If you are taking an AI-enabled device to the US market, you have almost certainly been handed a stack of FDA "AI guidance" and told to comply with all of it. That advice is subtly wrong, and the error is expensive. The FDA's AI documents do not carry equal weight. One of them is final, updated, and enforceable today. The most-cited one is still a draft stamped "Not for implementation." Treating them as interchangeable is how teams either over-build against a document the FDA can't hold them to, or under-build against the one it can.
Here is the actual state of the US rulebook for AI-enabled devices as of October 2026 — what binds you, what merely signals direction, and what to put in a submission this quarter.
Two documents, two very different statuses
The confusion is understandable, because the FDA released the two pieces within a month of each other and the press covered them as a single event. They are not.
| Document | Status | What it means for you |
|---|---|---|
| PCCP marketing-submission guidance — predetermined change control plans for AI-enabled device software functions | Final | Binding. Finalised December 2024, updated August 2025. This is the mechanism reviewers will actually apply to your change plan. |
| Lifecycle management & marketing-submission guidance — the "total product lifecycle" (TPLC) draft for AI-enabled device software functions | Draft | Directional. Issued 7 January 2025, comment window closed 7 April 2025, still not finalised. Marked "Not for implementation" — but it tells you what reviewers are thinking. |
The practical reading: build the PCCP to the letter, because it is law in all but name. Build toward the TPLC draft in spirit, because it is where review is heading — but do not treat its every recommendation as a hard requirement you can be refused over.
The PCCP: the one piece of leverage the FDA has handed you
A predetermined change control plan is the single most valuable regulatory instrument available to an AI-enabled device in the US, and the most under-used. It lets you pre-authorise a defined envelope of future model changes — retraining on new data, threshold adjustments, performance improvements — at the point of your original clearance, so that changes falling inside the envelope do not require a new marketing submission.
For a learning system, that is the whole game. Without a PCCP, every meaningful model update risks a new 510(k). With one, you ship improvements inside the pre-agreed boundary and keep moving.
The final guidance requires three components, and reviewers will look for all three:
| Component | What it has to contain |
|---|---|
| Description of Modifications | The specific changes you intend to make over time — stated concretely, not "we may improve the model". Include whether each change is automatic or manual, and global or site-specific. |
| Modification Protocol | The methods: how you will develop, validate and implement each change, the data you will use, the acceptance criteria, and the performance thresholds that gate a release. |
| Impact Assessment | The risk analysis of the modifications — benefits, risks, and how the protocol mitigates them, including the effect on previously cleared versions. |
The mistake we see most often: a PCCP written as a vague promise of future improvement. Reviewers reject those. A fundable PCCP reads like an engineering control document — bounded, measurable, and specific enough that an FDA reviewer can tell, in advance, whether a given future change is inside or outside the box.
The TPLC draft: where review is going, even before it's final
The January 2025 draft is not binding — but it is the clearest signal the FDA has given about what an AI-enabled device submission should contain, and reviewers do not un-know its contents just because the ink isn't dry. Its content elements are worth building toward now:
- Model description and development approach — architecture, training methodology, and the rationale for design choices.
- Data lineage and demographic composition — where the training, tuning and test data came from, and who is represented in it.
- Performance tied to claims — evidence that measured performance directly supports the stated intended use, not a generic accuracy figure floating free of the indication.
- Bias analysis and mitigation — performance broken down across demographic subgroups, with documented mitigation where it varies.
- Human–AI workflow — how the output reaches the clinician, what they can override, and how uncertainty is surfaced.
- Real-world performance monitoring — how you will detect drift and degradation once the device is in use.
Underneath both documents sit two older tripartite instruments — developed by the FDA with Health Canada and the UK's MHRA — that still frame the agency's expectations: the ten Good Machine Learning Practice guiding principles (2021) and the transparency principles for machine-learning-enabled devices (2024). Neither is a regulation. Both are the vocabulary your reviewer thinks in.
The transatlantic dividend
For the AI-enabled device companies we work with — most of which are going to the US, the EU and Singapore in parallel — the reassuring news is that the US evidence set overlaps heavily with what the EU AI Act, MDCG 2025-6 and Singapore's HSA ask for. Data lineage, subgroup performance, human-oversight design and drift monitoring appear on all three regulators' lists. The FDA calls it a PCCP; the EU calls the same idea a predetermined change control plan under the MDR. The vocabulary diverges; the artefacts converge.
Build the data-governance record, the subgroup performance evidence, the oversight rationale and the monitoring plan once — structured to satisfy the strictest reader — and you are answering three regulators from one source of truth. The alternative is building them three times, late, and reconciling versions for two years.
The one-line version: the PCCP guidance is final and is your most valuable tool — write it like an engineering control, not a promise. The lifecycle guidance is still a draft — build toward it, but know its limits.
What to do this quarter
01 · Draft the PCCP first, not last
Decide the change envelope before you finalise the submission. A PCCP bolted on at the end is always narrower and vaguer than one designed in from the start.
02 · Tie every performance number to a claim
The draft's clearest signal: the FDA wants performance evidence mapped to your specific intended use, not a headline accuracy stat. Restructure your V&V reporting around the indication.
03 · Produce subgroup performance now
Break performance down by the demographic and clinical axes that matter for your indication, and document mitigation where it degrades. This is the single most common gap in AI submissions.
04 · Write once for three markets
Structure the data-governance, subgroup and monitoring artefacts so the same source answers the FDA, a notified body and HSA. Don't fork them per market.
Sources & further reading
- Federal Register — AI-Enabled Device Software Functions: Lifecycle Management and Marketing Submission Recommendations (draft, 7 Jan 2025).
- FDA — Marketing Submission Recommendations for a Predetermined Change Control Plan for AI-Enabled Device Software Functions (final, Dec 2024).
- King & Spalding — FDA releases draft guidance on submission recommendations for AI-enabled device software functions.
- FDA / Health Canada / MHRA — Good Machine Learning Practice: 10 guiding principles (2021).
- CenterWatch — FDA guidance on AI-enabled devices: transparency, bias & lifecycle oversight.
This article is general information current as at 2 October 2026, not regulatory or legal advice. FDA guidance status changes; confirm the current version and status for your specific device and submission type before acting.