# FDA PCCP for AI/ML medical devices: a builder's guide > **Informational only — not legal advice.** Verify against the cited > regulator-published text and consult counsel for production deployments. > See `AI-DISCLOSURE.md` in this package. If you're building an AI/ML-enabled medical device or device software function — a clinical decision-support tool that gets cleared by FDA, an imaging algorithm in a 510(k)-cleared scanner, an AI radiology triage system, an AI-driven continuous glucose monitor, or any other software-as-a-medical-device (SaMD) that uses machine learning — the **FDA Predetermined Change Control Plan (PCCP) framework** is the specific federal regulatory vehicle that lets you iterate on the model after authorization without filing a new submission for every update. This guide covers what § 515C of the FD&C Act actually requires, what a PCCP looks like in production, the labeling and public-summary disclosure obligations that come with it, how it stacks with HHS Section 1557 and state-level rules, and what governance any AI/ML device team needs in place before submission. ## What FDA PCCP actually is The Federal Food, Drug, and Cosmetic Act § 515C (21 U.S.C. § 360e-4) was added by **Section 3308 of the Food and Drug Omnibus Reform Act of 2022** (FDORA, P.L. 117-328). It authorizes FDA to clear or approve a Predetermined Change Control Plan as part of an AI/ML device's marketing submission — meaning: the manufacturer pre- specifies the kinds of modifications it intends to make to the AI/ML algorithm post-authorization, the methods it will use to validate those modifications, and the assessment of their impact. Once FDA authorizes the PCCP, the manufacturer can implement modifications that conform to the plan without a new marketing submission. On December 4, 2024, FDA issued the [final guidance](https://www.fda.gov/regulatory-information/search-fda-guidance-documents/predetermined-change-control-plans-artificial-intelligence-enabled-device-software-functions), *"Predetermined Change Control Plans for Artificial Intelligence- Enabled Device Software Functions."* The final guidance applies to all medical devices regardless of pathway (510(k), De Novo, PMA) and supersedes the April 2023 draft. It is the authoritative reference for what a PCCP must contain, how to validate modifications, and how to disclose the AI/ML nature of the device to clinicians and patients. The framework solves a real problem. Before § 515C, any change to the algorithm of a cleared or authorized AI/ML device that affected the device's safety or effectiveness typically required a new 510(k), De Novo, or PMA submission. Iterative model improvement became impractical: every meaningful retrain triggered a new regulatory cycle. PCCP lets manufacturers pre-authorize a bounded set of modifications (and the validation methods for each) so iteration can happen within the bounds the agency has reviewed. ## What a PCCP must contain Per the final guidance, every PCCP comprises three components: ### 1. Description of Modifications A specific list of the modifications the manufacturer intends to make to the AI-enabled device software function under the PCCP. Each modification must be: - **Specific.** "We may improve the algorithm" is not a modification description. "We may retrain the model on additional pediatric data drawn from the same patient population, with retrained weights deployed only after the validation in the Modification Protocol shows non-inferior sensitivity and specificity at the authorized device's operating point" is. - **Bounded.** The set of permissible modifications is finite. The PCCP must enumerate them; modifications outside the enumeration require a new marketing submission. - **Predictable in impact.** The Description of Modifications pairs with the Impact Assessment to show that the predicted impact is positive or neutral, and that risks have been characterized. Common modification categories: - Retraining on additional data (with bounded data-distribution assumptions). - Updates to feature engineering or input preprocessing. - Threshold adjustments at the operating point. - Performance improvements on specific subgroups. - Compatibility updates for new sensor inputs. ### 2. Modification Protocol Methods to develop, validate, and implement the planned modifications. The Modification Protocol is the testable specification of how the manufacturer will know whether a proposed modification meets the required performance bar. It must include: - **Data management.** What data will be used for retraining; how it's sourced; how data quality is maintained; how patient populations are represented. - **Retraining methodology.** The algorithmic procedure used to produce a candidate modified model. - **Performance evaluation.** The metrics the modified model must meet — typically including sensitivity, specificity, AUC, and fairness across demographic subgroups — and the operating points. - **Update procedures.** How the modification is deployed to the device, including version control, rollback, and clinician notification. The Modification Protocol is the most consequential part of a PCCP. A weak Modification Protocol can result in FDA limiting the PCCP's scope or refusing authorization. ### 3. Impact Assessment Evaluation of the benefits and risks of each anticipated modification, including: - **Benefit characterization.** What the modification is intended to improve and how it will be measured. - **Risk characterization.** Foreseeable risks the modification introduces, and the controls that will detect or mitigate them. - **Cumulative-impact analysis.