← All Terms

Predetermined Change Control Plan

PCCP

A plan, agreed at approval, that sets out how an AI system may change afterwards, how each change is tested, and its expected impact, so planned changes need no new approval.

Governance & Risk

The US FDA finalised its guidance on Predetermined Change Control Plans for AI-enabled device software on 4 December 2024. A plan has three parts: a description of the planned modifications, the protocol for developing, testing and rolling them out, and an assessment of their impact. Changes made within the plan do not need a new marketing submission.

The EU AI Act takes the same approach in Article 43(4). For high-risk systems that keep learning, changes the provider set out at the initial conformity assessment, and recorded in the technical documentation, are not substantial modifications.

The idea travels well beyond medical devices. Any organisation running AI that changes after approval, whether through retraining or learning on the device, can write down in advance what may change, by how much, how it will be checked and how to roll back. Without that, the original approval stops describing the system in use.

Read more on this
Security

Neuromorphic AI Moves the Attack Surface Into the Device

Brain-inspired neuromorphic chips run AI as bursts of events inside sensors, cameras and controllers, and some of them keep learning after they ship. That changes cybersecurity in three ways: attackers can work through light, timing and power as well as code; the usual scanners and patches do not reach the chip; and the device you approved may not be the device in the field a year later. Maria Singh and I set out what changes, what the research already shows, and how to govern AI that adapts inside physical devices.