FDA PCCP Guidance in 2026: What a Predetermined Change Control Plan for an AI-Enabled Device Should Contain and Cover

What is an FDA PCCP?

An FDA PCCP is a plan, reviewed and authorized as part of a device’s marketing submission, that lists the specific modifications a manufacturer intends to make later and the methods it will use to develop, validate, and implement them. FDA defines it as “the documentation describing what modifications will be made to a device and how the modifications will be assessed.” For AI-enabled software, the subject is usually the model.

Without a PCCP, a change that could significantly affect safety or effectiveness generally needs a new 510(k) (21 CFR 807.81(a)(3)), and a change affecting safety or effectiveness of a PMA device generally needs a PMA supplement (21 CFR 814.39(a)). With an authorized PCCP, a change specified in the plan and carried out under its protocol does not. The plan does not lower the bar. It moves the review earlier: FDA must reach its safety and effectiveness or substantial equivalence determination for each planned modification before it authorizes the plan.

What law authorizes a PCCP?

Section 515C of the Federal Food, Drug, and Cosmetic Act, codified at 21 U.S.C. 360e-4, was added by Section 3308(a) of FDORA, part of the Consolidated Appropriations Act, 2023 (Pub. L. 117-328). It sets three rules:

• Approved (PMA) devices: a supplemental application “shall not be required” for a change consistent with an approved PCCP, and FDA may approve a plan if the device remains safe and effective without any change (Sec. 515C(a)).
• Cleared (510(k)) devices: a new premarket notification is not required for a change consistent with a cleared PCCP, and FDA may clear a plan if the device remains safe and effective without any change and would remain substantially equivalent to the predicate (Sec. 515C(b)).
• Predicates: only the version of a device cleared or approved before changes under its PCCP may be used as a predicate (Sec. 515C(c)).

FDA “may require” that a plan include labeling for safe and effective use as the device changes, notification requirements if the device does not function as intended under the plan, and performance requirements for changes made under it (Sec. 515C(a)(3) and (b)(3)). Most of the rest of this guide describes what FDA recommends, not what the statute requires.

Is FDA’s PCCP guidance for AI-enabled devices final, and what does it cover?

Yes. FDA announced the final guidance in the Federal Register on December 4, 2024 (89 FR 96259, docket FDA-2022-D-2628), after an April 3, 2023 draft. FDA reissued it on August 18, 2025, and that version is current; its cover says “Document issued on August 18, 2025” and “Document originally issued on December 4, 2024.” A comparison of the December 2024 PDF, as archived by the Internet Archive, with the current one shows that the reissue’s text changes include a rewritten machine learning definition; 15 U.S.C. 9401 in place of Executive Order 14110 as the cited source of the AI and machine learning definitions; “sex” in place of “gender” in its lists of population characteristics, with gender identity, intersex status, and sexual orientation dropped from a footnote list; and the removal of references to the Blueprint for an AI Bill of Rights. The three PCCP components, the eligible submission types, and the policy on deviations are unchanged.

The guidance applies to AI-enabled device software functions, including the device constituent part of device-led combination products, reviewed through the 510(k), De Novo, and PMA pathways, whether model updates are made manually, automatically (“continuous learning”), or both.

Final does not mean binding. FDA says its guidance should be viewed only as recommendations unless specific statutory or regulatory requirements are cited, and that the word should “means that something is suggested or recommended, but not required.” Where its policy sections say “must,” they cite a statute or regulation.

What goes in each section of a PCCP?

FDA recommends three sections and recommends that the plan show which parts of the Modification Protocol apply to each listed modification, which for a plan with several modifications can be done with a traceability table. The Modification Protocol has four recommended components. FDA also recommends a standalone PCCP section with a title and version number.

