FDA PCCP: Predetermined Change Control Plans

A Predetermined Change Control Plan is the FDA's mechanism for letting an AI/ML medical device evolve after authorization without requiring a new marketing submission for every change. This guide explains what belongs in a PCCP, how to define modification scope, and how cybersecurity fits in under the February 2026 premarket cybersecurity guidance.

Last reviewed: October 22, 2026 against the FDA final AI-enabled device software PCCP guidance and the February 3, 2026 final premarket cybersecurity guidance.

Related: EU AI Act vs FDA AI/ML Cybersecurity covers how PCCPs map to the EU AI Act's "substantial modification" test. SaMD Cybersecurity Requirements covers the SaMD foundation a PCCP builds on.

At a glance - What a PCCP is and isn't

When to consider an optional PCCP

A PCCP is optional. Consider one when you want to authorize specified future changes that would otherwise require a new submission. The most common drivers:

• AI/ML SaMD model retraining on new data with the same architecture and intended use.
• Performance threshold updates as real-world data accumulates.
• Expansion of input data types within the cleared indication (for example, adding a new MRI scanner make/model to a radiology AI's validated input set).
• Adaptive algorithm updates governed by a locked retraining recipe.
• Cybersecurity control updates that change the device's security architecture (for example, rotating cryptographic primitives on a schedule).

A PCCP is optional, including for devices receiving bug fixes or security patches. Assess each modification under the applicable device-change rules and postmarket policies; a patch is not exempt merely because it appears in a cybersecurity plan. Changes that do not require a new submission can be documented in the quality system without a PCCP.

The three recommended components

The FDA final guidance, "Marketing Submission Recommendations for a Predetermined Change Control Plan for Artificial Intelligence-Enabled Device Software Functions", was issued December 4, 2024, and updated August 18, 2025, according to the FDA page. It recommends a Description of Modifications, Modification Protocol, and Impact Assessment. The broader "Predetermined Change Control Plans for Medical Devices" is an August 22, 2024 draft, not final guidance. Guidance recommendations are nonbinding.

1. Description of Modifications

Enumerate every change the PCCP covers. For each:

• The specific parameter, threshold, dataset, model component, or control that can change.
• The bounded range of values it can take.
• The conditions that trigger the change.
• Whether the change is automatic, manual, or contingent on an event.

Vague entries like "periodic model retraining" do not clearly define the proposed modification scope. A clean entry reads: "Retraining of the diagnostic classifier on quarterly batches of de-identified images from the same five clinical sites, with the same model architecture (ResNet-50), the same input modality (chest CT), and the same intended use, when the new batch contains at least 5,000 confirmed labels."

2. Modification Protocol

This is the engineering and verification specification. For each modification class, the protocol should describe:

• Data management: how training, tuning, and test data will be collected, curated, labeled, and partitioned. How data drift will be detected.
• Retraining and update methodology: the algorithm, hyperparameter ranges, stopping criteria, and acceptance thresholds.
• Performance evaluation: the metrics, reference standards, and statistical methodology. Pre-specified non-inferiority or superiority margins.
• Verification and validation: bench testing, software unit/integration tests, and any clinical validation. Regression test coverage for unchanged functionality.
• Cybersecurity verification: threat model refresh, SBOM regeneration, vulnerability scan, regression of security controls, pen test scope decisions. See "Cybersecurity in the PCCP" below.
• Change management: how the change is documented in the DHF/DMR, who approves it, and how the QMSR/QSR design control loop closes.

The protocol is a real plan that the FDA can read and decide whether the resulting changes would still be substantially equivalent / safe and effective. An unclear protocol may prompt questions about validation and scope.

3. Impact Assessment

For each modification class, document how implementing it could affect:

• Benefit-risk profile of the device.
• Performance against the cleared indications for use.
• Safety for the intended patient population, including subgroup performance.
• Cybersecurity posture: confidentiality, integrity, availability of the device and its data flows; any expansion of the attack surface; any change to the trust boundary.
• Other modifications: how stacking changes over time could compound risk.
• Interactions with the existing risk management file (ISO 14971) and threat model.

