDA Approved in 2025–2026

If you build an AI-enabled device, the single most expensive regulatory question you face is not how to get cleared. It is what happens the next time you retrain the model. Without a plan in place, a meaningful change to an algorithm can trigger a new 510(k). With one, you ship the update under an authorization you already hold. That plan is a Predetermined Change Control Plan, and between December 2024 and 2026 it moved from a promising idea to the working mechanism behind a growing share of AI device clearances.

What a Predetermined Change Control Plan actually is

A PCCP is a section of your marketing submission that describes, in advance, the changes you intend to make to your device after clearance, how you will make them, and why they will not change the device's safety or effectiveness. FDA reviews that plan alongside the device. If FDA authorizes it, changes made in accordance with the plan do not require a new submission.

The authority is statutory, not discretionary. Section 515C of the Federal Food, Drug, and Cosmetic Act, added by the Food and Drug Omnibus Reform Act in December 2022, lets FDA authorize planned changes in a 510(k), De Novo or PMA, provided the device remains safe and effective with those changes and, for 510(k) devices, remains substantially equivalent to the predicate. If you are still mapping which of those routes applies to you, start with our guide to global FDA pathways: 510(k), De Novo and PMA.

What FDA finalized in 2024, and refreshed in 2025

FDA issued the final guidance, Marketing Submission Recommendations for a Predetermined Change Control Plan for Artificial Intelligence-Enabled Device Software Functions, on December 4, 2024, and reissued it on August 18, 2025. The most consequential change from the 2023 draft was scope: the draft covered machine-learning-enabled functions only, while the final guidance applies to all AI-enabled device software functions. Rule-based and hybrid systems are in scope too.

The guidance is non-binding, but it is the clearest statement available of what a reviewer expects to see, and submissions that ignore its structure tend to come back with questions.

The three parts a reviewer looks for

A PCCP has three components, and each fails in a predictable way.

The description of modifications lists the specific changes you plan to make. Vague entries such as "periodic model improvements" do not survive review. Reviewers want enumerated, bounded changes: retraining on additional data from the same intended population, a recalibrated threshold within a stated range, support for an additional scanner model.

The modification protocol is the engine of the plan. It covers data management (where new training data comes from, how it is labelled, how you prevent leakage between training and test sets), retraining procedures, performance evaluation against a pre-specified test set and acceptance criteria, and the update procedures your quality system will follow when a change goes out, including communication to users. This is where most of the review effort lands.

The impact assessment explains why the changes described, executed under the protocol, do not alter the device's risk profile. It has to connect back to your risk management file, not sit beside it.

What has actually been authorized in 2025 and 2026

The mechanism is in real use. In May 2025 FDA added PCCP search filters to its 510(k), De Novo and PMA databases, which for the first time made authorized plans findable rather than something you had to dig out of clearance letters. Published analyses of the AI/ML devices with authorized PCCPs identified up to mid-2025 point in a consistent direction: the overwhelming majority cleared through 510(k) rather than De Novo or PMA, all were moderate-risk devices, and they clustered in imaging and diagnostic assessment, with radiology far in front.

Treat those counts as public-record estimates rather than exact figures. FDA has issued corrections where authorization letters referenced a PCCP that was not in fact present. The direction of travel is nonetheless unambiguous, and the practical read is this: a PCCP is now a normal part of a moderate-risk AI submission, not an exotic one. If you want to see how a pathway decision interacts with the rest of your regulatory plan, our open-source DevicePath triage tool walks through the classification questions.

What a PCCP will not buy you

A PCCP is a licence to execute a plan, not a licence to evolve freely. Four limits matter.

A new intended use is out. If a change moves the device into a different clinical claim, that is a new submission regardless of what your plan says. A new patient population is generally out for the same reason. Changes outside the authorized protocol — even smaller ones — are not covered; the protection applies only when you follow the plan exactly. And your labelling and version-transparency obligations continue, which means users need to be able to tell which version of the model produced a result.

There is also an international dimension that catches teams out. EU MDR change control has no direct PCCP equivalent, so a change that ships freely in the US can still require notified body involvement in Europe. Build the two plans together rather than retrofitting one to the other; our guide to EU MDR and UKCA compliance routes sets out where those obligations diverge.

Four things to do now

Scope narrowly and specifically. A tight plan covering three well-defined changes gets authorized faster than a broad one covering everything you might ever want.

Lock the evaluation set before you write the protocol. Reviewers want to know the test data you will judge future versions against is fixed, representative and separate from anything you will retrain on.

Write update procedures your quality system can actually execute. A protocol that assumes a release process your organisation does not have is a finding waiting to happen.

Model the commercial side alongside the regulatory one. The ability to update quickly is worth more in markets where you can actually get paid, which is why change control and reimbursement planning belong in the same conversation — see our medical device market access guide and the recent piece on CMS renaming SaaS to Software as a Medical Service.

Where this leaves you

A PCCP is one of the few regulatory instruments that makes your product cheaper to run after launch rather than harder. The teams getting value from it treat it as a product decision made at submission time, not a document written at the end. MedTech Compass helps you line that decision up with market scoring and payment forecasting across 25+ markets, so the changes you pre-authorize are the ones your commercial plan actually needs.

Sources

1. FDA — Marketing Submission Recommendations for a Predetermined Change Control Plan for Artificial Intelligence-Enabled Device Software Functions, final guidance, issued December 4, 2024, reissued August 18, 2025: fda.gov/media/166704/download

2. Federal Register — Notice of availability, Docket FDA-2022-D-2628, December 4, 2024: federalregister.gov

3. FDA — Artificial Intelligence-Enabled Medical Devices list: fda.gov AI-enabled medical devices

4. FDA — 510(k) premarket notification database, which now supports PCCP search: accessdata.fda.gov

5. Section 515C of the FD&C Act, 21 U.S.C. 360e-4, added by FDORA 2022: law.cornell.edu

This article summarises FDA guidance and public records as of September 2026 and is not legal or regulatory advice.