The three sections of a PCCP, as FDA’s final AI guidance recommends

Section	What FDA recommends it contain	Question to settle before filing
Description of Modifications	An enumerated list of specific planned modifications with the rationale for each; whether each is implemented automatically, manually, or both; whether it applies uniformly to all devices (global) or differs by site or patient (local), with the local factors that warrant it; expected update frequency; and, where helpful, the labeling sections each change affects	Can each change, as written, be verified and validated?
Modification Protocol: data management	How new data will be collected, annotated, curated, stored, retained, and controlled; how training, tuning, and test data stay separate; how data will represent the intended use population, including race, ethnicity, sex, age, and disease severity as appropriate	Is the test data sequestered from model development?
Modification Protocol: re-training	The processing steps subject to change, the methods for implementing changes, the rationale for any architecture change, and the triggers for re-training, such as a data-volume threshold or observed drift	Are the triggers defined in advance?
Modification Protocol: performance evaluation	Study design, metrics, pre-defined acceptance criteria, and statistical tests for each modification, comparing the modified device with the original and the last modified version; a statement that if a modification has an unresolvable failure, such as not meeting its pre-defined acceptance criteria, the failure will be recorded and the modification will not be implemented (a failure whose root cause is unrelated to the PCCP is not unresolvable, and testing may be repeated)	Are acceptance criteria stated as specific values?
Modification Protocol: update procedures	How updates are deployed, how legacy users are affected, how users learn of changes in performance or inputs, how labeling will change, and post-market monitoring	Can a user tell which version is running?
Impact Assessment	A comparison of each modified version with the unmodified device; the benefits and risks of each change, including unintended bias; how the protocol’s testing controls those risks; how one change affects another; and the cumulative effect of all changes	Does it assess the changes together, not only one at a time?

Which changes can a PCCP cover, and which can it not?

FDA names three types of modification that may be appropriate:

• Changes to quantitative performance specifications, such as retraining on new data from the same intended use population and the same type and range of input signal.
• Changes to inputs and compatibility, such as new makes or models of an acquisition system, limited new input types, updated operating systems, or updated cloud infrastructure.
• Certain changes to use and performance, such as authorization for a subpopulation within the originally indicated population once enough data exist.

Each modification should maintain or improve safety or effectiveness, and FDA recommends a limited number of specific ones. A plan written as open permission to keep improving the model does not fit that recommendation.

The outer limit is the intended use. In FDA’s reading of Section 515C, changes in a PCCP must keep the device within its intended use and, for a 510(k) device, substantially equivalent to the predicate. FDA adds that changes should generally stay within the indications for use, because most indications changes are difficult to assess in advance; FDA says some indications changes may still be appropriate for a PCCP, for example certain changes to specify use with an additional device or component, and encourages discussing them through the Q-Submission Program. The guidance’s hypothetical examples show the line. A patient monitor retrained to cut false alarms within its plan needs no new submission, but adding a claim to predict instability before onset does. A skin lesion tool extended to smartphones that meet the plan’s camera specifications fits; a switch to thermographic cameras, or a patient-facing version, does not.

A PCCP is only for changes that would otherwise need a submission. Changes that would not are documented in the quality system, outside the plan, and for a PMA device are also reported to FDA in the periodic reports required as a condition of approval. FDA will consider automatic updates, says guardrails that define their range may help its review, and recommends discussing automatic updates through the Q-Submission Program.

Which FDA pathways accept a PCCP?

FDA considers these submission types appropriate to establish a PCCP: a Traditional or Abbreviated 510(k); an original De Novo request; and an original PMA, modular PMA, 180-day PMA supplement, panel-track supplement, or real-time PMA supplement where the plan comprises minor changes. A Special 510(k) is not on that list, but FDA says it may be appropriate to modify an existing PCCP for the manufacturer’s own device where well-established methods exist. A Pre-Submission cannot authorize a PCCP, though FDA encourages one for feedback.

Quality system history can block a plan. For a PMA, FDA says it must deny approval of a PCCP if the manufacturer’s methods, facilities, or controls do not conform to quality system requirements; for a 510(k), it may withhold clearance case by case based on a record of noncompliance.

De Novo shows how a PCCP can become a binding requirement for a device type. On June 17, 2026, FDA codified 21 CFR 892.2055, “radiological machine learning-based quantitative imaging software with predetermined change control plan,” in class II, from a De Novo order issued February 24, 2023 for Caption Health’s ejection fraction software. Its special controls require, among other things, documenting the planned modifications and the methodology for developing, verifying, and validating them; identifying and assessing their risks and the corresponding mitigations; and PCCP labeling that states the device has a PCCP, describes implemented modifications with a summary of current performance, and gives a version history, how modifications will be implemented, and how users will be informed of them. For that device type, those items are regulation, not recommendation.

