FDA Predetermined Change Control Plan (PCCP)

A foundational set of best practices co-developed by the FDA, Health Canada, and the UK's MHRA to guide the development and validation of AI/ML-enabled medical devices. GMLP principles emphasize data quality management, robust model evaluation, and performance monitoring across the total product lifecycle. A PCCP is a direct operationalization of GMLP, providing a structured mechanism to manage iterative improvements while maintaining safety and effectiveness without triggering a new premarket submission.

Structured transparency documents that report the intended use, evaluation results, and ethical considerations of a trained machine learning model. For a PCCP submission, model cards serve as a critical audit artifact, detailing the model's performance characteristics at the time of initial clearance. When a manufacturer executes a planned modification under an approved PCCP, the model card must be updated to reflect the new version's performance metrics, ensuring continuous transparency and traceability for regulators and end-users.

The process of estimating and characterizing the different sources of noise and model ignorance that contribute to the total predictive uncertainty of a model's output. In a PCCP context, manufacturers must demonstrate that planned modifications do not degrade the model's calibration or increase its epistemic uncertainty on novel inputs. Techniques such as Monte Carlo Dropout or Deep Ensembles are often used to establish pre-defined performance boundaries that, if breached, trigger a PCCP's rollback or halt protocol.

The task of identifying test inputs that are statistically different from the training data, on which a machine learning model's predictions are likely to be unreliable. A robust PCCP often includes a safeguard specification that integrates an OOD detector. The plan pre-specifies how the device will handle anomalous inputs—such as deferring to a human operator or issuing a low-confidence alert—and how the OOD detection threshold itself may be updated as part of an authorized modification to maintain real-world performance.

Quantitative measures that assess how accurately an explanation method reflects the true reasoning process of the underlying machine learning model. When a PCCP authorizes a modification that alters the model's architecture or weights, manufacturers must validate that the explanation system remains faithful. A planned change that improves sensitivity but causes the saliency map to highlight spurious correlations would fail a pre-specified faithfulness check, triggering a review under the PCCP's verification and validation protocol.

The ability of a machine learning model to maintain accurate predictions when presented with intentionally perturbed inputs designed to cause misclassification. A PCCP for a diagnostic device must address how planned modifications impact adversarial vulnerability. The plan pre-specifies testing protocols—such as projected gradient descent attacks—to verify that a model update does not introduce new failure modes. This is critical for maintaining the device's safety profile across its iterative lifecycle.