The Impact Assessment is the FDA's main reasoning aid. It is what lets the reviewer agree that any change made under the protocol will not require a new submission.

Cybersecurity in the PCCP

The February 3, 2026 final premarket cybersecurity guidance does not prescribe a PCCP or a universal PCCP cybersecurity template. Apply its risk-based cybersecurity recommendations and assess Section 524B duties for covered submissions separately. The final AI-enabled device software PCCP guidance recommends considering relevant cybersecurity impacts of proposed modifications in the Modification Protocol and Impact Assessment.

Threat model maintenance

The PCCP should commit to refreshing the threat model on a defined cadence and on specific triggers - new component, new interface, new data type, new trust boundary. The refresh has to be traceable: which threats were added, which mitigations changed, which risk acceptance decisions were re-evaluated.

SBOM regeneration and vulnerability management

Any change that modifies the software bill of materials (new dependency, version bump, model artifact swap) should regenerate the SBOM and run it through the established vulnerability triage, with VEX optional. The PCCP states the tool, the schedule, and the disposition rules.

Regression testing of security controls

The Modification Protocol's verification section should include security regression - authentication, authorization, cryptographic primitive use, secure boot, update integrity, logging. Listing security control test cases as a fixed regression suite that runs on every modification is the cleanest pattern.

Penetration testing scope decisions

The PCCP should state which modification classes trigger a fresh penetration test versus a delta test versus no retest. A documented risk-based rationale makes the scope decision traceable; the February 2026 guidance does not require these three retest categories or a new penetration test for every modification. To calibrate the pen-test scope reviewers are currently treating as complete in your product code, run the workflow in mining FDA databases for medical device cybersecurity precedent.

Postmarket monitoring tie-in

The PCCP modification cadence has to align with the postmarket cybersecurity plan required by Section 524B(b)(1). New components mean new monitoring scope; the PCCP says how that scope is updated.

PCCP scope and evidence gaps to assess

How a PCCP fits into the submission

For a 510(k), De Novo, or PMA, the PCCP is a labeled section of the submission. The FDA's review concludes with an authorized PCCP that becomes part of the cleared device's regulatory record. Any future change that conforms to the authorized PCCP is implemented and documented in the DHF; no new submission is required. Any change outside the PCCP is treated under the standard change rules and may require a letter-to-file analysis or a new submission.

For a device already on the market, a PCCP is added via supplement (PMA) or new 510(k) (510(k)-cleared devices). The agency will not retroactively authorize past changes through a new PCCP. To see how cybersecurity change-control patterns appear in cleared PMA supplement chains and 510(k) Summary Statements, use the workflow in how to work through the FDA 510(k), De Novo, and PMA databases.

Standards and references

Where Blue Goat Cyber fits

We author the cybersecurity portions of PCCPs for AI/ML medical device manufacturers, focused on relevant recommendations in the FDA's February 3, 2026 guidance - threat model refresh triggers, SBOM regeneration cadence, security regression suites, pen test scope rules, and postmarket monitoring tie-ins. Engagements typically run alongside the regulatory team writing the Description of Modifications and the Modification Protocol; we own the security-relevant content and stress-test the Impact Assessment for cyber gaps that get flagged in review.

See our PCCP cybersecurity services for scope and fixed-fee pricing, talk to us about your PCCP if you are scoping an AI/ML SaMD submission, or read the companion SaMD Cybersecurity Requirements guide for the underlying SaMD security baseline.

FAQ

Does every AI/ML medical device need a PCCP?

No. A PCCP is optional. You submit one when you expect specific, well-defined changes after authorization and want to pre-authorize them. A device that will be locked at clearance does not need one.

Can a PCCP cover cybersecurity-only changes?

Only if the FDA authorizes those specific changes in that device's PCCP. Do not assume cryptographic migrations or security architecture changes are covered. Assess the applicable change rules and discuss the proposed scope with the FDA; routine security patches do not automatically require a PCCP.

