FDA's Predetermined Change Control Plan Guidance: What It Requires and Why It Matters for Health Systems

Why Health Systems Need to Understand the PCCP Framework

Most explanations of the FDA's Predetermined Change Control Plan (PCCP) guidance are written for device manufacturers — the organizations that draft PCCP submissions, navigate 510(k) pathways, and manage FDA review. That framing misses a significant portion of the people who will actually live with the consequences of this framework: the health systems, clinical governance committees, and procurement teams that deploy AI-enabled devices in patient care settings.

The core problem the PCCP framework addresses is sometimes called the 'locked algorithm' challenge. Until recently, AI-enabled medical devices cleared by FDA were static — once cleared, the algorithm could not adapt or change without a new marketing submission. This created a mismatch between how AI systems actually improve (through iterative updates on new data) and how the regulatory system was structured (requiring a new submission for each meaningful change).

The PCCP framework resolves this by allowing manufacturers to pre-define specific algorithm changes — and the methods to validate and implement them — so those updates can be made after clearance without triggering a new FDA submission. That is a meaningful regulatory innovation. It is also a shift that creates distinct obligations for the deployer side of the ecosystem.

When a PCCP-covered device updates algorithmically in a clinical environment, the clinical staff using that device may encounter changed behavior, updated labeling, and revised performance characteristics — without any new FDA review having occurred. Whether those changes are appropriate, properly validated, and correctly communicated to clinical users becomes a governance question for the health system, not just a compliance question for the manufacturer.

This article is addressed to governance and procurement professionals — not device developers. It explains what the PCCP framework requires in terms of labeling transparency, modification boundaries, vendor accountability, bias obligations, and post-market surveillance — and translates those requirements into practical questions health systems should be asking their AI device vendors. Readers who are new to how FDA regulates AI devices generally may find it useful to first review how the U.S. regulatory framework for AI in medicine actually works before proceeding.

How PCCP-Authorized Devices Differ from Traditionally Cleared AI Devices

A traditionally cleared AI device has a locked algorithm. The version of the software that received FDA clearance is the version that can legally be deployed. Any meaningful change — whether to the algorithm's training data, architecture, output thresholds, or intended use — requires a new marketing submission before that change can be implemented in clinical use.

A PCCP-authorized device operates differently. The manufacturer, at the time of the original marketing submission, submits a PCCP that pre-defines specific modifications the device may undergo after clearance, along with the methods to develop, validate, implement, and monitor those changes. FDA reviews and authorizes the PCCP as part of the original submission. Once authorized, the manufacturer can implement those pre-defined modifications without filing a new marketing application — provided the modifications are executed exactly as specified in the authorized plan.

The statutory authority for this mechanism comes from the Food and Drug Omnibus Reform Act (FDORA) of 2022, which added section 515C to the Federal Food, Drug, and Cosmetic Act. The concept was first introduced in a 2019 FDA discussion paper and went through a 2023 draft guidance before reaching its December 2024 final version, subsequently updated in August 2025.

For health systems, the practical implication is straightforward but easy to overlook: a device operating under an authorized PCCP can behave differently over time than it did when it was first deployed — and those changes may arrive without the health system having any formal notification process in place unless that process is explicitly built into vendor contracts and governance workflows.

The Three PCCP Components: A Deployer's Reading

The PCCP framework requires manufacturers to include three components in every authorized plan: a Description of Modifications, a Modification Protocol, and an Impact Assessment. These components are usually explained in terms of what manufacturers must draft. What matters equally — and is rarely addressed — is what each component means for a health system evaluating a vendor's PCCP.

Description of Modifications: What Can Change

This component specifies the exact modifications the manufacturer is pre-authorizing — what aspects of the device's algorithm, performance, or software may change under the plan. For a procurement team or governance committee, this is the most important section to review when evaluating a vendor's PCCP.

Key questions to ask: Are the described modifications specific and bounded, or are they written so broadly that almost any change could be characterized as within scope? Does the description clearly distinguish between changes that are within the PCCP and changes that would require a new submission? Is the intended use population explicitly defined, and do the planned modifications stay within that population?

Modification Protocol: How Changes Are Validated

The Modification Protocol defines the methods the manufacturer will use to develop, validate, and implement each modification — including the performance requirements the modified device must meet before deployment. Critically, the protocol must address bias mitigation in data management and must include post-market surveillance strategies specifically related to post-modification safety and effectiveness monitoring.

The protocol must also describe what happens when a modification fails its performance requirements — including information on unresolvable failures in performance evaluation. For health systems with equity commitments, this section is where to look for evidence that the vendor has thought rigorously about whether algorithm updates perform consistently across demographic subgroups.

Impact Assessment: What Risk It Introduces

The Impact Assessment must analyze the benefits and risks — including risks of harm and unintended bias — for each planned change individually and in combination with other planned changes. It must also explain how the protocol's verification and validation activities ensure continued safety and effectiveness across the intended use populations and environments.

