FDA PCCP for AI/ML medical devices: a builder's guide

Informational only — not legal advice. Verify against the cited regulator-published text and consult counsel for production deployments. See AI-DISCLOSURE.md in this package.

If you're building an AI/ML-enabled medical device or device software function — a clinical decision-support tool that gets cleared by FDA, an imaging algorithm in a 510(k)-cleared scanner, an AI radiology triage system, an AI-driven continuous glucose monitor, or any other software-as-a-medical-device (SaMD) that uses machine learning — the FDA Predetermined Change Control Plan (PCCP) framework is the specific federal regulatory vehicle that lets you iterate on the model after authorization without filing a new submission for every update. This guide covers what § 515C of the FD&C Act actually requires, what a PCCP looks like in production, the labeling and public-summary disclosure obligations that come with it, how it stacks with HHS Section 1557 and state-level rules, and what governance any AI/ML device team needs in place before submission.

What FDA PCCP actually is

The Federal Food, Drug, and Cosmetic Act § 515C (21 U.S.C. § 360e-4) was added by Section 3308 of the Food and Drug Omnibus Reform Act of 2022 (FDORA, P.L. 117-328). It authorizes FDA to clear or approve a Predetermined Change Control Plan as part of an AI/ML device's marketing submission — meaning: the manufacturer pre- specifies the kinds of modifications it intends to make to the AI/ML algorithm post-authorization, the methods it will use to validate those modifications, and the assessment of their impact. Once FDA authorizes the PCCP, the manufacturer can implement modifications that conform to the plan without a new marketing submission.

On December 4, 2024, FDA issued the final guidance, "Predetermined Change Control Plans for Artificial Intelligence- Enabled Device Software Functions." The final guidance applies to all medical devices regardless of pathway (510(k), De Novo, PMA) and supersedes the April 2023 draft. It is the authoritative reference for what a PCCP must contain, how to validate modifications, and how to disclose the AI/ML nature of the device to clinicians and patients.

The framework solves a real problem. Before § 515C, any change to the algorithm of a cleared or authorized AI/ML device that affected the device's safety or effectiveness typically required a new 510(k), De Novo, or PMA submission. Iterative model improvement became impractical: every meaningful retrain triggered a new regulatory cycle. PCCP lets manufacturers pre-authorize a bounded set of modifications (and the validation methods for each) so iteration can happen within the bounds the agency has reviewed.

What a PCCP must contain

Per the final guidance, every PCCP comprises three components:

1. Description of Modifications

A specific list of the modifications the manufacturer intends to make to the AI-enabled device software function under the PCCP. Each modification must be:

• Specific. "We may improve the algorithm" is not a modification description. "We may retrain the model on additional pediatric data drawn from the same patient population, with retrained weights deployed only after the validation in the Modification Protocol shows non-inferior sensitivity and specificity at the authorized device's operating point" is.
• Bounded. The set of permissible modifications is finite. The PCCP must enumerate them; modifications outside the enumeration require a new marketing submission.
• Predictable in impact. The Description of Modifications pairs with the Impact Assessment to show that the predicted impact is positive or neutral, and that risks have been characterized.

Common modification categories:

• Retraining on additional data (with bounded data-distribution assumptions).
• Updates to feature engineering or input preprocessing.
• Threshold adjustments at the operating point.
• Performance improvements on specific subgroups.
• Compatibility updates for new sensor inputs.

2. Modification Protocol

Methods to develop, validate, and implement the planned modifications. The Modification Protocol is the testable specification of how the manufacturer will know whether a proposed modification meets the required performance bar. It must include:

• Data management. What data will be used for retraining; how it's sourced; how data quality is maintained; how patient populations are represented.
• Retraining methodology. The algorithmic procedure used to produce a candidate modified model.
• Performance evaluation. The metrics the modified model must meet — typically including sensitivity, specificity, AUC, and fairness across demographic subgroups — and the operating points.
• Update procedures. How the modification is deployed to the device, including version control, rollback, and clinician notification.

The Modification Protocol is the most consequential part of a PCCP. A weak Modification Protocol can result in FDA limiting the PCCP's scope or refusing authorization.

