Predetermined Change Control Plans: Letting Medical AI Improve Without Losing Its Approval

A predetermined change control plan, or PCCP, is a document a device maker submits and gets authorized alongside the device itself, describing in advance the specific changes the product may undergo after approval and how each change will be tested before it ships. For an AI or machine learning device, it is the mechanism that lets the model be retrained or retuned without a new regulatory submission every time. The United States Food and Drug Administration built the idea to answer a real tension: software that learns can get better with more data, yet a clearance is granted to a fixed version. A PCCP is the pre-agreed lane that keeps a locked model from being the only lawful option.

The problem it solves

Most medical devices are approved as a fixed thing. A pump, a stent, a blood test with a defined cutoff. Change the design in a meaningful way and, historically, you owe the agency a new review before selling the new version. That logic works well for hardware. It fits software awkwardly, and it fits learning software worst of all.

An AI model trained on last year's images may quietly lose accuracy on this year's scanner, this year's patient mix, or a hospital it never saw in development. The honest response is to retrain or recalibrate. Under the old default, each update could trigger its own submission, slow enough that many teams simply froze the model and let it age. Freezing feels safe. It is not always safe. A stale model drifting from current practice carries its own risk, easy to overlook because nothing visibly changed.

The PCCP reframes the question. Rather than ask permission after the fact for each individual update, a manufacturer proposes, up front, a bounded set of changes it expects to make and a disciplined method for making them. The agency reviews that plan as part of the original submission. Once authorized, changes that stay inside it can be implemented under the manufacturer's own quality system, without returning for a fresh review each time.

The three parts of a plan

The FDA's framework, set out in final guidance issued in December 2024 for AI-enabled device software functions, asks for three linked pieces. Read together, they show what a PCCP actually commits a company to.

Description of modifications

This is the list of what may change, written specifically. A vague promise to improve the model will not do. The plan names concrete, bounded items: retraining on new data of a defined type, adjusting a decision threshold within a stated range, or extending performance to a patient subgroup the device already targets. The changes are expected to stay within the device's original intended use. A plan is not a license to become a different product. It describes a defined envelope, and the tighter and more verifiable that envelope, the easier it is to defend.

Modification protocol

This is the how. For each listed change, it spells out the data management, retraining, verification, and validation steps, plus the acceptance criteria a new version must meet before release. Think of it as the test the model has to pass, agreed in advance, so that a claim of "we retrained it" is never bare. A good protocol reads like a standard operating procedure someone else could follow and audit.

Impact assessment

This is the why-it-is-safe. The impact assessment weighs benefits and risks of each planned change, individually and together, and describes how they are controlled. For learning systems the recurring hazards are performance drift and the introduction or amplification of bias across subgroups. The assessment is where a team commits to monitoring, to thresholds that trigger investigation, and to rolling back to a prior version if a change underperforms in the field.

Why adaptive models need extra guardrails

A change that improves average accuracy can still degrade care for a specific group. That is the quiet failure mode of retraining, and it is why the impact assessment cannot be a formality. New training data carries the distribution it was collected from. If that distribution skews toward one type of site or one segment of patients, the "improved" model may be improved mainly for them.

Two guardrails matter most. One is holding intended use fixed, so that the envelope of allowed change does not let a device drift into new claims, populations, or clinical roles under the cover of routine updates. The other is real-world monitoring with a way back. An authorized plan is only as trustworthy as the maker's ability to notice that a shipped update is underperforming and reverse it. Transparency belongs here too. The December 2024 guidance emphasizes that labeling should make clear when a device was authorized with a PCCP, so clinicians and users know the version in front of them can evolve within defined limits.

It helps to be clear about what a PCCP is not. It is not open-ended online learning that rewrites itself at the bedside. Every allowed change was described, its test was pre-specified, and its risk was assessed before authorization. The plan trades unlimited freedom for pre-agreed, auditable freedom.

Where the framework stands

The legal footing comes from Section 515C of the Federal Food, Drug, and Cosmetic Act, added by the Food and Drug Omnibus Reform Act of 2022, which gave the agency explicit authority to authorize such a plan within a premarket submission. That authority spans the common device pathways: 510(k) clearance, De Novo, and premarket approval. The December 2024 guidance is the AI-specific companion that tells manufacturers how to write the three components well.

This direction is also international. Regulators in the United States, Canada, and the United Kingdom have published shared guiding principles for these plans, converging on the same instincts: keep each plan focused on clearly defined and verifiable changes, and keep it risk-based and evidence-based so patient safety stays central. Regulators generally encourage early conversation, since a plan is easier to authorize when its boundaries were discussed before the submission was written.

For anyone building or evaluating medical AI, "how will this be allowed to change" deserves as much design attention as "how does this perform today." A locked model and an unbounded one are both easy to describe and hard to defend. The predetermined change control plan is the structured middle: improvement on a leash, with the leash written down in advance. This article is educational, reflects public frameworks that continue to evolve, and is not medical, legal, or regulatory advice; readers should consult their own clinician for medical questions and qualified regulatory professionals for their specific product.