To PCCP or not to PCCP: Part 1 – The situation for EU & UK MDR

Pre-determined change control plans (PCCPs) are dawning as a new option for manufacturers, under MDR, to enact pre-accepted changes to their SaMD in the post-market phase.

PCCPs are currently in place under the FDA, with recent EU and UK regulatory signals suggesting a similar route is opening up for these markets. In this first of two blog posts, we will cover the current background on PCCPs, what the latest expectations are for future EU and UK regulatory requirements, and which devices and changes might be PCCP appropriate. 

What is a PCCP?

A PCCP is a plan, assessed and approved during initial conformity assessment or surveillance, that outlines specific changes that the manufacturer intends to make to the device in the post-market phase.

These plans detail:

• which changes a manufacturer plans to make to the device(s)
• how they will develop, validate, and implement those changes
• how they will assess, monitor, and control their impact on device safety and performance

What are the benefits of a PCCP?

In the current reality of changes to certified devices, manufacturers are required to notify their Notified Body (for EU MDR, and Approved Body for UK MDR) of these changes. These changes need to be assessed and approved by the Notified Body prior to market roll-out. This can affect device development cycles, impact business opportunities through delayed deployment of new features, and limit the beneficial clinical impact an adaptation of a device can have on the intended clinical populations or workflows. 

PCCPs provide a more AI-feature-aligned framework, allowing manufacturers to pre-specify the modifications they wish to make to their devices and, once their plans are approved by the Notified Body, roll them out without delay after following the necessary activities specified in their PCCPs. 

What can we learn from current PCCP frameworks?

In the US, the FDA already uses PCCPs to allow some pre-specified device modifications without new submissions, provided the changes stay within the authorised plan. Internationally, the IMDRF and joint FDA/Health Canada/MHRA “guiding principles” documents describe similar PCCP requirements:

1. Description of modifications – which changes you want pre-approved
2. Modification protocol – how you’ll manage data, retraining, performance evaluation, & updates
3. Impact assessment – how you’ll show that risks remain acceptable and requirements continue to be met

What are the current signals from the EU and UK regulatory landscape? 

EU:

For EU markets, two sources have started to introduce the notion of pre-approved changes, and briefly comment on the contents and use cases:

• AI Act (Regulation (EU) 2024/1689) – classifies most AI devices that undergo conformity assessment as high-risk AI systems and imposes additional AI-specific obligations. High-risk AI systems must have technical documentation under Article 11 (AI Act), including, where applicable, “a detailed description of pre-determined changes to the AI system and its performance” (Annex IV, 2(f)). Annex IV also requires validation/testing procedures, relevant outcome metrics, test logs and test reports - explicitly including those related to pre-determined changes. These obligations kick in from 2 August 2027
  • Note: at the time of writing, there are proposals being considered to extend the 2 August 2027 deadline, and also remove medical devices from requiring conformity assessment under the AI Act if they are already being assessed under MDR
• MDCG 2025-6 guidance on the interplay between MDR/IVDR and the AI Act – clarifies that pre-determined changes that are described in Annex IV 2(f) of the EU AI Act, and assessed during the initial conformity assessment, do not constitute a "substantial modification" and are not treated as changes to the certified device

UK: 

In the UK, there is no current statutory PCCP framework, but there are strong signals:

• MHRA, FDA, and Health Canada jointly published “Predetermined change control plans for machine learning-enabled medical devices: Guiding principles”, which lays out five high-level principles and positions to reduce repeated reassessments for frequent, low-risk updates
• MHRA’s broader SaMD / AIaMD Change Programme and the AI Airlock sandbox are exploring how PCCPs would work in practice for UK-marketed devices
• Future UK Medical Devices Regulations (expected 2026) are anticipated to formalise a PCCP-style approach

Are there certain devices or changes that suit a PCCP? 

PCCPs are not appropriate for every type of device or every type of change. While there is still an absence of clear EU/UK guidance or regulation, the signals from other regulatory frameworks and opinions are aligned on some typical use cases: 

• The device uses AI/ML that is periodically retrained or improved after deployment
• A manufacturer can define bounded change scenarios where the intended purpose remains stable, but performance or coverage evolves
• The changes would otherwise require repeated Notified Body/authority notifications or submissions – for example:
  • frequent model updates based on new training data
  • refreshed input sources (e.g. new scanners, new EHR data fields)
  • incremental expansion to clearly defined sub-populations

Typical good candidates could include:

• Diagnostic or triage SaMD with a stable intended purpose but regular retraining (e.g. image classification, risk prediction, decision support)
• Monitoring or prediction tools where models are periodically updated as more real-world data accumulates
• AI modules embedded in larger systems whose clinical function is clearly scoped and whose update behaviour can be described

Examples where a PCCP might be an appropriate route to take:

1. Quantitative performance improvements within the existing intended purpose
   • Example: A skin-lesion classifier for melanoma in adults is retrained periodically with more diverse images from the same intended use population to improve sensitivity/specificity
   • The PCCP would define:
     • performance metrics (e.g. AUC, sensitivity at fixed specificity)
     • acceptable ranges or improvement targets
     • validation datasets and methods
     • automated and manual checks before deployment
2. Modifications to device inputs
   • Example: A CT-based triage algorithm extends support from scanner models A-C to models D-F with similar technical characteristics
   • The PCCP would define:
     • how new input sources are characterised (DICOM properties, noise profiles)
     • agreement testing vs existing inputs
     • regression testing to ensure no degradation
3. Expanding a well-defined sub-population
   • Example: An AI model currently contraindicated for Fitzpatrick VI is later extended to include that sub-population once sufficient training and validation data is available
   • The PCCP would define:
     • objective inclusion criteria for new sub-populations
     • minimum data requirements and bias analyses
     • clear labelling updates and risk controls.

In light of the EU AI Act, manufacturers can think of these examples as pre-determined changes to performance and coverage that do not reflect substantial modifications to the intended purpose, performance, or safety of the device.

Examples of changes that are less suited to a PCCP

1. Fundamental changes to the intended purpose
   • e.g. expansion from a narrow, specialist, use environment to a broad primary-care context
2. Major architectural changes to the AI system
   • e.g. moving from a classical ML model to a large deep-learning or foundation-model architecture with different risk characteristics
3. New, poorly characterised data domains
   • e.g. extending from adults to paediatrics, or to populations with very different epidemiology, where clinical evidence is limited
4. When there is no real regulatory benefit
   • for devices where changes rarely trigger Notified Body notification (e.g. minor bug fixes, cosmetic UI changes), a PCCP may not be justified

Takeaways: What can a manufacturer do now?

In the absence of specific PCCP EU/UK regulatory requirements or guidance, manufacturers can nonetheless begin leveraging PCCP principles to support the post-market development of their devices.

Manufacturers should:

• Describe their PCCP-update strategy at the initial conformity assessment
• Provide clear and transparent plans for device development, and the methods that could be used to determine the continued performance and safety of the device, with updates to risk management and usability engineering procedures
• Tie their PCCP back to MDR/IVDR expectations for lifecycle management, risk management, and clinical evaluation in the post-market phase

In our second blog instalment on this topic, we will look more closely at the documentation required for a PCCP, based on the current expectations from international regulatory frameworks.