FDA’s AI Guidance: Unshackling Innovation, Elevating Risk for Investors

The FDA’s new draft guidance on Predetermined Change Control Plans (PCCPs) is completely changing the game for AI in healthcare, forcing a rethink of risk for founders and their VCs. For years, the industry has been stuck. The FDA’s traditional 510(k) clearance process which was designed for static hardware, was a terrible fit for AI that needs to learn and adapt. The new PCCP guidance, released in April 2023, finally gives AI-enabled medical devices a way to get better over time without going back to the FDA for every single update. This gives companies an incredible speed advantage, but it also creates a whole new world of compliance risk if you don’t have your house in order.

From Static Reviews to Dynamic AI

Historically, any meaningful change to a cleared medical device, and that includes AI/ML-based Software as a Medical Device (SaMD), usually meant filing a new 510(k). This process was a black hole for productivity, taking an average of 156 days and effectively freezing product development. Every time a team wanted to retrain a model with new data, tweak a data pipeline, or add a feature, they’d face another regulatory submission that would kill their momentum and delay getting better tools to clinicians. You ended up with this constant fight between wanting to improve your AI’s performance to combat things like algorithmic drift and just staying compliant. The FDA’s draft guidance on PCCPs, spearheaded by the Digital Health Center of Excellence, finally accepts that adaptive AI/ML is different. A PCCP is basically a pre-negotiated agreement with the FDA where a manufacturer defines the specific kinds of changes they plan to make to their AI and, just as important, the exact methods they’ll use to prove the changes are safe and effective. With an approved plan, you can make those specified changes without a new premarket submission for each one, letting the device get smarter post-market while still meeting the FDA’s standards for safety.

PCCPs: Faster Iteration, Higher Stakes

For a digital health founder, the appeal of a PCCP is obvious: you can finally move fast. Consider a cardiac AI built to detect atrial fibrillation. With a PCCP, that company can keep retraining its model on new real-world evidence (RWE), making it more accurate or even expanding its use case without getting stuck in the 510(k) queue over and over. This is how an AI-first company can quickly improve its initial product, react to what clinicians are seeing on the ground, and build a real data advantage over slower competitors. But this speed comes with a lot of responsibility. The PCCP is a detailed contract, not a blank check. You have to specify everything in a tightly defined plan, including:

• The specific types of changes permitted (e.g., model retraining with new data, adjustments to hyperparameters).
• The methods for validating each change (e.g., predefined performance metrics, statistical analyses, clinical evaluation protocols).
• The data management practices, including data governance and quality assurance for new training data.
• Strong monitoring strategies to detect and mitigate algorithmic drift.

If you don’t follow your approved PCCP to the letter, or if you can’t maintain the clinical infrastructure to continuously validate your own work, you’re facing massive compliance risk that could lead to recalls or serious enforcement actions. The burden of continuous assurance effectively moves from the FDA to you, the manufacturer. This demands a very mature Quality Management System (QMS) and a deep commitment to Good Machine Learning Practice (GMLP) principles.

New Due Diligence for VCs

For venture capitalists, PCCPs completely change how you de-risk a deal in this space. Just seeing an “FDA cleared” checkmark in a pitch deck doesn’t mean what it used to. VCs now have to dig into a company’s ability to handle ongoing regulatory and clinical validation themselves. The diligence questions should get a lot more specific:

• Does the company have an approved PCCP? What exact modifications does it allow?
• Show us the performance metrics and validation protocols in the PCCP. How do you prove you’re applying them rigorously every time?
• What’s your strategy for collecting and cleaning the real-world data you’ll need for model updates under the plan?
• How strong is your QMS, especially as it relates to your CI/CD pipelines for deploying AI models? Is it ISO 13485-certified?
• How do you actively monitor for algorithmic drift to make sure performance doesn’t degrade in the wild?
• Who on your team has the clinical background to actually interpret the validation data and sign off on clinical safety?

A company that’s already navigated the 510(k) process with a PCCP included is clearly thinking ahead about AI lifecycle management. And it’s happening more and more, with the FDA database of AI-enabled devices with PCCPs showing about 53 had been cleared by the end of 2024. The real test, though, is the company’s ability to execute that plan flawlessly. A PCCP lets you iterate faster, but it also means your internal clinical governance and technical discipline have to be much, much better.

The New Balance of Speed and Safety

The FDA’s PCCP framework creates a workable process for AI medical devices to evolve and improve in real-world clinical settings, which is the entire point of using machine learning in the first place. This regulatory path lets these tools reach their potential by continuously learning from new data. All of this is detailed in the FDA’s official publications, particularly the April 2023 Draft Guidance on Predetermined Change Control Plans and recent 510(k) summaries found in public databases FDA official PCCP guidance. However, this shift puts a tremendous amount of responsibility on manufacturers to build and maintain clinically validated AI systems that can adapt safely. For investors, this means you need to look past the algorithm and assess the team’s entire AI lifecycle management capability. A team that can iterate quickly under a PCCP has a huge competitive advantage, but that advantage is only real if it’s built on a foundation of rigorous validation, transparent data governance, and constant clinical oversight. The companies that can prove they have that balance right are the ones that will win, delivering both rapid improvements and the patient trust that medicine demands.