What happens when a manufacturer uses, departs from, or changes a PCCP?

A change specified in the Description of Modifications and carried out under the Modification Protocol needs no new submission; the manufacturer documents it in its quality system. A change outside the plan is evaluated under the ordinary device modification rules. A change listed in the plan but not carried out as the protocol describes is, in FDA’s view, likely in most cases to need a new submission before it is implemented. FDA states that deviations from an authorized PCCP would generally cause the device to be adulterated and misbranded under Sections 501(f)(1) and 502(o). FDA does not treat choosing not to implement a planned change as a deviation.

FDA says changing the plan itself generally requires a new marketing submission containing the proposed revised PCCP; FDA recommends a summary of changes and, where practicable, a tracked-changes version.

The August 2025 guidance cites the Quality System regulation in 21 CFR Part 820. It also gives February 2, 2026 as the date the amended rule, which incorporates ISO 13485:2016 by reference, takes effect, and the eCFR has shown Part 820 as the Quality Management System Regulation since that date. Where the guidance sends a change to the quality system, read the current rule.

What labeling and transparency does FDA expect?

FDA recommends that labeling state that the device has an authorized PCCP and explain that it incorporates machine learning, so users know software updates may change its performance, inputs, or use. As modifications are implemented, FDA recommends that labeling describe them, summarize current performance and the data used, explain how they were implemented, and say how users are informed, for example through updated instructions for use or a version history. Labeling should not describe changes not yet implemented; FDA says that could mislead, and labeling that claims an unimplemented change could make the device misbranded. Where a device must bear a unique device identifier, a new version requires a new UDI (21 CFR 830.50).

FDA also recommends that the public 510(k) summary, De Novo decision summary, or PMA summary of safety and effectiveness describe the planned modifications, testing methods, validation and performance requirements, and how users will be told of changes, excluding trade secrets and confidential commercial information.

Separately, FDA, Health Canada, and the UK’s MHRA published five guiding principles for PCCPs in October 2023; the fourth, transparency, calls for clear information and plans for ongoing transparency to users before and after changes are implemented. The five are: focused and bounded, risk-based, evidence-based, transparent, and total product lifecycle perspective. The first includes mechanisms to detect and revert or stop a change that fails its performance criteria.

How does a PCCP fit with FDA’s draft AI lifecycle guidance?

The lifecycle draft covers the whole AI device submission, from model description and validation to transparency (including an example model card), bias, and cybersecurity, and refers manufacturers to the PCCP guidance for planned modifications. Its full title is “Artificial Intelligence-Enabled Device Software Functions: Lifecycle Management and Marketing Submission Recommendations,” issued in draft on January 7, 2025 (docket FDA-2024-D-4488). FDA’s guidance page still labeled it a draft, “Not for implementation,” as of October 26, 2026.

The overlap is post-market monitoring. The draft recommends a performance monitoring plan to catch drift and says a 510(k) generally does not need one unless a special control requires it, a De Novo may get one as a special control, and a PMA may carry one as a condition of approval. A PCCP’s update procedures and a monitoring plan draw on the same data, so draft them together.

FDA’s broader draft, “Predetermined Change Control Plans for Medical Devices” (August 22, 2024, 89 FR 67945, docket FDA-2024-D-2338), applies the same three components to all devices. It was still a draft as of October 26, 2026, so the AI guidance remains the only final PCCP guidance.

What changed for AI device PCCPs in 2026?

