A Predetermined Change Control Plan, or PCCP, is a section of an FDA marketing submission that describes planned modifications to an AI-enabled medical device, how they will be developed and validated, and how their impact will be assessed. Once authorized, modifications implemented according to the plan generally do not require a new marketing submission.
AI devices improve through retraining, yet significant changes traditionally required new submissions. PCCPs let manufacturers get planned changes authorized upfront, then implement them under an agreed protocol. FDA finalized guidance on PCCPs for AI-enabled device software functions in December 2024, building on authority Congress added to the Food, Drug, and Cosmetic Act. Taction Software builds regulated healthcare software across 200+ projects since 2013, and this guide explains PCCPs for engineering and product teams.
What a PCCP Is and Why It Matters
A PCCP lets manufacturers describe future changes to an AI device during the original submission, so FDA reviews the plan once rather than reviewing each change later. This matters because AI models often need retraining as data, populations and clinical practice change. Without a PCCP, many such changes could trigger new submissions, delaying improvements for months. The six points below explain the essentials of PCCPs for teams building AI medical devices, and our FDA SaMD compliance services support the engineering work behind these regulatory strategies. Planning ahead pays off. Start early.
Legal Authority
Congress added section 515C to the Food, Drug, and Cosmetic Act through the Food and Drug Omnibus Reform Act of 2022, giving FDA explicit authority to approve or clear PCCPs. This authority underpins FDA guidance describing what manufacturers should include in their plans.
Applies Across Pathways
PCCPs can be included in 510(k), De Novo and premarket approval submissions. The plan is reviewed as part of the marketing submission, and once authorized, it becomes part of the device’s authorized design, governing how future modifications must be developed and validated.
Avoids Repeated Submissions
Modifications implemented according to an authorized PCCP generally do not require a new marketing submission. This allows manufacturers to retrain models, improve performance or extend compatibility faster, while maintaining FDA oversight through the reviewed plan and documented protocol. Patients benefit sooner.
Changes Must Stay Within Scope
A PCCP covers only modifications described in the plan, implemented exactly as the protocol specifies. Changes outside the plan, or implemented differently, are evaluated under normal modification requirements, which may require new submissions depending on their nature and risk. Discipline matters.
Intended Use Must Be Maintained
Modifications under a PCCP must keep the device within its authorized intended use. Planned changes generally improve or maintain performance within that intended use, rather than expanding the device to substantially new indications, which typically require separate regulatory review. Scope stays clear.
Quality System Integration
PCCP modifications must be implemented under the manufacturer’s quality management system, with design controls, documentation and records. A PCCP does not replace quality system obligations. It defines how planned changes fit within them, and inspections can review that implementation. Records matter.
The Three Core Components of a PCCP
FDA guidance describes three core components every PCCP should include: a description of planned modifications, a modification protocol and an impact assessment. Together they tell FDA what will change, how changes will be developed and validated, and how benefits and risks were evaluated. Clear, specific components make review smoother and give engineering teams unambiguous rules for future work. The six points below explain each component and related elements, and our article on FDA SaMD for clinical AI provides broader regulatory context for AI device software. Each deserves careful drafting. Clarity wins.
Description of Modifications
This component lists the specific modifications the manufacturer plans to make, such as retraining with additional data or improving performance for defined conditions. Each modification should be specific enough that FDA understands what will change and why it remains within intended use.
Modification Protocol
The protocol explains how each modification will be developed, validated and implemented, including data management, retraining methods, performance evaluation, acceptance criteria and update procedures. It effectively becomes the rulebook engineering teams must follow whenever they implement a planned change. Precision matters.
Impact Assessment
The impact assessment evaluates benefits and risks of the planned modifications, including risks from implementing them, and explains how the protocol mitigates those risks. It demonstrates that the plan as a whole maintains reasonable assurance of safety and effectiveness for the device.
Labeling and Transparency
Labeling should inform users that the device includes an authorized PCCP and, as appropriate, describe how modifications may affect performance. Transparency helps clinicians understand that the device may change over time and how they will be informed when updates occur.
Traceability Between Components
Each planned modification should trace to its corresponding protocol elements and impact assessment. Clear traceability makes the plan easier to review and easier for engineering teams to follow, reducing the risk of implementing changes that drift outside the authorized scope.