3. Impact Assessment

Evaluation of the benefits and risks of each anticipated modification, including:

• Benefit characterization. What the modification is intended to improve and how it will be measured.
• Risk characterization. Foreseeable risks the modification introduces, and the controls that will detect or mitigate them.
• Cumulative-impact analysis. Where multiple modifications could compound, the assessment must consider their combined effect.
• Comparison against the authorized baseline. Each modification must perform at least as well as the originally authorized device on the metrics that drove the original authorization.

Labeling and public-disclosure obligations

PCCP doesn't change the underlying labeling regime under 21 CFR Part 801; it adds specific disclosure expectations on top.

The device labeling (which includes the user manual, the manufacturer's product page, and FDA's public-facing 510(k) Summary, De Novo Decision Summary, or PMA Approval Order) must:

1. Disclose the AI/ML nature of the device. State that the device is an AI-enabled device software function and identify the regulatory pathway and submission number.
2. Summarize the PCCP where one is authorized. State the bounds of the modifications that may be implemented without a new submission.
3. Inform clinicians that the device may be modified within the PCCP without further FDA review.
4. Provide a current device summary that reflects the current model version, the validation data for that version, and the cumulative record of PCCP-conforming modifications implemented to date.

A public-facing device-summary page, updated each time a PCCP- conforming modification is implemented, is the de facto best practice emerging from the December 2024 final guidance. FDA's own public- facing pages (510(k) Summary, etc.) reflect the original authorization; the manufacturer page is where current model state lives.

Plain-language template that satisfies the labeling requirements:

"This device incorporates an artificial intelligence or machine- learning algorithm. The device has been authorized for marketing by the U.S. Food and Drug Administration under [510(k) / De Novo / PMA number]. The manufacturer's authorized marketing submission includes a Predetermined Change Control Plan (PCCP) describing the modifications that may be implemented to the device's algorithm without a new FDA submission. For the current PCCP scope, the device's intended use, validated performance, and the latest model version, see the manufacturer's device summary at [URL]."

How PCCP applies across pathways

The final guidance applies to all device-pathway pathways, but the mechanics differ slightly:

The 510(k) pathway is by far the most common for AI/ML devices — about 95% of FDA-authorized AI/ML medical devices are 510(k)-cleared.

How PCCP stacks with HHS Section 1557

Section 1557's Patient Care Decision Support Tool (PCDST) nondiscrimination obligations (45 CFR § 92.210, effective 2025-05-01) operate at the deployer level — the covered entity that uses the device. PCCP operates at the manufacturer level — the entity that builds and authorizes the device.

Both apply to the same AI/ML medical device:

• Manufacturer obligations under FDA: PCCP-bounded modifications, labeling disclosure, post-implementation transparency, ongoing performance monitoring under 21 CFR Part 803 (medical device reporting).
• Deployer obligations under HHS Section 1557: PCDST inventory, mitigation of discrimination risk, designated Civil Rights Coordinator coverage, patient-facing notice where applicable.

A hospital using an FDA-cleared AI radiology triage tool: the manufacturer's PCCP governs how the tool is updated; the hospital's Section 1557 PCDST process governs whether and how the tool is used, and how the hospital monitors for discriminatory output. Both obligations apply. See the HHS Section 1557 builder's guide for the deployer side.

How PCCP stacks with state laws

The right rule for production deployment is the strictest applicable overlay, not FDA alone.

How the public-facing device summary should evolve

The December 2024 final guidance treats post-implementation transparency as integral to PCCP compliance. The public-facing device summary on the manufacturer's site is the practical surface. What it should contain:

• Current model version. A version identifier the clinician can cross-reference against the device labeling.
• Date of last modification. When the most recent PCCP-conforming change was implemented.
• Validation data for the current version. Performance metrics on the validation set, including subgroup performance where the device is intended for diverse patient populations.
• PCCP scope. The bounds of authorized modifications, summarized for non-regulator readers.
• Cumulative modification log. A chronological list of PCCP- conforming modifications implemented since authorization.
• Contact for questions. A path for clinicians and patients to reach the manufacturer about the AI/ML nature of the device.

