FDA PCCPs: What a Compliant Plan Actually Requires

FD&C Act Section 515C — added by the Food and Drug Omnibus Reform Act of 2022 — gives FDA authority to approve a Predetermined Change Control Plan for a device requiring a 510(k) or PMA, so that modifications consistent with the plan do not need a new marketing submission each time. The statute is broad. FDA's final guidance for AI-enabled device software functions, issued December 4, 2024, is specific: a PCCP has three required elements, and FDA will not accept a plan that treats them as optional framing around a general promise to keep improving the device.

What the statute allows, and what the guidance requires

Section 515C's authority is not AI-specific — it applies to any device change control plan FDA agrees to review under a 510(k) or PMA. FDA's December 2024 guidance narrows that broad authority into a concrete submission expectation for one category: devices with AI-enabled device software functions. A PCCP under this guidance is not a statement of intent to iterate responsibly. It is a bounded, evidence-based commitment: specific modifications, a specific method for validating each one, and a specific accounting of the risk the plan itself introduces.

The three elements, and where plans fall short

• Description of Modifications. The specific changes planned, with explicit bounds — what the modification can and cannot alter about the device's intended use, indications, and fundamental operating principle. A vague description ("improve model accuracy over time") is not a description FDA can review against.
• Modification Protocol. The methodology, verification and validation activities, and acceptance criteria for developing and implementing each described change — the evidence FDA is trusting in place of a new submission.
• Impact Assessment. The benefits and risks of the modifications and of relying on the PCCP mechanism itself, including how the protocol mitigates any new risk the changes introduce. FDA's final guidance added an explicit expectation that this assessment consider the device's intended-use populations — ethnicity, gender, disease severity — and intended-use environments.

A PCCP is not a request for permission to keep improving the device. It is a commitment to a specific method, reviewed once, that has to hold for every modification made under it. Why generic plans get sent back

What changed between the draft and the final guidance

FDA's April 2023 draft was scoped to machine-learning-enabled device software functions. The final guidance widened that to all AI-enabled device software functions — a broader population than many manufacturers were tracking against the draft. Two other additions are easy to miss reading only a summary: the final guidance recommends manufacturers account for the unique characteristics of intended-use populations and environments in the Impact Assessment, and it newly expects labeling and public-facing documentation to be updated as the device changes under an approved plan, not just at the next full submission. A PCCP drafted against the 2023 draft's scope and silent on labeling updates is working from a superseded framework.

None of this is a reason to avoid a PCCP — the alternative is a new marketing submission for every meaningful model or software update, which is slower and more expensive for both sides. It is a reason to build the plan as one integrated package from the start, the way FDA's Software as a Medical Device and AI & ML compliance review teams read it, rather than assembling three sections independently and hoping they cohere. Teams that treat the PCCP as part of 510(k) predicate strategy from first submission tend to get a workable plan approved. Teams that bolt it on afterward tend to get a request for the version they should have written the first time.