What if a change falls outside the authorized PCCP?

You handle it under the standard change rules - letter-to-file analysis, new 510(k) or applicable PMA supplement, or new submission, depending on the change's effect on safety, effectiveness, intended use, and the device's substantial-equivalence basis.

How does a PCCP interact with the postmarket cybersecurity plan?

They are complementary. The postmarket plan handles vulnerability response and patch deployment for the device as-is. The PCCP handles planned, structural changes. A patch to fix a known CVE goes through the postmarket plan; a scheduled migration to a new authentication scheme follows an authorized PCCP only if it is covered. Otherwise assess it under applicable change requirements.

Does the FDA approve each individual modification implemented under a PCCP?

No. That is the point of a PCCP - the agency approves the framework once, and conforming changes are implemented without further submission. The manufacturer documents each change in the DHF/DMR and is responsible for the protocol's faithful execution.

How does an EU AI Act "substantial modification" relate to a PCCP?

The two regimes use different language but overlap in effect. The PCCP defines what changes do not require a new FDA submission; the EU AI Act's "substantial modification" test defines what changes do require re-conformance. A change authorized by a PCCP may still trigger substantial-modification re-conformance in the EU, so a single AI cybersecurity program should map both. The EU AI Act vs FDA AI/ML Cybersecurity guide has the side-by-side.

Which FDA guidance governs PCCPs?

The August 18, 2025 final AI-enabled device software PCCP guidance provides recommendations for that scope. The broader "Predetermined Change Control Plans for Medical Devices" document is an August 2024 draft, not for implementation; it does not supersede the AI-specific final. The February 3, 2026 final premarket cybersecurity guidance provides nonbinding cybersecurity recommendations and explains applicable Section 524B duties; it does not prescribe a PCCP template. Consider relevant threat-model, component-inventory, and testing impacts using the final AI PCCP guidance and device-specific risk.

Do PCCPs apply to non-AI devices?

The statutory PCCP authority is broader than AI, but the current final guidance addresses AI-enabled device software functions. The general-device guidance remains draft. Whether a particular non-AI firmware, hardware, or security change can be authorized requires device-specific assessment and FDA agreement, not an assumption of blanket coverage. See PCCPs Beyond AI: Cybersecurity, Firmware, and Hardware.

Where to go next

• AAMI CR515:2025 and ML device cybersecurity - why every permitted model change is a change to the attack surface.
• GMLP Controls Crosswalk for Medical Devices - the control evidence behind a defensible PCCP.
• PCCPs Beyond AI: Cybersecurity, Firmware, and Hardware - applying PCCPs outside AI/ML devices.
• AIBOM for Medical Devices - the versioned model inventory that makes a PCCP auditable.
• PCCP Cybersecurity Appendix - how each planned change maps to your threat model and risk assessment.
• PCCP Cybersecurity Services - we write and review the security content of your PCCP, fixed fee.
• PCCP Builder - draft the modification protocol and impact assessment for a PCCP.

References

Primary sources cited or relied on in this guide:

• Predetermined Change Control Plans for Medical Devices (FDA draft guidance, August 2024; not for implementation), U.S. FDA
• Marketing Submission Recommendations for a PCCP for AI/ML-Enabled Device Software Functions, U.S. FDA
• Cybersecurity in Medical Devices: Quality Management System Considerations and Content of Premarket Submissions (Feb 2026 final), U.S. FDA
• Section 524B of the FD&C Act (Consolidated Appropriations Act, 2023, §3305), U.S. Congress
• ANSI/AAMI SW96:2023, Standard for Medical Device Security, AAMI/ANSI

Related precedent-research reading

• How to Navigate the FDA 510(k), De Novo, and PMA Databases for Cybersecurity. The three premarket databases and what each one exposes about cleared cybersecurity content.
• Mining FDA Databases for Medical Device Cybersecurity Precedent. A five-step workflow that turns 510(k), De Novo, PMA, MAUDE, and FOIA reads into a submission-ready evidence baseline.