FDA PCCP Beyond AI: Cybersecurity & Firmware Uses

A planned firmware update and an authorized change are different things. A manufacturer can describe a future cryptographic migration, dependency update, or hardware substitution without having permission to implement it under a PCCP. The regulatory team must establish which change route applies; the security team must show the resulting architecture and controls remain appropriate.

Why This Matters

The FDA's Marketing Submission Recommendations for a Predetermined Change Control Plan for AI-Enabled Device Software Functions, updated August 18, 2025, must not be confused with its broader Predetermined Change Control Plans for Medical Devices draft from August 2024. Draft recommendations are not for implementation, and final guidance is not itself binding law. The governing statutory authority and the authorization for the particular device remain essential.

Cybersecurity has its own obligations. Section 524B(b)(1) requires a postmarket vulnerability plan, including coordinated disclosure, for covered cyber-device submissions. Section 524B(b)(2) addresses cybersecure processes and updates and patches. The February 3, 2026 final premarket cybersecurity guidance recommends evidence supporting those obligations. A PCCP does not replace them.

Which guidance applies?

Read our FDA PCCP guide alongside the actual FDA documents. A proposal that resembles a worked example is not automatically an authorized change.

Which security changes need assessment?

The following are hypothetical planning examples, not claims that the FDA has authorized these classes for every device:

How do the evidence and change decision connect?

Start with a written description of the proposed change and its effect on the device. Identify new interfaces, dependencies, privileges, and safety-relevant behavior. Update the threat model and assess whether controls still address credible attack paths.

The regulatory team then determines the appropriate change route. If a change is within an authorized PCCP, execute that plan's protocol and document the results. If it is outside the plan, evaluate whether a new submission is required under the device's applicable rules. A PCCP is not limited to changes that already need no submission, and it does not waive the rules for changes outside its scope.

See also: FDA Section 524B Subsections Explained, SBOM for Third-Party Chip Firmware, and Secure Update Infrastructure for Medical Devices.

Update the SBOM and vulnerability assessment, keep the security risk file traceable, and scope regression or penetration testing to the changed attack surface. General functional and clinical validation remain with the manufacturer's qualified engineering, quality, and clinical teams.

The postmarket plan governs vulnerability intake, triage, communication, and remediation. A manufacturer's risk acceptance decision is separate from a VEX status: acceptable residual risk does not mean a product is unaffected, and a planned patch is not a completed fix.

How Blue Goat Cyber Approaches This

Blue Goat Cyber reviews the security implications of a proposed change against the device architecture, threat model, SBOM, and existing controls. Our team brings medical-device security testing and regulatory cybersecurity documentation experience; we do not substitute penetration testing for functional or clinical validation.

We help the regulatory team define security evidence and testing for the specific plan being proposed, without assuming that every firmware or hardware change belongs in a PCCP. Our PCCP cybersecurity service addresses security documentation and test scope. If the FDA raises a cybersecurity question, we answer it at no extra cost until the cybersecurity portion is closed.

Frequently Asked Questions

Can a PCCP apply beyond AI-enabled software?

The statutory authority is broader than AI. However, the current final guidance addresses AI-enabled device software functions, while the broader general-device guidance remains draft. Whether a particular non-AI change can be covered depends on the device-specific proposal and FDA authorization. Do not treat the draft as final guidance or infer permission for a change from a general example.

Does every cybersecurity patch need a PCCP?

No. Assess security patches under the applicable device-change rules and your postmarket processes. Some changes may not require a new submission; others may require additional regulatory action. A PCCP may be relevant to specified planned changes, but it is not a universal prerequisite for patching and does not replace the postmarket cybersecurity plan.

Does a PCCP remove Section 524B obligations?

No. The postmarket vulnerability plan, cybersecure processes, updates and patches, and SBOM obligations for covered submissions remain. The PCCP addresses specified authorized changes. Maintain the risk-management and monitoring evidence as changes occur, and separately assess any applicable correction/removal or adverse-event reporting obligations.

Can we call a future patch fixed in VEX?

No. A future patch is a remediation plan, not evidence the current product is fixed. Use the VEX status supported by the current product configuration and investigation. A not-affected status needs a supported justification, such as the vulnerable code not being present or an attack path not existing; it cannot be inferred from a low aggregate risk score.

Can the FDA authorize changes outside the proposed plan?

Do not assume so. The manufacturer must follow the authorized plan's scope and protocol. A change outside that scope requires assessment under the applicable regulatory rules and may require a new submission. Discuss uncertain scope with the FDA and retain the decision and evidence in the quality system.

CTA

Discuss your proposed cybersecurity change with Blue Goat Cyber. We can review the architecture, threat model, SBOM, and security testing implications while your regulatory team determines the submission route. Start with a specific change, not a blanket promise that all future updates are covered.

Christian Espinosa, Founder and CEO of Blue Goat Cyber, works with medical-device teams on premarket and postmarket cybersecurity evidence. His experience includes red-team and DoD cyberwarfare work. About Christian.

Official Sources

• FDA general medical-device PCCP draft guidance
• FDA AI-enabled software PCCP final guidance, August 18, 2025
• FDA premarket cybersecurity guidance, February 3, 2026
• FDA medical-device cybersecurity and Section 524B resources