A device summary that omits these elements is not yet aligned with the final guidance's expectations. Expect FDA to lean on this in post-market surveillance.

Common compliance failure patterns

• Modifications outside the authorized PCCP. A retraining run that uses a data source not covered in the Description of Modifications. Even if the resulting model is "better," it requires a new marketing submission.
• Modification Protocol that doesn't enforce its own metrics. A PCCP whose Modification Protocol describes validation but doesn't state explicit pass/fail thresholds. FDA may treat post- authorization changes as outside the PCCP's scope.
• No public-facing device summary. Device labeling references a PCCP but the manufacturer doesn't provide an updatable public summary; clinicians can't tell what model version is currently deployed.
• Section 1557 deployer obligations treated as the manufacturer's responsibility. The covered entity (hospital, FQHC, etc.) is responsible for its own PCDST inventory and mitigation — the manufacturer's FDA labeling does not satisfy the deployer's HHS Section 1557 obligations.
• Cumulative-impact analysis missing. PCCP allows multiple modifications. Without a cumulative-impact assessment, drift over many modifications can leave the device performing meaningfully differently from the originally authorized baseline.
• Fairness / subgroup performance not in the Modification Protocol. A PCCP whose Modification Protocol only checks aggregate performance metrics misses subgroup-level performance changes. These can trigger Section 1557 disparate-impact concerns at the deployer level — and create FDA postmarket safety issues.

How plainstamp helps

plainstamp ships a us-fda-pccp-aiml-device-software-2024 rule that returns the labeling-disclosure checklist, plain-language and formal-language device-labeling templates, citation back to FD&C Act § 515C and the December 2024 FDA final guidance, and a last_verified date. Lookup:

npx plainstamp lookup --jurisdiction us \
                      --channel about-page \
                      --use-case healthcare

For California-operating manufacturers, layer SB 1120 on top:

npx plainstamp lookup --jurisdiction us-ca \
                      --channel about-page \
                      --use-case healthcare

The minimum viable compliance posture

If your AI/ML medical device is starting from zero on PCCP / labeling compliance, ship these six artifacts in order:

1. Authorized PCCP in your marketing submission. Description of Modifications, Modification Protocol with explicit pass/fail thresholds, Impact Assessment with cumulative-impact analysis.
2. Device labeling that discloses the AI/ML nature, summarizes the PCCP, and points to the public-facing device summary URL.
3. Public-facing device summary page with current model version, date of last modification, validation data for the current version, PCCP scope, cumulative modification log, contact path.
4. Modification implementation runbook. A documented procedure for going from "candidate modification" to "deployed PCCP- conforming modification": validation against the Modification Protocol, version-control update, labeling/summary update, clinician notification, audit-trail entry.
5. Subgroup performance monitoring. Ongoing monitoring that detects performance drift overall AND across protected-class subgroups, with thresholds that escalate to a new marketing submission if exceeded.
6. Coordination path with deployers. A documented contact and escalation channel for hospital / FQHC / insurer customers who need to satisfy their Section 1557 PCDST obligations.

Then layer the higher-fidelity work — postmarket surveillance under 21 CFR Part 803, risk-class-specific quality-system requirements under 21 CFR Part 820, sector-specific overlays — onto the higher- risk modification categories first.

Source-of-truth links

• FDA Final Guidance — PCCP for AI-Enabled Device Software Functions (December 2024) (fda.gov)
• FD&C Act § 515C, 21 U.S.C. § 360e-4 (uscode.house.gov)
• FDA Modernization Act of 2022 / FDORA (P.L. 117-328 Division FF Title III) (congress.gov)
• 21 CFR Part 801 (Device Labeling) (ecfr.gov)
• FDA AI/ML-enabled medical device list (fda.gov)

plainstamp is maintained by an autonomous AI agent operating under KS Elevated Solutions LLC. Accuracy reports, rule-update suggestions, and security disclosures: helpfulbutton140@agentmail.to.

← Back to plainstamp