FDA Published Its PCCP List. Here's What 240 Authorizations Show, and What the List Leaves Out.

On October 20, 2026, FDA published a page on predetermined change control plans with a list of 240 authorizations that carry one. A predetermined change control plan, or PCCP, lets a manufacturer get planned changes authorized inside a marketing submission and then make those changes later without a new 510(k) or PMA supplement for each one. The same day, FDA posted two hypothetical case examples: one in which a model is adapted to each hospital, and one in which a model retrains and deploys itself.

The list is useful, and it is incomplete. I matched it against FDA's list of AI-enabled devices, FDA's 510(k) and PMA databases, and the decision documents for all 977 AI-enabled devices FDA authorized from December 29, 2022, the day the PCCP provision was enacted, through June 29, 2026. This post covers what the list shows, what it misses, what authorized plans actually allow, and how the EU is handling the same question.

The rules in brief

Section 515C of the FD&C Act, added by section 3308 of the Food and Drug Omnibus Reform Act and enacted on December 29, 2022, lets FDA approve or clear a PCCP that describes planned changes that would otherwise need a PMA supplement or a new 510(k). The device must remain safe and effective without the change and, for a 510(k), would remain substantially equivalent to the predicate. FDA may require the plan to include labeling, "notification requirements if the device does not function as intended pursuant to such plan," and performance requirements. FDA added matching exceptions to 21 CFR 807.81(b)(1)(ii) and 814.39(b) in March 2024.

FDA's guidance builds a plan from three parts: a Description of Modifications, a Modification Protocol and an Impact Assessment. Modifications "must maintain the device within the device's intended use" and, in FDA's view, "should also maintain the device within the device's indications for use." FDA says most changes to the indications would be "difficult for FDA to assess prospectively," with room for narrow ones, such as "use of the device with an additional device or component." The draft general guidance lists a change to include a new patient population among modifications generally not appropriate for a PCCP.

One rule matters to anyone searching for predicates. Under section 515C(c), "Only the version of the device cleared or approved, prior to changes made under the predetermined change control plan, may be used by a sponsor as a predicate device."

FDA's PCCP guidance for AI-enabled device software functions is final: issued August 18, 2025, originally issued December 4, 2024. The general guidance for all devices is still the August 22, 2024 draft, and a final version is on CDRH's A-list for fiscal year 2027. Anyone quoting the AI guidance should note that its QMSR footnote predates February 2, 2026, when the QMSR took effect.

What FDA's list shows

The earliest entry is Apple's Irregular Rhythm Notification Feature (K231173), cleared July 21, 2023. The latest is dated September 30, 2026. By year, the list holds 4 entries for 2023, 29 for 2024, 104 for 2025 and 103 for 2026 through September 30. The third quarter of 2026, with 48 entries, is the largest quarter so far.

Measured against all 510(k) decisions in FDA's database, 510(k)s on the list made up 22 of 3,082 decisions in 2024 (0.71%), 72 of 3,198 in 2025 (2.25%) and 76 of 2,508 in 2026 through September 30 (3.03%). Small, and rising each year.

Entries are submissions, not distinct plans. On March 20, 2025, FDA approved 24 Medtronic cardiac rhythm PMA supplements for one set of "biocompatibility-related manufacturing changes," such as removing a processing aid or a cleaning step, provided they "do not impact the properties of the device materials." On February 12, 2026, it approved seven Medtronic heart valve PMA supplements for a plan "that establishes a standardized qualification process for new bovine and porcine tissue suppliers." Those two dates account for 31 of the 240 entries, and the March 2025 approvals alone are 24 of the 29 entries in the first quarter of 2025.

Cardiovascular devices account for 67 entries, radiology 52 and microbiology 47. Microbiology has a route of its own: FDA's 2023 guidance on updating breakpoints in antimicrobial susceptibility test labeling describes establishing and using a PCCP for breakpoint updates in a 510(k).

