Reference · Healthcare

FDA's AI-Enabled Device Guidance: PCCP and Lifecycle, Explained

Predetermined Change Control Plans (final) · AI-Enabled Device Software Functions: Lifecycle Management (draft)

Last reviewed October 15, 2026

At a glance

PCCP guidance: Final. First issued 4 December 2024; current version issued 18 August 2025 (docket FDA-2022-D-2628)
Lifecycle guidance: Draft, issued 7 January 2025 and marked not for implementation (docket FDA-2024-D-4488). No final version as of 15 October 2026
Issued by: CDRH, CBER and CDER; the PCCP guidance also by the Office of Combination Products
Addressed to: Device manufacturers, through 510(k), De Novo and PMA submissions
Legal effect: Nonbinding recommendations. The binding rules are FD&C Act section 515C and 21 CFR 807.81(a)(3) and 814.39(a)
Next step: The final lifecycle guidance is on CDRH's A-list of priority guidances for fiscal year 2027

FDA has two guidances on how manufacturers of AI-enabled device software functions document change and the device lifecycle. The predetermined change control plan (PCCP) guidance is final: FDA first issued it on 4 December 2024 and issued the current version on 18 August 2025.FDA PCCP guidance The lifecycle management and marketing submission guidance was issued as a draft on 7 January 2025, and FDA's guidance page still lists it as one.Federal Register FDA lifecycle draft CDRH's list for fiscal year 2027, current as of 1 October 2026, names the final lifecycle guidance among the priority guidances it intends to publish during that fiscal year.CDRH FY 2027 list

Both guidances address the manufacturer. A health system, physician group or payer that runs an AI-enabled device answers a different set of questions: which version is running, what changed and when, how the device performs on its own patients, and where patient data goes. This page covers both sides.

The statute and regulations bind, and both guidances recommend

Both documents carry FDA's label for nonbinding recommendations, and the lifecycle draft adds that it is not for implementation.PCCP guidance Lifecycle draft The binding rules sit in the law the PCCP guidance explains. Section 515C of the Federal Food, Drug, and Cosmetic Act lets FDA authorize a PCCP with a device, and a change made under the plan then needs no new 510(k) or PMA supplement.FD&C Act § 515C Outside a plan, a significant modification needs a new marketing submission.21 CFR 807.81 · (a)(3)21 CFR 814.39 · (a)

FDA states that a deviation from an authorized PCCP would generally make the device adulterated and misbranded under sections 501(f)(1) and 502(o) of the Act.PCCP guidance · Section V The structure and content the guidance recommends for a plan, and everything in the lifecycle draft, remain recommendations.

Cite the PCCP guidance as final and the lifecycle guidance as a draft. A draft is FDA's proposed thinking, and its recommendations may change before it is finalized.

A PCCP lets a manufacturer change an authorized device without a new submission

A PCCP lists the modifications a manufacturer plans to make, and FDA reviews and authorizes it with the device. A modification specified in the plan and implemented under its protocol needs no new marketing submission, because FDA reviewed it with the plan. The manufacturer documents the modification in its quality system.PCCP guidance · Sections V, V.D

The final guidance recommends three components, which FDA reviews together.PCCP guidance · Section V.A

Description of Modifications: the specific planned modifications, with specifications for their characteristics and performance.
Modification Protocol: the verification and validation activities, with predefined acceptance criteria, that support each modification. It covers data management, re-training, performance evaluation and update procedures, including how labeling is updated.PCCP guidance · Section VII.B
Impact Assessment: the benefits and risks of the planned modifications, and how the Modification Protocol keeps the device safe and effective.

FDA recommends that manufacturers consider the intended use populations, for example by race, ethnicity, disease severity, sex and age, and the intended environments of use, so the device continues to reflect them as it is modified.PCCP guidance · Section V.A

Each update under a PCCP ends with a decision the deploying organization records

For a device with an authorized PCCP, FDA recommends that the labeling say so and tell users that software updates may change the device's performance, inputs or use. As each modification is implemented, the labeling should describe it: current device performance, the data used, the inputs and outputs, how the modification was implemented, and how users are told, for example through updated instructions for use or a version history. The plan itself should be described in the public 510(k) summary, De Novo decision summary or PMA summary of safety and effectiveness.PCCP guidance · Section V.C

A modification inside the plan reaches the deploying organization without a new FDA review of that specific change, so the organization decides for itself whether its local validation, clinical workflow and monitoring thresholds still hold for the new version. That decision, with its date and owner, is the deployer's record of the change.

Flow

From a planned modification to the deployer's record

ManufacturerImplements a planned modificationSpecified in the plan, run under its protocol, documented in its quality system
LabelingLabeling and version history updateCurrent performance, the data used, how users are informed
DeployerDated review of the new versionLocal validation, clinical workflow, monitoring thresholds
RecordThe decision is recordedWho decided, when, and for which version

Steps 1 and 2 are from Sections V.C and V.D of the final PCCP guidance, which addresses the manufacturer. Steps 3 and 4 are ours: what a deploying organization does with the update.

The lifecycle draft sets the vocabulary for procurement

The draft describes what FDA recommends a marketing submission for an AI-enabled device contain, and design and development practices across the total product life cycle.FDA lifecycle draft It is a draft and creates no obligation for a manufacturer or a deployer. Its terms give both sides a shared vocabulary for contract questions and for the deployer's own review.