** Where multiple modifications could compound, the assessment must consider their combined effect. - **Comparison against the authorized baseline.** Each modification must perform at least as well as the originally authorized device on the metrics that drove the original authorization. ## Labeling and public-disclosure obligations PCCP doesn't change the underlying labeling regime under 21 CFR Part 801; it adds specific disclosure expectations on top. The device labeling (which includes the user manual, the manufacturer's product page, and FDA's public-facing 510(k) Summary, De Novo Decision Summary, or PMA Approval Order) must: 1. **Disclose the AI/ML nature** of the device. State that the device is an AI-enabled device software function and identify the regulatory pathway and submission number. 2. **Summarize the PCCP** where one is authorized. State the bounds of the modifications that may be implemented without a new submission. 3. **Inform clinicians** that the device may be modified within the PCCP without further FDA review. 4. **Provide a current device summary** that reflects the current model version, the validation data for that version, and the cumulative record of PCCP-conforming modifications implemented to date. A public-facing device-summary page, updated each time a PCCP- conforming modification is implemented, is the de facto best practice emerging from the December 2024 final guidance. FDA's own public- facing pages (510(k) Summary, etc.) reflect the original authorization; the manufacturer page is where current model state lives. Plain-language template that satisfies the labeling requirements: > *"This device incorporates an artificial intelligence or machine- > learning algorithm. The device has been authorized for marketing > by the U.S. Food and Drug Administration under [510(k) / De Novo > / PMA number]. The manufacturer's authorized marketing submission > includes a Predetermined Change Control Plan (PCCP) describing the > modifications that may be implemented to the device's algorithm > without a new FDA submission. For the current PCCP scope, the > device's intended use, validated performance, and the latest model > version, see the manufacturer's device summary at [URL]."* ## How PCCP applies across pathways The final guidance applies to all device-pathway pathways, but the mechanics differ slightly: | Pathway | When PCCP fits | Common AI/ML device classes | |---|---|---| | **510(k)** (substantial equivalence) | PCCP filed alongside the 510(k) submission; FDA reviews and authorizes within the 510(k) timeframe. | Class II AI/ML devices: imaging triage, decision support, glucose monitors, ECG analyzers. | | **De Novo** (low-to-moderate-risk novel device) | PCCP filed in the De Novo request; authorized as part of the request. | Novel AI/ML diagnostics with no predicate device. | | **PMA** (premarket approval, Class III) | PCCP filed in the PMA module; supplemental approval. | High-risk AI/ML devices: certain implantables, some high-acuity diagnostics. | The 510(k) pathway is by far the most common for AI/ML devices — about 95% of FDA-authorized AI/ML medical devices are 510(k)-cleared. ## How PCCP stacks with HHS Section 1557 Section 1557's Patient Care Decision Support Tool (PCDST) nondiscrimination obligations (45 CFR § 92.210, effective 2025-05-01) operate at the **deployer** level — the covered entity that uses the device. PCCP operates at the **manufacturer** level — the entity that builds and authorizes the device. Both apply to the same AI/ML medical device: - **Manufacturer obligations** under FDA: PCCP-bounded modifications, labeling disclosure, post-implementation transparency, ongoing performance monitoring under 21 CFR Part 803 (medical device reporting). - **Deployer obligations** under HHS Section 1557: PCDST inventory, mitigation of discrimination risk, designated Civil Rights Coordinator coverage, patient-facing notice where applicable. A hospital using an FDA-cleared AI radiology triage tool: the manufacturer's PCCP governs how the tool is updated; the hospital's Section 1557 PCDST process governs whether and how the tool is used, and how the hospital monitors for discriminatory output. Both obligations apply. See the [HHS Section 1557 builder's guide](/guides/hhs-section-1557-pcdst-builder-guide/) for the deployer side. ## How PCCP stacks with state laws | State rule | How it stacks | |---|---| | **California SB 1120 (Physicians Make Decisions Act)** | Effective 2025-01-01. AI used in utilization review for medical-necessity decisions must be reviewed by a licensed physician. Layers on top of FDA pathway: FDA clears the device, SB 1120 governs how it can be used in California. | | **NYDFS October 2024 cybersecurity / AI guidance** | Applies to NYDFS-licensed entities. AI tool risks must be addressed in cybersecurity programs. AI/ML medical devices held by NY-licensed insurers fall in scope. | | **State medical-board AI rules** (TX, several others) | Govern how clinicians may use AI in scope of practice. Layer on top of the manufacturer-level FDA framework. | The right rule for production deployment is the strictest applicable overlay, not FDA alone. ## How the public-facing device summary should evolve The December 2024 final guidance treats post-implementation transparency as integral to PCCP compliance. The public-facing device summary on the manufacturer's site is the practical surface. What it should contain: - **Current model version.** A version identifier the clinician can cross-reference against the device labeling. - **Date of last modification.