Early FDA Engagement
FDA encourages manufacturers to discuss proposed PCCPs early, often through the Q-Submission program. Early feedback helps scope modifications appropriately and avoids investing in protocols FDA may consider insufficient, saving significant time during formal review of the marketing submission. Feedback shapes scope.
Modifications That Commonly Fit a PCCP
PCCPs work best for well-defined, foreseeable modifications that can be validated with clear methods and acceptance criteria. Manufacturers should think carefully about which future changes are likely and valuable, then describe them precisely. Overly broad modification descriptions are difficult to justify, while overly narrow ones limit flexibility. The six examples below illustrate categories of modifications manufacturers commonly consider. Whether a specific modification fits depends on the device and FDA’s review, so treat these as starting points, and confirm strategy with qualified regulatory professionals before preparing your submission. Specificity wins. Choose carefully.
Retraining With New Data
Retraining a model with additional data from the same intended population is a common planned modification. The protocol should define data sources, quality requirements, labeling methods and performance testing that retrained models must pass before deployment to users. Criteria must be predefined.
Performance Improvements
Planned changes aimed at improving sensitivity, specificity or other metrics within the intended use often fit PCCPs. Acceptance criteria should require that improvements in some metrics do not come at unacceptable cost to others or to performance across subgroups. Tradeoffs matter.
Input Compatibility
Extending compatibility to additional input sources, such as new imaging device models or data acquisition systems, may fit a PCCP when validation methods are well defined. The protocol should specify how compatibility will be tested and what performance must be demonstrated.
Subgroup Performance Improvements
Modifications improving performance for specific patient subgroups within the intended population can strengthen fairness and safety. The protocol should define subgroup analyses, minimum sample sizes and acceptance criteria demonstrating improvement without degrading performance for other groups. Fairness improves too. Equity matters.
Threshold Adjustments
Some devices use operating thresholds that balance sensitivity and specificity. Planned adjustments to thresholds within defined limits may fit a PCCP, provided the protocol specifies how adjustments are evaluated and how users are informed of resulting performance changes. Limits must be explicit.
Changes Usually Outside a PCCP
Modifications that change intended use, add substantially new indications or significantly alter how clinicians use the device typically fall outside PCCPs. These changes usually require separate regulatory review, so plan them as distinct regulatory projects rather than PCCP modifications. Plan them separately.
Building a Strong Modification Protocol
The modification protocol is where regulatory commitments meet engineering reality. A strong protocol specifies data, methods, testing and deployment in enough detail that any qualified team could follow it and reach consistent decisions. Vague protocols invite review questions and create risk during implementation. Engineering teams should help write the protocol, because they must live with it for years. The six elements below are those strong protocols address, aligned with the good machine learning practice principles regulators emphasize, and our healthcare ML model registry work supports the traceability these elements require.
Data Management Practices
The protocol should define how new training and test data are collected, curated, labeled and stored, including quality controls and independence between training and test sets. Data practices determine whether retrained models are trustworthy and whether results generalize to real clinical use.
Retraining Methods
The protocol should specify how retraining will be performed, including architecture constraints, hyperparameter ranges and procedures. Limiting what can change during retraining keeps modifications predictable and makes their impact easier to assess against the original authorized model. Predictability builds confidence.
Performance Evaluation
The protocol should define evaluation metrics, test datasets, statistical methods and acceptance criteria, including subgroup analyses. Retrained models must meet these criteria before deployment, and documented results become records demonstrating that modifications followed the authorized plan. Statistics must be sound.
Update Procedures
The protocol should describe how validated modifications are deployed, including version control, rollout methods, rollback plans and user communication. Controlled deployment prevents errors during release and ensures users receive appropriate information about changes in device performance. Rollback plans protect patients.
Real-World Performance Monitoring
The protocol should describe how device performance is monitored after modifications, detecting unexpected degradation. Monitoring connects PCCP implementation to post-market surveillance obligations, and our medical device post-market surveillance work supports these processes. Early detection protects patients and preserves clinician trust.
Cybersecurity Considerations
Modifications must not introduce cybersecurity vulnerabilities. The protocol should address how security is assessed for each change, including dependencies and deployment infrastructure, consistent with FDA expectations for cybersecurity in medical devices throughout their lifecycle. Security reviews accompany every change. Threats evolve.