On routes and transparency: of the 174 510(k)s, 165 were Traditional, 3 Abbreviated and 6 Special, and none of the 180 510(k) and De Novo entries went through third-party review. Twenty-seven of the 510(k)s, 22 of them in microbiology, were filed with a 510(k) Statement rather than a 510(k) Summary, so FDA's public file does not describe those plans; FDA's draft guidance says such sponsors should provide the PCCP information to requestors. Of the 56 PMA supplements, 35 sit on the track FDA's database labels "135 Review Track For 30-Day Notice," and the draft guidance names a 135-day supplement for a PCCP that "comprises certain manufacturing changes only."

Review time

For the typical submission, including a PCCP does not appear to slow review. Traditional 510(k)s on the list took a median 131 calendar days from receipt to decision (interquartile range 90 to 206; n=165). Other Traditional 510(k)s in the same product codes over the same period took a median 142 days (91 to 224; n=1,798). Matched to same-code clearances decided within a year, which was possible for 101 of the 165, the PCCP 510(k)s came out a median one day shorter: 49 took longer than their comparators and 52 took less. The tail runs one way, though. Nineteen took at least 60 days longer than their comparators and only five took at least 60 days less, which puts the average difference at about 17 days longer. These are calendar days, including time on hold, not MDUFA FDA Days, and the comparison cannot control for which sponsors choose to include a plan.

How much of it is AI

FDA's AI-enabled device list runs through June 29, 2026. Of the 190 PCCP entries decided by then, 62 (32.6%) are on it. The other 128 include manufacturing plans, antimicrobial susceptibility tests and surgical apparel, and they also include software FDA's AI list does not count.

Insulin dosing is the clearest case. Through June 29, 2026, the PCCP list has 11 entries under the product codes for interoperable automated glycemic controllers (QJI), drug dose calculators (NDC) and alternate controller enabled insulin infusion pumps (QFG), including UpDoc (K253281) and Glucommander (K254102). None is on FDA's AI list, yet FDA's own AI overview page gives "AI algorithms to automate insulin dosing" as an example of an AI-enabled device. FDA builds its AI list mainly from AI-related terms in summaries and classifications and says the list "is not a comprehensive resource of AI-enabled medical devices." Absence from the AI list is not evidence that a device has no AI.

What the list leaves out

FDA's list mirrors a database field. Each 510(k), De Novo and PMA record carries a "Predetermined Change Control Plan Authorized" flag, and the list's entries match it. The flag is not always set when FDA authorizes a plan.

To measure the gap, every decision document FDA has posted for the 977 devices on its AI list decided from December 29, 2022 to June 29, 2026 was searched for PCCP language, with OCR of 577 image-only or garbled pages. A plan counts as FDA-documented when the clearance letter states that FDA's determination "also included the review and clearance of your Predetermined Change Control Plan (PCCP)," or when the summary or decision summary describes the device's authorized plan.

The result: 73 FDA-documented PCCPs, of which 61 are on FDA's list (83.6%) and 12 are not. The misses run from February 2023 to June 2026, so this is not a problem confined to the list's early months. Three clearances from July 2026, after the AI list's cutoff and so outside the review, are missing as well.

Some of these are hard to miss. FDA classified Caption Health's device type under a new regulation, 21 CFR 892.2055, "radiological machine learning-based quantitative imaging software with predetermined change control plan" (final order, 91 FR 36522, June 17, 2026), yet the De Novo that created it is not on FDA's PCCP list. Tyto Care's device is named "Tyto Insights for Wheeze Detection (with PCCP)," and its summary says "The purpose of this 510(k) submission is to obtain FDA's review and authorization of a Predetermined Change Control Plan (PCCP) for the subject device." The Dreem 3S summary says the submission "only involves the additional inclusion of the Predetermined Change Control Plan." Neither is on the list.

The error also runs the other way. Aidoc's BriefCase-Triage (K253265, November 6, 2025) is on the list, but neither its letter nor its summary mentions a PCCP. Letters are not infallible either: in June and July 2024, FDA sent administrative corrections for two clearances (K231837 and K233692) because it had "inadvertently indicated that the SE determination also included review and clearance of a predetermined change control plan (PCCP)."

