FDA Publishes Final Predetermined Change Control Plan Guidance for AI-Enabled Device Software Functions

On December 4, 2024, FDA finalized its guidance entitled “Marketing Submission Recommendations for a Predetermined Change Control Plan for Artificial Intelligence-Enabled Device Software Functions” (the “2024 Final Guidance”). The Final Guidance replaces the Draft Guidance issued in April 2023 (the “2023 Draft Guidance”).

The 2024 Final Guidance is largely consistent with the 2023 Draft Guidance but has some notable changes, as discussed below. Please see our Client Alert on the 2023 Draft Guidance for a detailed overview of FDA’s current thinking on Predetermined Change Control Plans (PCCPs) for artificial intelligence (AI)-enabled device software functions outside of the changes discussed here. We also note that that some of the process-related changes appear to bring the 2024 Final Guidance into alignment with FDA’s Predetermined Change Control Plans for Medical Devices Draft Guidance published August 22, 2024, which applies the concept of PCCPs to non-AI-enabled medical devices.

NOTABLE SCOPE, DEFINITIONAL, AND HIGH-LEVEL CHANGES

• Machine Learning Device Software Functions (ML-DSFs) have been renamed AI-Enabled Device Software Functions (AI-DSFs), although FDA acknowledges in the Scope section of the 2024 Final Guidance that most PCCPs FDA has reviewed are in the subset of AI known as Machine Learning (ML).
  
  
• FDA has included a definition of AI to align with its “Digital Health and Artificial Intelligence Glossary” published in September 2024. FDA defines the term “AI” as follows:

A machine-based system that can, for a given set of human-defined objectives, make predictions, recommendations, or decisions influencing real or virtual environments. Artificial intelligence systems use machine- and human-based inputs to perceive real and virtual environments; abstract such perceptions into models through analysis in an automated manner; and use model inference to formulate options for information or action.

• A machine-based system that can, for a given set of human-defined objectives, make predictions, recommendations, or decisions influencing real or virtual environments. Artificial intelligence systems use machine- and human-based inputs to perceive real and virtual environments; abstract such perceptions into models through analysis in an automated manner; and use model inference to formulate options for information or action.
  
  
• In its definition of “Test Data” in the 2024 Final Guidance, FDA goes beyond simply defining the term and provides expectations regarding the purpose, timing, outcome, characteristics, and independence of test data, with respect to training and tuning data. FDA defines the term “Test Data” in a single sentence then establishes expectations as follows:

These data are used to characterize the performance of an AI-DSF. These data are never shown to the algorithm during training and are used to estimate the AI model’s performance after training. Testing is conducted to generate evidence to establish the performance of an AI-DSF before it is deployed or marketed. The testing phase is also expected to provide evidence to demonstrate a reasonable assurance of safety and effectiveness of an AI-DSF before it is deployed or marketed. These data typically should be representative of the proposed intended use populations (e.g., with respect to race, ethnicity, disease severity, gender, age, or others, as appropriate) and intended environments. Test data should be independent of data used for training and tuning and should generally be from multiple sites different from those that were used to generate training and tuning data.

• Section V.B (Establishing a PCCP) now details the specific submission types FDA considers appropriate for establishing a PCCP (i.e., five submission types for AI-DSFs subject to PMA requirements, two submission types for AI-DSFs subject to 510(k) requirements, and original De Novo requests). This section also elaborates on the importance of following the Quality System Regulation requirements for each modification described in the PCCP and how such compliance might impact its approval or clearance of the product. [Note: FDA’s Quality System Regulation will be replaced by the Quality Management System Regulation (QMSR) effective February 2, 2026. The QMSR aligns the medical device regulatory framework by incorporating by reference ISO 13485:2016 (Medical devices – Quality management systems – Requirements for regulatory purposes) and Clause 3 (Terms and definitions) of ISO 9000:2015 (Quality management systems – Fundamentals and vocabulary).]
  
