PCCP architectures for adaptive AI in medical devices.

FDA's Marketing Submission Recommendations for a Predetermined Change Control Plan for AI/ML-Enabled Device Software Functions finalised in December 2024, replacing the April 2023 draft. Section 3 of the FD&C Act, as amended by section 3308 of the FDORA, now formally permits PCCPs as a mechanism to authorise specified post-market modifications without a new 510(k) or PMA supplement. The mechanism is real. The submissions are real. The clearances are real — by Q1 2026 the FDA had cleared more than 1000 AI/ML-enabled devices, with the PCCP-enabled subset growing as a share of new submissions.

The clearances are also the source of the deficiency-letter pattern. PCCPs are being read carefully, and the early submissions are getting back substantial first-cycle deficiency lists. The pattern is now legible enough to write about.

/ 01What a PCCP is, in operational terms.

A PCCP is a contract with the regulator about the boundary of permissible post-market change. It has three components per the December 2024 guidance:

• A Description of Modifications — the specified changes the manufacturer intends to make. Not a wishlist; specific, bounded, traceable to design inputs
• A Modification Protocol — the verification and validation methods that will be used to confirm each modification meets device safety and effectiveness
• An Impact Assessment — the risks and mitigations associated with each authorised modification, including unintended consequences

The boundary is real. A modification within the PCCP envelope can ship without a new submission. A modification outside the envelope cannot. The line between the two is what every AI/ML device sponsor should be designing carefully now.

/ 02Where the deficiency letters are landing.

Boundary specificity.

The most common deficiency is a Description of Modifications written too broadly. "The model may be retrained on additional data from the same population" is not a specified change. The agency wants quantitative bounds: what data sources, what minimum and maximum sample sizes, what re-labelling protocol, what acceptance gates before deployment, what rollback criteria. A PCCP that reads as a general retraining licence will be cut back substantially in deficiencies.

Verification floor.

The Modification Protocol must specify the test sets that will be used to verify each modification. The agency expects a locked reference test set — preserved, traceable, version-controlled — alongside performance acceptance criteria with confidence bounds. Submissions that propose to "validate against representative test data" without specifying what representative means are getting deficiencies. The pattern is to pre-specify the test set, the metrics (sensitivity, specificity, AUROC, calibration), and the acceptance threshold for each.

Subgroup performance.

Section IV.C of the final guidance is explicit: the Modification Protocol must address performance across pre-specified subgroups. Race, ethnicity, sex, age strata where relevant to the indication. Submissions that present overall performance without subgroup breakdowns are receiving deficiency requests for the data. Companies that did not collect the demographic metadata during training are now retroactively assembling it — an expensive lesson.

Drift monitoring.

The Impact Assessment must address how the manufacturer will detect and respond to performance drift in the deployed model. Specific drift metrics, sampling cadence, threshold for triggering a corrective action, threshold for triggering a notification to FDA. Vague "we will monitor performance" language fails. The pattern that passes is operational — named metrics, named thresholds, named responsible roles.

The PCCP is not a permission slip. It is a forward-deposited evidence package that lets the regulator trust changes they will not see at the time of change.

/ 03What a good PCCP envelope looks like.

The pattern that is clearing well in 2026 has six characteristics. The Description of Modifications is bounded by specific, named, parameterised changes — typically retraining on additional same-population data with quantitative limits, recalibration on shifted prevalence, threshold adjustments within a pre-specified range. The Modification Protocol uses a locked reference test set plus a separately maintained shadow test set that the agency can audit independently. Performance acceptance criteria are stated as one-sided bounds with confidence intervals. Subgroup performance is reported as a matrix, not a paragraph. Drift monitoring is automated, with a named threshold for each modification class. Roll-back criteria are defined operationally — what triggers, who approves, how the field is notified.

The companies clearing these submissions are typically resourcing a dedicated AI quality function alongside the regulatory affairs team. The function is not optional. PCCP maintenance after clearance is a substantive ongoing workload.

/ 04The tension with EU MDR / IVDR.

FDA's PCCP framework has no direct equivalent in EU MDR (Regulation 2017/745) or IVDR (Regulation 2017/746). Significant changes in EU still trigger notified-body reassessment. The EU AI Act Article 43(4) acknowledges adaptive systems and treats the modification description as part of the conformity assessment — but the specific operational shape of an EU "PCCP equivalent" is still being assembled by notified bodies. Sponsors who have a US PCCP cannot simply lift it across to the CE mark. The architecture is the same; the regulatory recipient is different. This is a 2026–2027 problem with no clean answer yet.

The governance documentation required to maintain a PCCP overlaps substantially with what ISO/IEC 42001 requires for an AI management system. Companies that build the management system once and feed both regulators from it will be cheaper to operate than companies that build two stacks.

/ 05The thing nobody is documenting.

The PCCP describes a contract about future change. It does not describe the cumulative effect of permitted changes over time. A model that has been retrained five times within the PCCP envelope is materially different from the cleared device, even if every individual retraining was within bounds. The guidance does not require a cumulative-change assessment. The next deficiency wave will. iFeed's methodology pre-stages the cumulative-change document now, before the agency starts asking for it.