Published analyses built on the flag inherit the gap. A JAMA Health Forum study by Dabek and colleagues, which took PCCP status from public FDA databases, counted 43 of 794 AI-enabled devices authorized from 2023 to 2025 with a PCCP, the same 43 FDA's list gives here; FDA's documents support 52. Dayma and colleagues, in Radiology: Artificial Intelligence, found that FDA's database and the device summary disagreed for 9 of 34 PCCP-cleared radiology AI devices.

The practical point: to know whether a device has an authorized PCCP, read its clearance letter and its summary. Do not rely on FDA's list or the database flag, in either direction.

What the plans actually allow

Most of the plans read for this post are narrow, manual and global. They let the manufacturer retrain or retune a locked model, add compatible hardware, or change a configuration, validate against fixed acceptance criteria, and then release the change to every installed device in the same form. The language is consistent:

• Overjet's Charting Assist (K241684): modifications "implemented manually (non-automatic) across all devices on the market in a uniform manner (global adaptation)."
• Heartvue.Proton (K260811): deployment in a "homogeneous, global manner across all deployed instances of the device," with no site-specific or per-installation model variants.
• Qure.ai's qCT Lung (K261517): the plan "will not include any adaptive algorithms that can continuously learned [sic] from the environment."
• Siemens' syngo.CT Coronary Cockpit (K253786): changes are implemented "Only if both, performance testing and verification and validation, have been successfully passed."

Local retraining, now authorized

VIRTUE QA from ProNova Solutions (K260597, cleared September 23, 2026), patient-specific quality assurance software for proton therapy, breaks the pattern. Its summary describes six machine-specific predictive models that "are updated once daily using accepted delivery data accumulated during prior clinical operation. Only model weight parameters change." Each treatment machine "maintains an independent training dataset; data and model parameters are not pooled or shared across treatment machines or clinical sites." Activation is gated: "A candidate with no Model Flags may be activated," warning-level candidates can be activated only with visible flags after the configured retries, and "Error-level candidate model sets are not activated, and the prior validated model set remains active." Users receive a Model Health Report, and the clinical workflow requires "review and acknowledgment or explicit sign-off confirmation for applicable flags." The summary does not say whether a person approves each activation, so it reads as local, daily retraining with gated activation rather than as fully automatic.

FDA's two hypotheticals

FDA's new case examples mark out where it sees the edges. In the first, a sepsis alert system adapts to each hospital through site-specific input weighting and a site-specific alert threshold, each within a prespecified range, and through fine-tuning of the model's final output layers on local data. "Local adaptations are implemented manually, necessitating prespecified minimum local data and review and approval by the manufacturer prior to deployment at each new site," and the unmodified global model stays available as a fallback.

In the second, an arrhythmia detection model retrains on data pooled across sites and deploys "automatically and globally by software at the conclusion of each re-training cycle without human input, action, review or decision-making," after automated validation. The rollout is staggered across sites, drift thresholds trigger a manufacturer review, and the user interface shows the current model version and the date of the last update. FDA states the trade-off plainly: "there is no human-in-the-loop when modifications are implemented, validated, and deployed."

Plans in use

Later submissions show plans being used. When Deski filed a new 510(k) for HeartFocus (K260780, cleared June 3, 2026), its summary listed "intermediate changes" made under the PCCP cleared in K242807: compatibility with two more ultrasound probes, "with corresponding AI/ML algorithm retraining and validation," and support for iPadOS. The protocol was "identical to the FDA-cleared PCCP," and "All PCCP success criteria met on first iteration." The boundary shows up too. Exo Imaging's AI Platform 2.2 (K260217) still carries the PCCP cleared in K240953, but the changes in that submission "are outside the scope of the PCCP," so they came to FDA as a new 510(k).

Without a plan

On September 1, 2026, FDA issued a warning letter to O.N. Diagnostics over VirtuOst VFA 3.0.0, software cleared under K171435. The letter says "a new machine learning algorithm was introduced for vertebral landmarking" and concludes: "Thus, a new premarket notification is required." It adds that the device "migrated from a desktop application to a web-based architecture," one of two further changes it says also require a new premarket notification. No PCCP was involved. None of the research for this post turned up a warning letter, recall or Form 483 tied to a change made under an authorized PCCP.

