The device you validated is not the device you are running (external link)
A Predetermined Change Control Plan is the FDA mechanism that lets a vendor modify a cleared AI device — retrain it, extend it to new equipment, optimise the algorithm — without coming back for a new clearance, provided they said in advance what kinds of change they might make.
I understand why it exists. The alternative is a device frozen at the moment of clearance, degrading quietly as everything around it changes. That is worse.
This scoping review characterises how PCCPs are actually being used in radiology, and one sentence in the results is the reason I am writing about it:
Continuous monitoring of device performance and predefined drift triggers for retraining were absent from public summaries.
So the mechanism that permits the model to change is in place and being adopted quickly — 34 of the 37 AI/ML-specific PCCP devices are radiology, 22 of those 34 cleared in 2025 alone after the final guidance landed. But the part that would tell me when it changes, what would trigger a retrain, and how anyone would notice degradation is not in the public documentation. Mean documentation score was 5 out of 8.
Sit with what that means operationally. I validate a tool in January. I run my own acceptance testing, check it against our study descriptions, tune the worklist rules, train the radiologists on what its flags mean. In June the vendor pushes an update inside the scope of their PCCP. No new clearance, no event I necessarily see. The thing my radiologists learned to trust has been retrained on data I know nothing about, and the document that was supposed to govern that does not state the performance thresholds.
There is a smaller finding that bothers me nearly as much: for 9 of 34 devices (27%), FDA's public database and the individual device summaries disagreed enough to require manual adjudication by the reviewers. Twenty-seven percent. If you have ever tried to answer "what exactly is cleared here" for a compliance committee, you already know this, but it is useful to have it counted.
None of this is an argument against PCCPs. It is an argument that the questions have moved. The procurement conversation is still built around a one-time validation, as though clearance were an event. With a PCCP it is a licence to keep changing, which makes the useful questions: what triggers a retrain, what do you monitor, what do you consider a decline, and will you tell me when it happens?
I have started asking those in writing. I recommend it. The answers, and the silences, are informative.