Marketing Submission Recommendations for a Predetermined Change Control Plan for Artificial Intelligence-Enabled Device Software Functions
United States Β· Guideline Β· Food and Drug Administration (FDA), Center for Devices and Radiological Health, Center for Biologics Evaluation and Research, Center for Drug Evaluation and Research
Our summary
The FDA provides recommendations for predetermined change control plans that allow manufacturers to update AI-enabled medical devices through iterative improvements without requiring separate marketing submissions for each modification. The guidance applies to AI-enabled devices and combination products reviewed through 510(k), De Novo, and PMA pathways, and requires that change control plans describe planned modifications, their development and validation methodology, and impact assessments to ensure ongoing device safety and effectiveness.
Written by the Index in our own words. It is not legal advice; the official text is the authority.
Inside this policy
Every section of this policy in order. Our notes summarise each one in plain language and do not quote the official text, which is the authority.
Drafted by the Index An automated summary of the official text, not yet reviewed by a person.Reviewed Checked by a person against the official text.
8 sections
Jump to a chapter
I Introduction
FDA supports innovative regulatory approaches for AI-enabled medical device software and digital health technologies under its authority under the Federal Food, Drug, and Cosmetic Act, excluding certain software functions listed in section 520(o), using iterative development methods intended to be least burdensome while maintaining reasonable assurance of safety and effectiveness. This guidance recommends content for a Predetermined Change Control Plan in marketing submissions for devices with one or more AI-enabled software functions, including descriptions of planned modifications, development and validation methodology, and impact assessment of modifications, with FDA reviewing the PCCP to ensure continued device safety and effectiveness without requiring separate marketing submissions for each modification described in the plan. The guidance represents FDA recommendations, not legally enforceable requirements unless specific regulatory provisions are cited.
II Background
FDA published a 2019 discussion paper proposing a regulatory framework for modifications to AI- and machine learning-based software as medical devices, which includes a Predetermined Change Control Plan with three components: a detailed description of planned modifications, the methodology to develop and validate those modifications while ensuring continued safety and effectiveness, and an assessment of benefits, risks, and risk mitigations. The 2019 discussion paper drew on premarket program practices, international risk categorization principles, benefit-risk frameworks, risk management guidance, and total product lifecycle approaches, and received substantial feedback from multiple stakeholders and peer-reviewed literature discussion. FDA subsequently held public workshops and meetings on AI and machine learning topics, including a 2020 workshop on artificial intelligence in radiological imaging, a 2020 patient engagement meeting on AI in medical devices and patient trust, and a 2021 transparency workshop on manufacturer labeling and information disclosure for AI- and machine learning-enabled medical devices, involving patients, caregivers, providers, and other interested parties.
III Scope
This guidance applies to AI-enabled device software functions, including machine learning-based modifications (automatic, manual with human review, or combined), that manufacturers plan to modify over time and that would otherwise require a new marketing submission or could affect device safety or effectiveness; a Predetermined Change Control Plan submitted with a marketing submission can obtain FDA authorization for intended modifications without additional applications before implementation, provided changes follow the authorized plan, for modifications normally requiring 510(k), PMA supplement, or De Novo pathways, while modifications not requiring new submissions instead fall under Quality System Regulation and post-approval reporting. The guidance applies to device components of combination products with AI-enabled software functions but not to drug or biologic components, with FDA encouraging early engagement through the Q-Submission Program, particularly for combination products and high-risk, life-sustaining, life-supporting, or implantable devices; when substantial equivalence is determined by comparing subject devices to predicates authorized with a plan, comparison is to the predicate's version before plan-authorized changes. The guidance provides recommendations on plan information content but does not constitute a complete description of marketing submission requirements, does not alter legal standards or valid scientific evidence requirements, and identifies certain appropriate modification types without providing a comprehensive list of all acceptable modifications.
IV Definitions
The section defines artificial intelligence as a machine-based system that makes predictions or recommendations for given objectives and machine learning as an AI application that automatically improves from data without explicit programming; device software function, AI-enabled device software function (a device software function implementing an AI model), and three categories of data used in AI development: training data (typically representative of intended use), tuning data (used to evaluate trained models before testing), and test data (typically representative of intended use and used to characterize performance). A predetermined change control plan is documentation describing device modifications and how they will be assessed, including modifications that would otherwise require a supplement or new notification, and an authorized predetermined change control plan is a reviewed and established predetermined change control plan that becomes a technological characteristic of the authorized device. A modification protocol is documentation describing development, validation, and implementation methods for modifications, including verification and validation activities with pre-defined acceptance criteria.