MLOps That Makes PCCPs Work
An authorized PCCP is only valuable if engineering systems can execute it reliably. Manufacturers need MLOps infrastructure that enforces the protocol automatically, producing records that demonstrate every modification followed the plan. Manual processes struggle to provide this consistency over years of updates and staff changes. Good MLOps turns regulatory commitments into repeatable engineering workflows. The six capabilities below are those PCCP-ready MLOps platforms need, and our healthcare MLOps services build platforms designed around regulated device software requirements and documentation obligations. Automation makes compliance sustainable. Each capability reinforces the others. Invest early.
Versioned Data and Models
Every dataset, model and configuration must be versioned and linked, so any deployed model can be traced to exact training data and code. Versioning supports reproducibility, investigations and inspections, and it is foundational to demonstrating protocol compliance. Lineage is essential.
Automated Validation Pipelines
Validation pipelines should run protocol-defined tests automatically, applying acceptance criteria consistently. Automation prevents selective testing, reduces human error and produces standardized evidence for every modification implemented under the authorized plan. Evidence is generated the same way every time, which strengthens inspection readiness.
Approval Gates
Pipelines should require documented human approvals before deploying modifications, aligned with quality system responsibilities. Gates ensure qualified personnel review evidence, confirm protocol compliance and authorize release, creating clear accountability for every change reaching clinical users. Accountability stays clear. Signatures are recorded.
Audit-Ready Records
Every step, from data selection to deployment, should generate records stored for inspection. Audit-ready records demonstrate that modifications followed the PCCP, supporting FDA inspections, notified body reviews and internal quality audits without scrambling to reconstruct evidence. Preparation never panics. Retention follows policy.
Monitoring and Alerts
Production monitoring should track performance, data drift and usage, alerting owners when results deviate from expectations. Our healthcare AI observability service implements monitoring that connects technical signals with clinical performance metrics for device software. Owners respond quickly. Trends are reviewed regularly.
Software Lifecycle Alignment
MLOps processes should align with software lifecycle standards used for medical device software, such as IEC 62304, and with design controls. Alignment ensures model updates fit within established development, verification and maintenance processes rather than bypassing them. Consistency matters. Auditors expect it.
Engineering Services and Cost for PCCP Readiness
We help AI medical device manufacturers build the engineering systems that support PCCPs, working alongside their regulatory teams and consultants. We are engineers, not regulatory attorneys, and regulatory strategy decisions remain with qualified regulatory professionals. Our work is billed at a blended rate of $50 per hour, and the ranges below are planning figures, not quotes. The six options below describe how manufacturers engage us, and you can also hire FDA AI SaMD regulatory consultants through our network for regulatory strategy support. Scope is agreed first. Fees for consultants are separate.
PCCP Engineering Assessment: $3,000 to $10,000
An assessment of your data practices, training pipelines, validation and monitoring against PCCP needs typically takes 60 to 200 hours. It identifies gaps and produces an engineering plan supporting the protocol your regulatory team intends to submit. Findings are prioritized.
Protocol Engineering Support: $6,000 to $24,000
Helping regulatory teams draft technically precise modification protocols, including data, retraining, evaluation and update procedures, typically takes 120 to 480 hours. Engineering input ensures protocols are both reviewable and practical to execute for years. Reviewers see clarity. Engineers stay aligned.
Validation Pipeline Build: $15,000 to $60,000
Building automated validation pipelines that apply protocol-defined tests and acceptance criteria typically takes 300 to 1,200 hours, depending on model complexity, data sources and the number of planned modification types. Evidence generation becomes automatic, consistent and ready for inspection. Scope varies.
PCCP-Ready MLOps Platform: $40,000 to $104,000
A full MLOps platform with versioning, validation pipelines, approval gates, audit records and monitoring typically takes 800 to 2,080 hours, giving manufacturers infrastructure that executes authorized PCCPs reliably over the device lifecycle. Updates become routine and well documented. Teams move faster.
Post-Market Monitoring: $10,000 to $40,000
Implementing real-world performance monitoring, drift detection and reporting typically takes 200 to 800 hours, connecting PCCP modifications with post-market surveillance processes and quality system records required for regulated devices. Signals reach owners quickly. Reports stay current and complete. Patients stay safer.
Dedicated Engineers
Manufacturers can hire FDA SaMD engineers at about $8,000 per engineer per month, supporting ongoing model updates, validation and documentation under authorized PCCPs and quality system procedures. Engineers bring regulated software and machine learning experience, and engagements can start within weeks.