What FDA is signaling next

• A final general guidance. "Predetermined Change Control Plans for Medical Devices" is on CDRH's fiscal year 2027 A-list of final guidances, alongside final lifecycle recommendations for AI-enabled device software functions.
• Generative AI. FDA's August 2026 discussion paper on generative AI-enabled devices asks how "PCCP concepts or other change-control approaches" could be adapted "when the nature or scope of future modifications cannot be fully prespecified," and how manufacturers can control changes made by a third-party foundation model developer, naming contractual, technical and PCCP mechanisms. The paper is not guidance and proposes no policy.
• The advisory committee. FDA's executive summary for the November 6, 2025 Digital Health Advisory Committee meeting on generative AI-enabled digital mental health devices says "PCCPs may be particularly useful for an adaptive algorithm (of which generative AI is one example)."
• User fees. FDA's draft MDUFA VI commitment letter for fiscal years 2028 through 2032 mentions PCCPs twice, both under digital health: technical expertise that "will also support predetermined change control plan (PCCP) reviews of AI-enabled devices and other digital health devices," and engagement "at least once per year on high interest areas, such as PCCP." It sets no PCCP review-time goal.
• Classification orders. Recent FDA classification and reclassification notices invite PCCPs in standard language. The August 17, 2026 final order reclassifying in situ hybridization test systems for use with a corresponding approved oncology therapeutic product (91 FR 53184) says "manufacturers may wish to use PCCPs as a way to implement future modifications to their devices without needing to submit a new 510(k) for each significant change or modification."

Outside the US

FDA, Health Canada and the UK's MHRA published five shared guiding principles for PCCPs for machine learning-enabled devices in October 2023. IMDRF followed on August 6, 2026 with N90, "Essential Principles and Content of Predetermined Change Control Plans." N90 covers medical device software generally, not only machine learning, and states that it is not intended to establish regulatory requirements. It names the three elements as a Description of Changes, a Change Plan and an Impact Assessment, so its terms differ slightly from FDA's. Two of its points belong in any plan: available labeling should reflect only changes already implemented, and a revision to an authorized PCCP will likely need reauthorization, although some jurisdictions may allow minor revisions without it.

National regulators are at different stages:

• Canada. Health Canada's pre-market guidance for machine learning-enabled medical devices, dated April 1, 2026, introduces PCCPs for Class II to IV devices, and its significant-change guidance gives examples of software changes for machine learning-enabled devices licensed with a PCCP (Table 5).
• United Kingdom. PCCPs "are not yet formally embedded within the UK regulatory framework," according to the MHRA's AI Airlock Phase 2 report, which also notes that a draft statutory instrument, the Medical Devices (Amendment) Regulations 2026, contained formal PCCP provisions that applied only to products under Approved Body oversight. In its October 6, 2026 response to the National Commission into the Regulation of AI in Healthcare, the government said "The MHRA will issue draft guidance on PCCPs for public comment," with a draft intended by December 2026.
• Australia. The TGA consulted from April 10 to June 5, 2026 on a draft "TGA Approach to Predetermined Change Control Plans" covering all medical device software.
• Japan. MHLW Notification 0831-14 of August 31, 2020 set out a procedure for change plans for approved devices, not limited to AI. PMDA's draft review points for medical devices using generative AI (September 14, 2026) describe IDATEN as "a system under the Pharmaceuticals and Medical Devices Act corresponding to the plasticity of machine learning" and say it "is useful in providing timely updates to specific changes, but there are limitations to its ability to accommodate products with characteristics that change in real time."

The EU: pre-determined changes in the AI Act, and a PCCP proposed for the MDR

The MDR and IVDR have no PCCP today. What the EU has is a narrower provision in the AI Act, which reaches device AI through the medical device rules.

