FDA Predetermined Change Control Plans (PCCP) for AI-enabled devices

Include a PCCP in the marketing submission for a device with one or more AI-enabled device software functions. It should describe the planned AI-DSF modifications, the associated methodology to develop, validate and implement those modifications, and an assessment of the impact of those modifications. FDA reviews the PCCP as part of the marketing submission, so the plan boundary must be specific enough to be reviewable yet broad enough to cover foreseeable iteration needs, and the terminology for training, tuning and test data should follow the clarifications in the final guidance.

Applies when

Sponsors filing a 510(k), De Novo or PMA for a device that includes AI-enabled device software functions.

Evidence to retain

• · PCCP document covering the planned modification list, methodology and impact assessment
• · Modification boundary criteria and the test for when a new submission is required
• · Description of training, tuning and test data splits with the data dictionary
• · Validation protocol and acceptance criteria, including the no-performance-degradation threshold
• · FDA review correspondence (additional information or deficiency letters) and responses

Estimated first-time effort: 25–70 person-days (estimate, not a commitment)

One of the clarifications the final guidance makes over the draft concerns the PCCP information to include in labelling and in publicly available decision summaries. In practice the labelling must let users know that an authorised change plan exists, what types of change may occur and how to identify the current version, and the wording in the public decision summary must match the submission so that external marketing does not overstate what automatic updating means.

Applies when

Holders of an authorised PCCP and their marketing and medical affairs teams.

Evidence to retain

• · Final labelling and instructions for use containing the PCCP description, with version records
• · Consistency check between the PCCP wording in the public decision summary and the submission
• · Compliance review records for promotional materials
• · Evidence of how users can identify the current software version

Estimated first-time effort: 5–15 person-days (estimate, not a commitment)

The effect of FDA review and authorisation of a PCCP is that no additional marketing submission is needed for each modification implemented within the plan. Companies therefore need a gating process confirming, for every release, that the intended modification falls within the authorised modification list and methodology and that validation was performed as specified; anything outside must return to the marketing submission route. The final guidance specifically clarifies implementation of modifications consistent with an authorised PCCP, and the implementation evidence must be retrievable during inspection.

Applies when

The R&D, quality and regulatory teams of the submission holder; changes in OEM-supplied modules must enter the same gate.

Evidence to retain

• · Per-release determination of whether the change is within the PCCP scope
• · Validation reports executed under the PCCP methodology with performance comparison data
• · Release approval records and sign-off
• · Marketing submission records for out-of-scope modifications
• · Traceability register for model and data versions

Estimated first-time effort: 15–45 person-days (estimate, not a commitment)

The final guidance adds clarifications on postmarket surveillance relative to the draft. For an AI device this means monitoring real-world performance continuously while the PCCP is in force, detecting distribution shift, subgroup performance differences and degradation, and feeding the findings back into decisions on further modifications and risk controls. The system must connect to the device quality system and adverse event reporting processes.

Applies when

Holders marketing AI devices in the United States, including Chinese manufacturers filing through a U.S. agent.

Evidence to retain

• · Real-world performance monitoring plan and metric definitions, including subgroup stratification
• · Legal basis and privacy compliance analysis for the monitoring data collection
• · Thresholds, alerts and response records for performance degradation and data drift
• · Records showing monitoring findings driving modification decisions and risk control updates
• · Documented interface with the adverse event reporting process

Estimated first-time effort: 15–45 person-days (estimate, not a commitment)