CDRH put the final version on its fiscal year 2026 B-list, the guidances it would publish as resources permit, and the guidance stayed a draft through that year.CDRH FY 2026 list The fiscal year 2027 list moves it to the A-list of priorities.CDRH FY 2027 list The topics a deployer can use now:

Data management: sources, collection, annotation, representativeness, and the independence of test data from development data.Lifecycle draft · Section VIII
Human-AI interaction: the user interface, the degree of automation, and the performance of the user and the device working together as a team.Lifecycle draft · Sections VI, X.A
Subgroup performance: labeling that explains performance across important subgroups such as sex, age, race, ethnicity and disease severity, at each operating point, with a model card as an optional format.Lifecycle draft · Section VI.B, Appendix E
Post-market monitoring: a plan to identify and respond to performance changes, including those from data drift and changes in patient populations.Lifecycle draft · Section XI
Version control: a software version history that includes the model version and any difference between the tested and the released model.Lifecycle draft · Section X

Patient data an AI device sends off-site falls under HIPAA

A marketing authorization addresses the device's safety and effectiveness. When a device feature sends images, notes or other patient data off the device, for example to a manufacturer's cloud for inference, storage or support, that data is electronic protected health information for a covered entity, and the HIPAA Security Rule governs it.45 CFR 164.306 · (a)(1)

A manufacturer that creates, receives, maintains or transmits PHI on the covered entity's behalf is generally a business associate.45 CFR 160.103 · Business associate The covered entity needs a business associate agreement before PHI reaches it, and the agreement sets the uses of PHI the manufacturer may make.45 CFR 164.502 · (e)(1)45 CFR 164.504 · (e)(2)(i) If the manufacturer wants device data to develop future versions, including modifications under its PCCP, the agreement has to say whether that use is permitted.

The data flow belongs in the Security Rule risk analysis like any other system that uses ePHI.45 CFR 164.308 · (a)(1)(ii)(A) The safeguards that apply to it are in the HIPAA Security Rule and AI workloads.

Six questions to put to the manufacturer before contract and at each update

Both guidances describe information the manufacturer prepares for FDA and for labeling. A deploying organization can ask for the same information.

Model card or summary: intended use, inputs and outputs, the data the model was developed and tested on, and known limitations.Lifecycle draft · Appendix E
Performance by subgroup: which subgroups were evaluated, the results for each, and at which operating point.
Authorized PCCP: whether the device has one, which modifications it covers, and where it appears in the public device summary.
Change notification: how and when the organization learns that a modification has been implemented, whether updates install automatically or on the site's schedule, and where the version history is kept.
Post-market monitoring: what the manufacturer monitors, what the site is expected to report back, and what triggers action.
Data location and retention: where device inputs and outputs are processed and stored, whether any leave the device or the organization's network, for how long they are kept, and under which agreement.

FDA's list of AI-enabled devices is a starting point for an inventory

FDA publishes a list of AI-enabled medical devices authorized for marketing in the United States and updates it periodically. Each row gives the date of final decision, the submission number, the device, the company, the lead review panel and the primary product code. FDA states that the list is not comprehensive: it finds devices mainly through AI-related terms in their authorization documents or classification.FDA AI device list

The submission number leads to the device's public summary, which is where an authorized PCCP should be described.PCCP guidance · Section V.C

Control mapping

What a reviewer expects to be able to see.

Obligation	What the system must do	Evidence a reviewer expects
Version change control	Know when the model behind a device function changed and whether the change fell within the PCCP	Version history, the manufacturer's labeling and release notes, and the organization's dated review of each change
Subgroup performance	Know how the device performs on the populations the organization serves	The manufacturer's subgroup results and the organization's local validation
Post-market monitoring	Monitor real-world performance with triggers for action	The monitoring plan, metrics, and runtime inputs
Human factors	Design the human-AI workflow against automation bias	Workflow documentation and human-review records
PHI leaving the device	Cover off-device data flows under the HIPAA Security Rule	The data flow in the risk analysis, the business associate agreement, and a record of what left the device
Lifecycle record-keeping	Keep records across the lifecycle	The deployment record alongside the sponsor's development and validation records

Key dates

Timeline, drawn to scale

Two FDA guidances, from first issue to the review date

FDA action, or the review dateFirst issue of each guidance

Dates from the final PCCP guidance, the Federal Register notice for the lifecycle draft and CDRH's fiscal year 2027 guidance list. Status as of October 15, 2026.

4 December 2024FDA issues the final predetermined change control plan guidance for AI-enabled device software functions.
7 January 2025FDA issues the draft lifecycle management guidance for AI-enabled device software functions (90 FR 1154).
7 April 2025Comment date in the Federal Register notice for the lifecycle draft. FDA accepts comments on any guidance at any time.
18 August 2025FDA issues the current version of the final PCCP guidance.
1 October 2026CDRH's fiscal year 2027 guidance list moves the final lifecycle guidance to the A-list of priorities.
15 October 2026Review date. FDA's guidance page lists the lifecycle guidance as a draft, and the Federal Register carries no final version.

Sources cited

Common gaps

Where deploying organizations are least prepared.

Nobody knows the version in use. A vendor pushes an update within its plan. The organization learns of it from a changed output, before anyone reads the release note.
Monitoring without a plan. Over-read disagreement rates exist in someone's spreadsheet. No trigger, no cadence, no owner.
Subgroup results never requested. The contract covers uptime and support. Nobody asked how the device performs on the populations the organization actually serves.
Patient data leaves through the device. A cloud-connected feature sends studies to the manufacturer for inference. The risk analysis does not list the flow, and no business associate agreement covers it.45 CFR 164.308 · (a)(1)(ii)(A)
Draft guidance quoted as requirement. The lifecycle guidance is a draft.FDA lifecycle draft Citing it as binding overstates the posture and misleads a reviewer.

In practice

How Meilynx maps to the FDA guidances for deployers →

Last reviewed October 15, 2026. This reference summarises publicly available regulatory guidance and is provided for general information. It is not legal advice. Obligations depend on an institution's charter, registration status, size, and activities. Verify against the primary sources cited above and consult counsel before relying on any summary here.