  
• Section V.C (Identifying a PCCP in a Marketing Submission) has been modified to add specific labeling recommendations, including (1) a statement that the device has an authorized PCCP and (2) a revision of King & Spalding Client Alert 3 labeling after modifications are made to the AI-DSF to include a description of implemented modifications, how the modifications were implemented, and how users will be informed of the implemented modifications. FDA also provides more specific recommendations compared to the 2023 Draft Guidance regarding the description of the PCCP in public-facing documents (i.e., 510(k) summaries, PMA summary of safety and effectiveness documents (SSEDs), and De Novo decision summaries), including summaries of planned modifications, test methods, acceptance criteria (i.e., validation and performance requirements), and how users will be informed of modifications.
  
  
• Section V.D (Utilizing an Authorized PCCP to Implement Device Modifications) adds more specific guidance regarding actions a manufacturer should take if a modification is not included in the PCCP (i.e., follow existing statutory and regulatory requirements and FDA guidance documents on device modifications) or if it is included but not implemented in accordance with the PCCP’s Modification Protocol (i.e., consider that a new submission may be necessary).
  
  
• When modifying a previously authorized PCCP, FDA has added to Section V.E of the 2024 Guidance a recommendation for a summary of the changes to the PCCP and a version of the revised PCCP with tracked changes as part of the submission. This section is identical to Section V.E in FDA’s August 2024 Draft Guidance on PCCPs for medical devices other than AI-enabled devices. 
  
  
• The 2024 Final Guidance adds Section V.F (Version Control and Maintenance of a PCCP for a Device), which borrows language directly from Section V.F of the August 2024 Draft Guidance. The first part of this section states that FDA will provide feedback on PCCPs during the submission review process through deficiency letters. This section states that manufacturers should clearly indicate the title and current version of the PCCP when revising the document in response to deficiencies. The second part of the section addresses modifications made to devices with an authorized PCCP that are not within the scope of the PCCP and require a new marketing submission. In such cases, FDA will not re-review the PCCP or modifications made within the scope of the authorized PCCP but will focus on the modifications that are specific to the submission.
  
  
• FDA modifies its reference to AI-DSF data categories throughout the 2024 Final Guidance from “training and testing” to “training, tuning, and testing.”

NOTABLE CHANGES TO THE DESCRIPTION OF MODIFICATIONS

• The 2023 Draft Guidance proposed that FDA would consider PCCPs for ML-DSFs using automatic implementation of modifications, and Section VI.B (Content of the Description of Modifications Section) of the 2024 Final Guidance confirms this will be the case for AI-DSFs. The Final Guidance also recommends that manufacturers using automatic implementation of modifications discuss this approach with FDA using the Q-Submission Program. As we describe in this client alert (see below) and in our prior Client Alert on the 2023 Draft Guidance, such language does not, in and of itself, support algorithms employing continuous learning.
  
  
• Section VI.B (Content of the Description of Modifications Section) outlines additional recommendations to include expected frequency of updates in the Description of Modifications section of the PCCP.
  
  
• Section VI.C (Types of Modifications) backs away from a clear prohibition against incorporating changes to indications for use in a PCCP and states that some such changes may be considered, and to engage with FDA using the Q-Submission process to discuss further.

NOTABLE CHANGES TO THE MODIFICATION PROTOCOL

• The 2024 Final Guidance adds in Section VII.A (Goals of the Modification Protocol Section) an additional goal for Modification Protocols regarding identification of the update process and the manufacturer’s plan for communication and/or training for users for implemented modifications.
  
  
• Section VII.B(1) (Data Management Practices) now states that manufacturers should include information in their modification protocol regarding “the process that will be followed to determine the reference standard (representing the ground truth), [and a] protocol describing how the reference standard is determined.”
  
  
• Section VII.B(3) (Performance Evaluation) now states that for a failure identified during performance evaluation to prevent implementation of a modification, the failure should be “unresolvable.” According to FDA, a failure would not be “unresolvable” if there is a root cause analysis of the failure revealing it is not related to “specific aspects of the PCCP.”
  
  
• Section VII.B(4) (Update procedures) now clarifies that devices required to have a Unique Device Identifier (UDI) must generate new UDIs “when there is a new version and/or model, and for new device packages.”
  