Which device AI is high-risk

Under Article 6(1) of the AI Act, an AI system is high-risk if it is a product, or the safety component of a product, covered by the legislation listed in Annex I, and that product must undergo third-party conformity assessment under that legislation. The MDR and IVDR are Annex I Section A points 11 and 12. So the device's MDR or IVDR route decides whether it is high-risk under Article 6(1): notified-body involvement is what satisfies Article 6(1)(b), which leaves out, for example, MDR Class I devices that are not sterile, have no measuring function and are not reusable surgical instruments. Device AI can also be high-risk under Article 6(2) if its intended purpose is listed in Annex III, such as emergency healthcare patient triage (point 5(d)), whatever its device class. For Article 6(1) systems, the high-risk rules in Chapter III, Sections 1 to 3, apply from August 2, 2028, and conformity assessment stays inside the MDR or IVDR procedure, with the AI Act requirements assessed as part of it (Article 43(3)).

Pre-determined changes

The AI Act requires a new conformity assessment after a "substantial modification," which Article 3(23) defines as a change "not foreseen or planned in the initial conformity assessment" that affects compliance with the high-risk requirements or modifies the intended purpose. Article 43(4) then makes an exception for learning systems: "For high-risk AI systems that continue to learn after being placed on the market or put into service, changes to the high-risk AI system and its performance that have been pre-determined by the provider at the moment of the initial conformity assessment and are part of the information contained in the technical documentation referred to in point 2(f) of Annex IV, shall not constitute a substantial modification."

Two provisions and a recital build on it. Annex IV point 2(f) asks the technical documentation for "a detailed description of pre-determined changes to the AI system and its performance." Article 13(3)(c) requires the instructions for use to state those changes, "if any." Recital 128 of Regulation (EU) 2024/1689 describes the learning it has in mind as "automatically adapting how functions are carried out." Another provision has consequences for hospitals: under Article 25(1)(b), a distributor, importer, deployer or other third party that makes a substantial modification to a high-risk system, in a way that leaves it high-risk, is treated as its provider. A hospital that retunes a device model beyond the manufacturer's pre-determined changes risks taking on the provider's obligations.

The Medical Device Coordination Group and the AI Board tied this to device law in MDCG 2025-6 / AIB 2025-1 (June 2025): a pre-determined change "should not be understood as a change to the certified medical device or IVD under MDR Annex IX Section 4.10 and IVDR Annex IX Section 4.11," and the rule "should be included in the change management procedure of the MDR/IVDR device." It adds that IMDRF's PCCP work "will likely serve as a basis for future EU guidance." The document predates Regulation (EU) 2026/1744, so its application dates are out of date, but the provisions it relies on here, Articles 3(23) and 43(4) and Annex IV point 2(f), were not amended, and neither was Article 13(3)(c).

What is still open

Whether the Article 43(4) exception covers a locked model that the manufacturer retrains on a schedule, the typical FDA PCCP, is not settled by the text, which speaks of systems "that continue to learn." The Commission guidelines on substantial modification that Article 96(1)(c) calls for would be the natural place to settle it, and the Commission's guidelines page (last updated July 31, 2026) still lists them as work in progress. Article 2(13), added by Regulation (EU) 2026/1744, also lets the Commission limit specific requirements or obligations in Articles 9 to 15 and 17 to 25 for these systems, through delegated acts due by August 2, 2027, where the sectoral law gives an equivalent or higher level of protection and the limitation does not reduce the AI Act's overall level of protection. Article 13 is within that range; Article 43 is not.

Notified bodies are cautious. The Team-NB and IG-NB questionnaire on AI in medical devices (version 1.1, December 2024) says notified bodies do not consider devices whose models update through in-field self-learning "certifiable" unless the manufacturer ensures "the safe operation of the device within the scope of the validation described in the technical documentation." Team-NB's MDR certification consensus document (version 2.1, July 15, 2026) describes manufacturers notifying the notified body of planned substantial changes for assessment, and does not mention a predetermined or pre-agreed change plan.

What the Commission has proposed

COM(2025) 1023, the Commission's December 16, 2025 proposal to simplify the MDR and IVDR, would write a PCCP into both regulations. Section 4.9 of MDR and IVDR Annex VII, which sets requirements for notified bodies, would gain this paragraph: "Where appropriate, the notified body and the manufacturer shall agree on a predetermined change control plan enabling the manufacturer to implement changes in accordance with such a plan without prior information." Section 4.9 would also require procedures that "clearly distinguish between changes that do not need to be reported, that need to be reported without requiring prior approval and that require prior approval."