For a clinical governance committee, this section should answer the question: if this modification is implemented, what could go wrong, and how has the manufacturer demonstrated that the validation process would catch it? An Impact Assessment that is generic or that does not address specific patient populations or clinical environments is a signal that the PCCP may not be sufficiently rigorous.

Labeling and Transparency Obligations: What Vendors Must Disclose

The PCCP guidance establishes specific labeling requirements that directly affect health system users. These are not aspirational recommendations — they are baseline transparency obligations that health systems should verify in vendor contracts and confirm are being met in practice.

The guidance requires that device labeling clearly state that the device incorporates machine learning and has an authorized PCCP. This is so clinical users understand that the device may require software updates that could modify its performance, inputs, or use — and that such updates may occur without a new FDA review.

Beyond the baseline disclosure, labeling must be updated each time a PCCP-covered modification is implemented. The update must include:

• A description of which modifications were implemented.
• How the modifications were implemented (e.g., updated instructions for use, revised performance specifications).
• How users were informed of the change.

Manufacturers are also required to maintain public-facing device summaries that describe planned modifications, the testing methods and validation activities that govern them, the performance requirements each modification must meet, and the mechanism by which users will be notified when modifications are implemented.

When a modification results in a new device version or model, a new unique device identifier (UDI) is required. Health systems that track device versions in their medical device management systems — or that are subject to accreditation standards requiring device inventory accuracy — should ensure their vendor contracts specify how UDI updates will be communicated and reflected in device records.

Modification Boundaries: What Stays In Scope and What Requires a New Submission

One of the most practically important aspects of the PCCP framework for health systems is understanding where the boundaries of an authorized plan end. Not every change a manufacturer might want to make falls within PCCP scope — and health systems need to recognize when a vendor should be filing a new marketing application rather than relying on an existing plan.

The PCCP guidance is explicit that certain types of changes are always outside PCCP scope and require a new premarket submission regardless of what a manufacturer's authorized plan may say.

The provider-to-patient-facing example is particularly relevant for health systems that deploy AI tools in patient-accessible contexts. A vendor claiming that a shift from clinician-facing to patient-facing functionality is covered by an existing PCCP should be asked to produce the specific language in the authorized plan that supports that claim — and the health system should independently verify it.

Enforcement Risk and Vendor Contract Implications

The enforcement stakes of the PCCP framework are not theoretical. The FDA guidance is explicit: modifications that deviate from an authorized PCCP — whether by implementing changes outside the plan's defined boundaries or by failing to follow the protocol's validation requirements — can render the device adulterated and misbranded under the Federal Food, Drug, and Cosmetic Act. The consequences include FDA enforcement action, up to and including seizure or injunction.

For health system legal and compliance teams, this creates a specific category of vendor contract risk. A device that has been rendered adulterated or misbranded because of its manufacturer's PCCP non-compliance does not become legally problematic only for the manufacturer — it affects the device's status in the health system's clinical environment. Deploying a device that is adulterated under FDA law, even unknowingly, carries its own regulatory and liability exposure.

The guidance also notes that FDA may, in certain circumstances, withhold clearance of a PCCP submitted in a 510(k) based on findings in the manufacturer's regulatory history that demonstrate failure to comply with quality system regulations. This means a vendor's past compliance record is directly relevant to the reliability of its PCCP authorization — and is a legitimate due diligence question for procurement teams.

• Contracts should specify that the vendor will provide written notification before implementing any PCCP-covered modification, with sufficient lead time for the health system to review updated labeling and inform clinical staff.
• Contracts should require the vendor to certify that each implemented modification was executed in accordance with the authorized PCCP and that all required labeling updates have been completed.
• Contracts should establish a clear remediation pathway — including the right to suspend or terminate the agreement — if the vendor implements a modification outside the authorized PCCP or fails to follow the required protocol.
• Contracts should require the vendor to notify the health system immediately if FDA initiates any enforcement action related to the device or the manufacturer's quality system compliance.
• Procurement due diligence should include a review of the manufacturer's FDA inspection history and any warning letters or consent decrees that could affect the reliability of PCCP authorization.

Diversity, Bias, and Health Equity Obligations in the PCCP Framework

One of the most significant additions in the final PCCP guidance — compared to the 2023 draft — is an explicit requirement that manufacturers consider the unique characteristics of their device's intended use populations when developing their PCCP. The guidance specifically calls out race, ethnicity, disease severity, gender, and age as dimensions that must be considered in the context of intended use populations and intended environments.

This obligation appears in multiple components of the PCCP framework. The Modification Protocol must address bias mitigation in data management. The Impact Assessment must analyze risks of unintended bias for each planned modification, individually and in combination. And the post-market surveillance plan must include monitoring for performance deviations that could signal differential outcomes across patient populations.

For health systems with active health equity programs or clinical AI governance policies that include equity requirements, this creates a direct connection between FDA's regulatory requirements and internal governance obligations. A vendor's PCCP should be evaluable against the health system's own equity standards — not just against the regulatory minimum.

Practically, health systems should ask vendors to provide the demographic composition of the datasets used to validate each PCCP-covered modification, the subgroup performance metrics from that validation, and the monitoring thresholds that would trigger a rollback or remediation if post-deployment performance diverges from validation results in specific patient populations.