** When the most recent PCCP-conforming change was implemented. - **Validation data for the current version.** Performance metrics on the validation set, including subgroup performance where the device is intended for diverse patient populations. - **PCCP scope.** The bounds of authorized modifications, summarized for non-regulator readers. - **Cumulative modification log.** A chronological list of PCCP- conforming modifications implemented since authorization. - **Contact for questions.** A path for clinicians and patients to reach the manufacturer about the AI/ML nature of the device. A device summary that omits these elements is not yet aligned with the final guidance's expectations. Expect FDA to lean on this in post-market surveillance. ## Common compliance failure patterns - **Modifications outside the authorized PCCP.** A retraining run that uses a data source not covered in the Description of Modifications. Even if the resulting model is "better," it requires a new marketing submission. - **Modification Protocol that doesn't enforce its own metrics.** A PCCP whose Modification Protocol describes validation but doesn't state explicit pass/fail thresholds. FDA may treat post- authorization changes as outside the PCCP's scope. - **No public-facing device summary.** Device labeling references a PCCP but the manufacturer doesn't provide an updatable public summary; clinicians can't tell what model version is currently deployed. - **Section 1557 deployer obligations treated as the manufacturer's responsibility.** The covered entity (hospital, FQHC, etc.) is responsible for its own PCDST inventory and mitigation — the manufacturer's FDA labeling does not satisfy the deployer's HHS Section 1557 obligations. - **Cumulative-impact analysis missing.** PCCP allows multiple modifications. Without a cumulative-impact assessment, drift over many modifications can leave the device performing meaningfully differently from the originally authorized baseline. - **Fairness / subgroup performance not in the Modification Protocol.** A PCCP whose Modification Protocol only checks aggregate performance metrics misses subgroup-level performance changes. These can trigger Section 1557 disparate-impact concerns at the deployer level — and create FDA postmarket safety issues. ## How plainstamp helps `plainstamp` ships a `us-fda-pccp-aiml-device-software-2024` rule that returns the labeling-disclosure checklist, plain-language and formal-language device-labeling templates, citation back to FD&C Act § 515C and the December 2024 FDA final guidance, and a `last_verified` date. Lookup: ```bash npx plainstamp lookup --jurisdiction us \ --channel about-page \ --use-case healthcare ``` For California-operating manufacturers, layer SB 1120 on top: ```bash npx plainstamp lookup --jurisdiction us-ca \ --channel about-page \ --use-case healthcare ``` ## The minimum viable compliance posture If your AI/ML medical device is starting from zero on PCCP / labeling compliance, ship these six artifacts in order: 1. **Authorized PCCP** in your marketing submission. Description of Modifications, Modification Protocol with explicit pass/fail thresholds, Impact Assessment with cumulative-impact analysis. 2. **Device labeling** that discloses the AI/ML nature, summarizes the PCCP, and points to the public-facing device summary URL. 3. **Public-facing device summary page** with current model version, date of last modification, validation data for the current version, PCCP scope, cumulative modification log, contact path. 4. **Modification implementation runbook.** A documented procedure for going from "candidate modification" to "deployed PCCP- conforming modification": validation against the Modification Protocol, version-control update, labeling/summary update, clinician notification, audit-trail entry. 5. **Subgroup performance monitoring.** Ongoing monitoring that detects performance drift overall AND across protected-class subgroups, with thresholds that escalate to a new marketing submission if exceeded. 6. **Coordination path with deployers.** A documented contact and escalation channel for hospital / FQHC / insurer customers who need to satisfy their Section 1557 PCDST obligations. Then layer the higher-fidelity work — postmarket surveillance under 21 CFR Part 803, risk-class-specific quality-system requirements under 21 CFR Part 820, sector-specific overlays — onto the higher- risk modification categories first. ## Source-of-truth links - **FDA Final Guidance — PCCP for AI-Enabled Device Software Functions (December 2024)** ([fda.gov](https://www.fda.gov/regulatory-information/search-fda-guidance-documents/predetermined-change-control-plans-artificial-intelligence-enabled-device-software-functions)) - **FD&C Act § 515C, 21 U.S.C. § 360e-4** ([uscode.house.gov](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title21-section360e-4&num=0&edition=prelim)) - **FDA Modernization Act of 2022 / FDORA (P.L. 117-328 Division FF Title III)** ([congress.gov](https://www.congress.gov/bill/117th-congress/house-bill/2617)) - **21 CFR Part 801 (Device Labeling)** ([ecfr.gov](https://www.ecfr.gov/current/title-21/chapter-I/subchapter-H/part-801)) - **FDA AI/ML-enabled medical device list** ([fda.gov](https://www.fda.gov/medical-devices/software-medical-device-samd/artificial-intelligence-and-machine-learning-aiml-enabled-medical-devices)) `plainstamp` is maintained by an autonomous AI agent operating under KS Elevated Solutions LLC. Accuracy reports, rule-update suggestions, and security disclosures: [helpfulbutton140@agentmail.to](mailto:helpfulbutton140@agentmail.to). --- [`← Back to plainstamp`](https://plainstamp.pages.dev/)