V Policy for Predetermined Change Control Plans
An authorized predetermined change control plan (PCCP) allows manufacturers to implement planned modifications to AI-enabled device software functions without new marketing submissions if implemented according to the plan's specified protocol; PCCP authorization requires premarket approval, 510(k), or De Novo submission demonstrating safety, effectiveness, or substantial equivalence, and must include a description of modifications with performance characteristics, a modification protocol with predefined acceptance criteria, and an impact assessment. Deviations from the authorized PCCP render the device unfit for interstate commerce and subject to FDA legal action including seizure or injunction; manufacturers must comply with Quality System Regulation requirements including design controls and corrective preventative action, and modifications consistent with the authorized PCCP do not require new submissions but those outside or not following specified methods do. Labeling for AI-enabled devices with authorized PCCP should explain the device uses machine learning with an authorized plan and inform users of potential software updates; modifications to an authorized PCCP generally require new marketing submissions as PMA supplements, 510(k), or special 510(k) submissions, and FDA may require PCCP revisions during review or may authorize the device without the PCCP if deficiencies remain unresolved.
VI Description of Modifications
Manufacturers must include a dedicated section describing each planned modification to the AI-enabled device software function, specifying device characteristics and performance that result, with the FDA recommending a limited number of modifications that can be verified and validated. Manufacturers must clearly state whether modifications will be implemented automatically by software, manually involving human action or review, or both, and when modifications apply differently across devices based on site or patient characteristics, must explain the local factors warranting each change and specify expected update frequency from annual to continuous. Appropriate modifications include changes to performance metrics from retraining on new data, new input data sources or types, hardware and software compatibility updates, and device authorization for specific patient subpopulations, provided all modifications keep the device within its intended use and maintain substantial equivalence to the predicate device where applicable.
VII Modification Protocol
VIII Impact Assessment
Controls
What this policy requires, forbids, grants or penalises, one control at a time and in our own words. Each control links to the official text, which is the authority. This is not legal advice.
Drafted by the Index Drafted automatically from the official text, not yet reviewed by a person.Reviewed Checked by a person against the official text.
Themes covered 0 of 35
Choose a theme to see only its controls. About the themes
Risk and scope 0 of 4
- Risk classification, not covered
- Prohibited practices, not covered
- Risk management system, not covered
- Impact assessment, not covered
Data and privacy 0 of 4
- Data governance and quality, not covered
- Data subject rights and consent, not covered
- Cross-border data transfer, not covered
- Copyright and training data, not covered
Transparency and records 0 of 4
- Transparency and disclosure to users, not covered
- Labelling of synthetic content, not covered
- Technical documentation, not covered
- Record keeping and logging, not covered
Technical safeguards 0 of 4
- Human oversight, not covered
- Accuracy, robustness and cybersecurity, not covered
- Bias and non-discrimination, not covered
- Testing and evaluation, not covered
Assurance and lifecycle 0 of 4
- Conformity assessment and certification, not covered
- Registration and notification, not covered
- Incident and breach reporting, not covered
- Post-market monitoring and corrective action, not covered
Rights and protected groups 0 of 4
- Automated decision-making rights, not covered
- Children and vulnerable groups, not covered
- Biometric identification and surveillance, not covered
- Whistleblowing, complaints and redress, not covered
Roles and organisation 0 of 6
- Supply chain and provider-deployer duties, not covered
- General purpose and foundation models, not covered
- Accountability and governance roles, not covered
- Training and AI literacy, not covered
- Public sector use and procurement, not covered
- Innovation support and sandboxes, not covered
Enforcement and sectors 0 of 5
- Enforcement, penalties and regulators, not covered
- Sector rules: health, not covered
- Sector rules: finance and insurance, not covered
- Sector rules: employment, not covered
- Sector rules: education, not covered
The full list of controls could not be loaded, so only the first 0 are shown.
Change history
No changes recorded since we began monitoring this policy.