Why Choose Taction for PCCP Engineering
PCCP success depends on engineering systems as much as regulatory writing. Manufacturers need partners who understand machine learning, regulated software development and the documentation discipline inspections demand. Our team builds AI systems with traceability, validation and monitoring designed in, drawing on 200+ healthcare projects since 2013 and ISO 27001 certified processes. We work alongside your regulatory professionals rather than replacing them. The six points below explain what working with us on PCCP readiness looks like for AI medical device manufacturers, from early-stage startups to established device companies expanding AI portfolios.
Regulated Software Discipline
Our engineers follow documented processes aligned with medical device software expectations, including design controls, verification and traceability. That discipline makes PCCP implementation reliable rather than dependent on individual engineers remembering protocol details years after authorization. Inspections go smoothly. Quality stays consistent.
Machine Learning Depth
We build, evaluate and monitor clinical machine learning models across imaging, signals and text. Our healthcare AI evaluation services bring rigorous evaluation methods that strengthen both protocols and the evidence generated under them. Evidence becomes stronger and more defensible. Rigor matters.
Collaboration With Regulatory Teams
We translate regulatory commitments into engineering requirements and explain engineering realities to regulatory teams. This collaboration produces protocols that reviewers understand and engineers can execute, reducing friction between functions throughout submission and implementation. Everyone stays aligned. Handoffs become smoother. Trust builds.
Automation Over Manual Process
We automate validation, documentation and approvals wherever possible. Automation produces consistent evidence, reduces errors and lowers the ongoing cost of implementing modifications, making PCCPs practical to use rather than plans that teams avoid because execution is burdensome. Costs fall. Speed improves.
Clear Role Boundaries
We are engineers, not regulatory attorneys or FDA consultants. Regulatory strategy and submission decisions remain with qualified professionals, while we deliver the technical systems, documentation inputs and evidence that support their work and your quality system. Collaboration works. Each role stays clear.
You Own Everything
Code, pipelines, models, documentation and records belong to you. We hand everything over in documented form, so your team can maintain and extend PCCP infrastructure internally or continue working with us through ongoing support arrangements. No lock-in applies. Handover is complete.
Frequently Asked Questions
These are the questions AI medical device founders, regulatory leads, quality managers and engineering teams ask most often about PCCPs, whether they are preparing a first submission, adding a PCCP to an existing device strategy or building infrastructure to execute an authorized plan. The answers are short on purpose and are not regulatory advice, so confirm strategy with qualified regulatory professionals and current FDA guidance. If your question depends on your device, a short call with our team will help. For classification questions, see our FDA SaMD classification decision tree.
What Does PCCP Stand For?
PCCP stands for Predetermined Change Control Plan. It is a section of an FDA marketing submission describing planned modifications to a device, the protocol for implementing them and an assessment of their impact on safety and effectiveness. It matters for AI.
Which Devices Can Use a PCCP?
PCCPs can be included in 510(k), De Novo and premarket approval submissions. FDA’s December 2024 final guidance addresses AI-enabled device software functions specifically, and manufacturers should confirm applicability for their device with regulatory professionals and FDA. Ask early. Plan early.
Do Changes Under a PCCP Need New Submissions?
Modifications implemented according to an authorized PCCP generally do not require new marketing submissions. Changes outside the plan, or not implemented as the protocol specifies, follow normal modification requirements and may require new submissions. Discipline protects the plan. Follow it exactly.
Can a PCCP Change the Intended Use?
Generally no. PCCP modifications should keep the device within its authorized intended use. Changes adding substantially new indications typically require separate regulatory review rather than implementation under a predetermined change control plan. Plan expansions separately. Scope stays protected. Ask regulators early.
What Engineering Capabilities Does a PCCP Need?
Manufacturers need versioned data and models, automated validation pipelines, approval gates, audit-ready records and production monitoring. These capabilities ensure modifications follow the protocol consistently and generate evidence supporting quality system and inspection requirements. Automation helps. Plan them early. Start with versioning.
How Much Does PCCP Engineering Cost?
At our $50 blended hourly rate, a PCCP engineering assessment typically costs $3,000 to $10,000, validation pipelines $15,000 to $60,000 and a full PCCP-ready MLOps platform $40,000 to $104,000. Scope decides the final figure. Consultant fees are separate. Ranges vary widely.
Tell Us About Your AI Device
Share your device, intended use, submission pathway and planned modifications. In a 30-minute call we will review your engineering readiness for a PCCP and outline what infrastructure you need. Book a free consultation. No commitment. It is free. No obligation applies.