Post-Market Surveillance and QMSR Alignment

Post-market surveillance is not optional under the PCCP framework — it is a formal requirement. The guidance specifies that post-market surveillance plans may include real-world monitoring and notification requirements if the device does not function as intended pursuant to the authorized PCCP. This framing makes ongoing performance monitoring an explicit condition of PCCP authorization, not a discretionary quality practice.

These obligations align with — and are reinforced by — the FDA's Quality Management System Regulation (QMSR), which aligns 21 CFR Part 820 with ISO 13485 and became effective February 2, 2026. As of this article's publication in Q2 2026, QMSR is already in effect. Post-market surveillance plans and procedures are a formal requirement under ISO 13485, and manufacturers operating under the PCCP framework are now subject to both the PCCP-specific surveillance requirements and the elevated quality system standard that QMSR represents.

For health systems, this has a practical implication: the standard for ongoing monitoring and record-keeping that vendors must meet has risen. A vendor that cannot demonstrate a functioning post-market surveillance program — with documented real-world performance data, defined monitoring thresholds, and a clear escalation process for performance deviations — is not meeting the current regulatory standard for PCCP-authorized devices.

International Alignment: The Five Guiding Principles

The PCCP framework is not exclusively a U.S. regulatory construct. FDA, Health Canada, and the UK's Medicines and Healthcare products Regulatory Agency (MHRA) jointly identified five guiding principles that should govern any PCCP framework. These principles provide a useful evaluation lens for health systems — particularly those operating in multinational or cross-border clinical environments.

• Focused and Bounded: Changes must be limited to modifications within the device's intended use, with plans to verify, validate, and revert to an earlier version if needed.
• Risk-Based: The intent, design, and implementation of modifications must be driven by risk management throughout the total product lifecycle.
• Evidence-Based: Evidence generated throughout the total product lifecycle must ensure ongoing safety and effectiveness of the device.
• Transparent: Clear information must be provided to users and stakeholders before and after changes, including characterization of data reflecting the intended population and monitoring of deviations in device performance.
• Total Product Lifecycle Perspective: The PCCP must consider all stakeholder perspectives and support existing regulatory, quality, and risk management measures throughout the device's entire lifecycle.

The EU currently has no program comparable to the FDA's PCCP framework. This means EU-based AI device manufacturers face a more restrictive post-market modification environment than their U.S. and UK counterparts, and that globally deployed AI devices may operate under different modification regimes depending on jurisdiction. Health systems deploying AI devices across multiple countries should map which regulatory framework governs each deployment and whether the device's PCCP authorization applies in each jurisdiction.

Practical Questions Health Systems Should Ask AI Device Vendors

The following questions are organized around the key accountability areas the PCCP framework creates. They are intended for use in vendor evaluation, contract negotiation, and ongoing governance review — not as a compliance checklist for manufacturers.

PCCP Authorization Status

• Does this device have an authorized PCCP, and through which clearance pathway was it authorized (510(k), De Novo, or PMA)?
• Can you provide the current public-facing device summary that describes the authorized modifications and the validation methods that govern them?
• Has the PCCP been modified since initial authorization? If so, through what mechanism, and what changed?

Modification Scope and User Notification

• What specific modifications are covered by the authorized PCCP, and what types of changes would require a new FDA submission?
• What is your process for notifying health system customers before implementing a PCCP-covered modification? How much advance notice do you provide?
• How is device labeling updated when a modification is implemented, and how are clinical users informed?
• When a modification creates a new device version and a new UDI, how will you communicate that to us for device inventory tracking purposes?

Bias, Diversity, and Equity

• What demographic composition characterizes the datasets used to validate each planned modification under the PCCP?
• Do you report subgroup performance metrics (by race, ethnicity, sex, age, disease severity) for each PCCP-covered modification validation?
• What are the monitoring thresholds that would trigger a rollback or remediation if post-deployment performance diverges across patient subgroups?

Post-Market Surveillance and Quality System

• What does your post-market surveillance plan for this device include, and how does it address real-world performance monitoring following PCCP-covered modifications?
• Has your quality management system been updated to reflect the QMSR (21 CFR Part 820 aligned with ISO 13485, effective February 2, 2026)? Can you confirm that PCCP implementation procedures are formally documented within your quality system?
• What is your process if a PCCP-covered modification fails its post-deployment performance requirements? Does your plan include a rollback mechanism?

Compliance History and Contract Remedies

• Has your organization received any FDA warning letters, consent decrees, or adverse inspection findings related to quality system compliance in the past five years?
• What contractual remedies are available to us if you implement a modification outside the authorized PCCP or fail to follow the required validation protocol?
• Will you notify us immediately if FDA initiates any enforcement action related to this device or your organization's quality system compliance?

For broader context on how the PCCP framework fits within FDA's overall approach to AI regulation, the AI regulatory landscape in 2026 provides a comprehensive overview of the multi-agency environment in which PCCP-authorized devices operate.