  
• Appendix A provides example elements of a Modification Protocol, and in Section (1)(d) of the appendix (Data Management / Sequestration of test data sets), the 2024 Final Guidance adds a recommendation to include “descriptive statistics (e.g., covariate range, mean, median) for each data set and how similar they are for the intended use population.”
  
  
• In Appendix A Section (4)(d) (Update Procedures / Device monitoring plan), the 2024 Final Guidance adds recommendations to describe how information about monitoring real-world device performance will be provided to users, how and at what frequency changes in safety and effectiveness will be monitored, and a roll-back plan to bring devices back to a previous version, if applicable.

 NOTABLE CHANGE TO THE IMPACT ASSESSMENT

Section VIII (Impact Assessment) adds a recommendation for manufacturers of combination products to “discuss how the individual modifications included in the PCCP for the device constituent part impact the biologic and/or drug constituent part, and the combination product as a whole.”

EXAMPLES (APPENDIX B)

The 2024 Final Guidance made only minor changes to the example scenarios for AI-DSFs employing PCCPs provided in the 2023 Draft Guidance. One additional example was provided in the 2024 Final Guidance for a combination product (optical imaging system co-packaged with an imaging drug).

CONTINUING CONCERNS ABOUT CONTINUOUS LEARNING

We remain concerned that the 2024 Final Guidance does not fully support adaptive algorithms using continuous learning models (i.e., those that continually update themselves in their operating environment based on real-world data and performance).

In the Scope section of the 2024 Final Guidance, FDA adds to its previous language regarding automatically implemented modifications by referring to these modifications as “continuous learning.” We note that although FDA makes this correlation in an attempt to accommodate continuous learning models into the 2024 Final Guidance, FDA’s definition of “Continual Machine Learning” adds burden to the concept that is not clearly incorporated into other definitions. The “Digital Health and Artificial Intelligence Glossary” maintained on FDA’s website defines “Continual Machine Learning” as:

The ability of a model to adapt its performance by incorporating new data or experiences over time while retaining prior knowledge/information. The model changes are implemented such that for a given set of inputs, the output may be different before and after the changes are implemented. These changes are typically implemented and validated through a well-defined process that aims at improving performance based on analysis of new data. In contrast to a locked model, a continual machine learning model has a defined learning process to change its behavior.

The glossary citation above states that this is an adaptation from ISO 22989:2022. The definition of “continuous learning” in the ISO standard, however, simply states it is “incremental training of an AI system that takes place on an ongoing basis during the operation phase of the AI system life cycle.” The International Medical Device Regulator’s Forum (IMDRF), of which FDA is a member, only slightly modifies this definition in its own “Machine Learning-enabled Medical Devices—A subset of Artificial Intelligence-enabled Medical Devices: Key Terms and Definitions.” FDA’s implication in its AI glossary that continuous learning changes are “implemented and validated through a well-defined process” is in conflict with other definitions that allow for unattended updates to adaptive algorithms in their operating environments and may put burdens on changes to a continuous learning model similar to that of a locked model (i.e., one that is initially trained and does not change with use but must be retrained and retested to incorporate “learning” from new data).

The 2024 Final Guidance also maintains the requirement for implementation of full design controls (including verification and validation of the “entire device” (Section VII.B(3) of the 2024 Final Guidance)) for each modification implemented in the context of an authorized PCCP. This requirement is a significant barrier to any manufacturer seeking to implement adaptive algorithms using continuous learning unless a way can be found to meet the quality system requirements for design changes, likely in an automated way and possibly as an add-on software item to the medical device within its operating environment.

For manufacturers seeking to deploy adaptive algorithms, the FDA has expressed its desire to engage with such firms in its continuing search for ways to support this technology without compromising the safety and effectiveness of marketed medical devices. Firms going down this road, however, must recognize that the costs associated with the development of adaptive technologies may not be recouped if engagement with FDA during a Q-Submission or other interactive process does not result in alignment on issues of safety, effectiveness, and regulatory compliance.

FINAL THOUGHTS

We continue to view the FDA’s implementation of PCCPs within the regulatory framework as a positive step in integrating the capabilities of AI into the healthcare ecosystem. We encourage firms to carefully review the 2024 Final Guidance in light of our comments on the 2023 Draft Guidance and our thoughts expressed above.