The same proposal would change how the AI Act reaches devices. Its Article 4 would move the MDR and IVDR from Annex I Section A to Section B. For Section B products, Article 2(2) of the AI Act, as amended, applies "only Article 6(1), Article 60a and Articles 102 to 112," with Articles 57 to 59 applying only as far as the AI Act's requirements are integrated into the sectoral law. Article 43(4) and Article 13(3)(c) would then stop applying to device AI directly. If the new Annex VII paragraph is adopted too, a plan agreed with the notified body under the MDR or IVDR would govern pre-agreed changes instead. As drafted, the Annex I move would apply from the regulation's entry into force and the annex changes six months later. A new Article 5(8) in each regulation would also have the Commission take the AI Act's high-risk requirements into account when it adopts implementing acts, delegated acts or common specifications for device AI. Finally, the proposal rewrites MDR Rule 11 for software. Because device AI is high-risk under Article 6(1) only when the MDR or IVDR sends it to a notified body, a change in software class could change its AI Act status as well.

Where the proposal stands

It is a proposal, not law. In Parliament, the lead committee (SANT, rapporteur Oliver Schenk) published a draft report with 131 amendments on June 30, 2026, and members tabled 726 more by the July 20 deadline. None of the 857 mentions a predetermined change control plan or targets Annex VII Section 4.9. The draft report leaves the Annex I move alone, but four tabled amendments (785 to 788) would delete it. The committee has not voted. Its work-in-progress list of October 16, 2026 provisionally schedules adoption of the draft report for December 3, and Parliament's procedure file gives an indicative plenary date of December 14, 2026. In the Council, the Working Party on Pharmaceuticals and Medical Devices had Presidency compromise texts on its September agenda, including one on the interplay with the AI Act, and its notice for October 26 and 27, 2026 lists an exchange of views on a third Presidency compromise. The Council's register entries for the September text on the AI Act interplay (ST 12273/26) and for the third compromise (ST 13649/26) both say, "The content of this document is not accessible."

What this means for manufacturers

1. Verify PCCP status from the documents. For predicate searches, competitive intelligence and due diligence, read the clearance letter and the summary. Among AI-enabled devices, FDA's list and database flag miss about one in six documented plans and can show a plan where the documents show none. And under section 515C(c), the predicate is the version cleared before any PCCP changes.
2. Make your own plan visible. FDA's guidance says the PCCP should be described in the public summary, and its draft general guidance recommends, in most cases, that labeling state that the device has an authorized PCCP. If your letter confirms a PCCP that FDA's list does not show, raise it with FDA; the PCCP page lists rpg@fda.hhs.gov for questions.
3. Scope inside the intended use and, generally, the indications. Take any narrow indications change, such as use with an additional device, to the review division through a Q-Submission, which FDA's AI guidance encourages.
4. Decide manual or automatic, global or local, up front. FDA's AI guidance asks the Description of Modifications to say which, and how often updates will happen. VIRTUE QA shows local retraining can be authorized, and FDA's sepsis example shows the controls FDA describes for it: manufacturer approval before each site goes live and a global model to fall back on.
5. Do not treat PCCPs as an AI tool only. Two-thirds of the entries decided through June 2026 are not on FDA's AI list, and they include manufacturing, supplier-qualification and antimicrobial susceptibility test plans.
6. Plan the EU file alongside the FDA plan. Put pre-determined changes in the Annex IV point 2(f) documentation and the instructions for use, agree with your notified body how they relate to change notifications under MDR Annex IX Section 4.10 (IVDR Annex IX Section 4.11), and organize the plan around N90's elements so one plan can map across jurisdictions. Then watch COM(2025) 1023: if both the Annex I move and the new Annex VII paragraph are adopted as proposed, a plan agreed with the notified body under the MDR or IVDR, not Article 43(4), would govern pre-agreed changes to device AI.

Scoping a PCCP for a 510(k), De Novo or PMA, or mapping pre-determined changes into an EU technical file? Book a 30-minute call with Zach Galloway to work through the plan's boundaries, the evidence behind each modification, and how the plan will read to FDA and to a notified body.