An optional PCCP can authorize specified future modifications. This planning outline uses the August 2025 final AI PCCP guidance and February 3, 2026 cybersecurity recommendations; it does not determine authorization or whether a new submission is required.
Reviewed by
Christian Espinosa
Founder & CEO, Blue Goat Cyber
PCCP completion
1/9 planning items complete
Progress saved on this device automatically.
Model class
Determines which monitoring and re-training controls reviewers expect.
Planned modification types
These are planning categories, not FDA dispositions. Actual coverage depends on the authorized PCCP and applicable change requirements.
Verification methods (modification protocol)
Items marked recommended create planning reminders, not legal compliance decisions.
Transparency / user notification
FDA expects clinicians to know when a model version changes underneath them.
What you'll see after you submit
Common misconceptions
Myth: PCCP is only for continuously-learning AI.
Reality: A PCCP is optional and may be proposed for specified modifications to AI-enabled device software, including locked models. The broader medical-device PCCP guidance remains draft; actual scope requires FDA authorization.
Myth: PCCP lets us push any model update without a new submission.
Reality: Only changes consistent with an authorized PCCP can use that authorization. Changes outside it require assessment under applicable change requirements; a new submission may be required, not assumed.
Myth: We can skip cybersecurity in the PCCP if the device already has §524B docs.
Reality: Assess relevant cybersecurity impacts of planned changes and maintain applicable Section 524B processes. The final cybersecurity guidance does not mandate this builder checklist or separately filed reports.
Myth: Rollback is a deployment concern, not a regulatory one.
Reality: The final PCCP guidance recommends update procedures appropriate to the device. Recovery tests and user communications should follow the authorized protocol and device risks; automated rollback is not universally prescribed.
Myth: Real-world performance monitoring is optional if we have a strong test set.
Reality: Consider monitoring, performance criteria, and response actions appropriate to the device and modifications. The January 2025 AI lifecycle document remains a draft, not an enforceable monitoring mandate.
References & further reading
Tracked signals that change what reviewers expect. Items move on as new ones land.
We write and review the security content of your PCCP. Fixed fee after scoping.
Read PCCP cybersecurity servicesFull SPDF + eSTAR-ready submission aligned to current FDA guidance.
Read FDA premarket cybersecurity servicesSTRIDE-based threat model that satisfies PCCP impact-assessment requirements.
Read Threat modeling servicesSPDX/CycloneDX SBOMs with continuous CVE/VEX maintenance.
Read SBOM services for MedTechReadiness quiz, §524B applicability, SaMD classifier, and more.
Read More free tools