• Clinical decision support: On January 29, 2026, FDA reissued its CDS guidance, superseding the January 6, 2026 version; FDA describes the change as a minor correction deleting a reference to time-critical decision-making on pages 13 and 14. Software that meets all four statutory CDS criteria is not a device and needs no PCCP; FDA does not consider software for a critical, time-sensitive task or decision to meet the fourth.
• A PCCP device type in the CFR: 21 CFR 892.2055, codified June 17, 2026, described above.
• Generative AI: An August 2026 FDA discussion paper on generative AI-enabled devices asks how PCCP concepts might be adapted when future modifications cannot be fully prespecified, and how a manufacturer built on a third-party foundation model can respond to changes the model developer initiates. It is not guidance; feedback was due October 19, 2026 (docket FDA-2026-N-7874).
• Radiology CAD stays under 510(k): In an order effective September 17, 2026, FDA recorded its April 1, 2026 denial of a petition to partly exempt radiology computer-aided detection, diagnosis, and triage software from 510(k). So a model change to one of those devices that could significantly affect safety or effectiveness still needs a new 510(k) (21 CFR 807.81(a)(3)) unless an authorized PCCP covers it.
• Device list: FDA says it has authorized over 1,600 AI-enabled devices as of September 2026. It describes its public list of them as not comprehensive and says it will explore tagging devices that use foundation models.
• Advisory committee: The Digital Health Advisory Committee last met on November 6, 2025, on generative AI-enabled digital mental health devices. FDA’s committee page listed no 2026 meeting as of October 26, 2026.

How does the EU AI Act treat the same device?

A medical device is an Annex I Section A product. An AI system is high-risk under Article 6(1) if it is a safety component of a product covered by EU harmonisation law listed in Annex I, or is itself such a product, and that product must undergo third-party conformity assessment. Both conditions must be met. Under the Digital Omnibus (Regulation (EU) 2026/1744), in force since July 27, 2026, high-risk duties for AI in Annex I Section A regulated products apply from August 2, 2028 (was August 2, 2027).

The mechanics differ from a PCCP. For Annex I Section A products, the sectoral conformity assessment procedure applies and the AI Act requirements are checked inside it (Article 43(3)), and the provider must repeat the conformity assessment after any substantial modification (Article 43(4)). The AI Act has its own form of pre-planned change. A change foreseen or planned in the initial conformity assessment is not a substantial modification (Article 3(23)). For a high-risk system that continues to learn after it is placed on the market or put into service, changes to the system and its performance that the provider pre-determined at the initial conformity assessment, and that are part of the technical documentation under Annex IV point 2(f), are not a substantial modification (Article 43(4)). This guide does not cover the change rules in the EU medical device regulations themselves. The manufacturer of an Annex I Section A product is the provider of a high-risk AI safety component placed on the market or put into service under the manufacturer’s name or trademark (Article 25(3)). A high-risk system placed on the market or put into service before the applicable date is covered only if its design changes significantly from that date, but providers and deployers of high-risk systems intended to be used by public authorities must comply by August 2, 2030 (Article 111(2)). An FDA-authorized PCCP has no stated effect on any of these EU duties. See the EU AI Act compliance guide.

What should a device maker do before filing a PCCP?

• Confirm the software function is a device and not non-device CDS under the four criteria in 21 U.S.C. 360j(o)(1)(E)
• List the model changes expected over the device’s life and keep only those that would otherwise need a new 510(k) or PMA supplement and stay within the intended use
• Request a Pre-Submission on the draft PCCP, particularly for automatic updates, indications changes, combination products, or high-risk, life-sustaining, life-supporting, or implantable devices
• State acceptance criteria for each modification as specific values, and state that an unresolvable failure will be recorded and the modification will not be implemented
• Sequester test data, and document how new data will represent the intended use population and its subgroups
• Build the traceability table and an Impact Assessment that covers interactions and cumulative effects
• Draft the PCCP labeling statement, version history, and user notice process, and plan UDI updates for new versions
• Put the PCCP under version control in the quality management system and log each implemented modification
• For EU sales, map the same device to its Annex I Section A conformity assessment and the August 2, 2028 date, and record any pre-determined changes in the Annex IV technical documentation at the initial conformity assessment (Articles 3(23) and 43(4))

How this fits the other guides: the health care AI guide covers device status, HIPAA, Section 1557, and state law; the hospitals page covers what to ask a vendor about FDA status and PCCPs; and the manufacturers page covers AI in EU-regulated products.

This guide is general information as of October 2026, not legal or regulatory advice. Confirm the current guidance with FDA or regulatory counsel before filing.