Published: 22th June 2026
Reviewed By: David Small BSc (Hons), MSc, MTOPRA (Founder and CEO)
PCCPs Are Transforming How Software Medical Devices Are Regulated
Medical device software is evolving faster than traditional regulatory systems were designed to handle. For years, Software as a Medical Device (SaMD) manufacturers have faced a major challenge: even small software updates could trigger costly regulatory reviews, certification delays, and additional Notified Body scrutiny.
Now, both the UK MHRA’s 2026 draft regulations and the EU’s latest AI and software guidance are signalling a major shift toward a new compliance model built around Predetermined Change Control Plans (PCCPs).
PCCPs are rapidly becoming the gold standard for agile software compliance.
For manufacturers of:
- AI medical devices
- SaMD platforms
- Connected healthcare applications
- Machine learning systems
- Cloud-based diagnostics
- Digital health technologies
PCCPs could fundamentally change how software updates are managed under MDR, IVDR, and future UKCA frameworks.
Most importantly, they allow certain planned software modifications to be implemented without requiring a full re-certification process each time an update is released.
This represents one of the biggest regulatory shifts in modern medical device software compliance.
The Development Foundation
Remember: a successful agile modification plan relies on a rock-solid software lifecycle. Read our comprehensive guide on IEC 62304 Explained: Medical Device Software Development to ensure your configuration management and software verification support continuous agile updates.
What Is a Predetermined Change Control Plan (PCCP)?
A Predetermined Change Control Plan (PCCP) is a documented regulatory framework that allows manufacturers to define anticipated software changes in advance during the initial conformity assessment submission.
Instead of submitting every future software modification individually for regulatory approval, manufacturers can pre-specify:
- The types of changes expected
- The limits of those changes
- Validation procedures
- Risk controls
- Performance monitoring methods
- Verification activities
If updates remain within the approved PCCP boundaries, manufacturers may be able to deploy them without undergoing a full new conformity assessment.
Why PCCPs Matter for Medical Device Software
Traditional medical device regulation was designed primarily around hardware products with relatively stable designs.
Modern software development works very differently.
Today’s healthcare software often requires:
- Continuous updates
- Cybersecurity patching
- AI model refinements
- Bug fixes
- Cloud infrastructure changes
- Performance optimisation
- Interoperability improvements
Without PCCPs, even low-risk software modifications can create:
- Regulatory bottlenecks
- Delayed product improvements
- Increased compliance costs
- Slower innovation
- Reduced patient access to improvements
PCCPs aim to solve this problem.
The Shift Toward “Agile Compliance”
What Is Agile Compliance?
Agile Compliance is the concept of aligning regulatory systems with modern agile software development methodologies.
Instead of treating software as static, regulators are increasingly recognising that:
- Software evolves continuously
- AI models require monitoring
- Cybersecurity threats constantly change
- Digital health products need rapid iteration
PCCPs allow regulators and manufacturers to manage this reality through controlled, pre-approved change frameworks.
This creates a more flexible and sustainable approach to medical device software regulation.
How PCCPs Allow Software Updates Without Full Re-Certification
The Traditional Problem
Historically, manufacturers often needed regulatory review for:
- Algorithm adjustments
- UI changes
- Feature expansions
- Software patches
- Interoperability modifications
- Performance tuning
This created enormous administrative burden.
Even relatively minor changes could require:
- Additional technical documentation reviews
- New submissions
- Notified Body involvement
- Delayed deployment
How PCCPs Change the Process
With a PCCP in place, manufacturers can pre-define:
- Which modifications are anticipated
- Acceptable risk boundaries
- Validation protocols
- Performance testing requirements
- Cybersecurity controls
- Post-market monitoring activities
As long as updates remain within the approved scope, implementation may proceed under the existing certification framework.
This dramatically improves software lifecycle efficiency.
How the No Duplication Rule Works
If your MDR or IVDR conformity assessment already covers areas such as:
- Risk management
- Cybersecurity
- Clinical performance
- Human oversight
- PMS
- Data governance
- Software lifecycle controls
- Usability engineering
then portions of the AI Act requirements may be considered satisfied through the existing process.
This could significantly reduce:
- Administrative burden
- Audit duplication
- Certification delays
- Regulatory costs
What Can Be Included in a PCCP?
A well-structured PCCP may cover:
- Software maintenance updates
- Cybersecurity patches
- Minor algorithm refinements
- User interface improvements
- Cloud infrastructure changes
- Performance optimisation
- Data management enhancements
- Compatibility updates
However, significant intended purpose changes or major risk profile changes may still require formal regulatory reassessment.
PCCPs and AI Medical Devices
Why AI Systems Especially Benefit from PCCPs
Artificial Intelligence systems require ongoing refinement throughout their lifecycle.
Machine learning models may need:
- Retraining
- Dataset updates
- Bias correction
- Performance tuning
- Real-world optimisation
Without a PCCP framework, every modification could potentially trigger regulatory disruption.
This is one reason regulators across:
- the EU
- the UK
- the FDA
- IMDRF member jurisdictions
are increasingly supporting PCCP-based approaches.
PCCPs Under the UK MHRA 2026 Draft Regulations
The UK MHRA’s draft Medical Devices (Amendment) Regulations 2026 formally introduce PCCPs into the future UK medical device framework.
The MHRA recognises that:
- AI systems evolve rapidly
- Software updates are continuous
- Cybersecurity requires frequent intervention
- Traditional certification models are too rigid for digital health
Under the draft proposals, PCCPs are expected to become central to future UKCA software regulation.
PCCPs and the EU MDR / IVDR Landscape
Although PCCPs are not yet fully codified within MDR or IVDR legislation, recent EU guidance strongly supports their use.
This is particularly relevant for:
- AI medical devices
- Software under MDR Rule 11
- Connected IVD software
- Cloud-based healthcare systems
The EU AI Act discussions have further accelerated regulatory support for lifecycle-based software governance models.
What Regulators Expect to See in a PCCP
1. Clear Scope of Planned Modifications
Manufacturers must define:
- Which changes are anticipated
- Why those changes may occur
- The boundaries of acceptable modifications
Vague or overly broad PCCPs are unlikely to be accepted.
2. Risk Management Integration
PCCPs must integrate directly into ISO 14971 risk management systems.
Manufacturers should demonstrate:
- Hazard identification
- Risk control measures
- Residual risk analysis
- Benefit-risk evaluation
- Post-update monitoring
3. Verification and Validation Procedures
Regulators expect documented methods for:
- Software verification
- Validation testing
- Cybersecurity testing
- Regression testing
- Clinical performance confirmation
Manufacturers must show that updates will remain safe and effective.
4. Post-Market Surveillance Controls
PCCPs require strong PMS systems capable of monitoring:
- Real-world performance
- Software anomalies
- Adverse events
- Algorithm drift
- Cybersecurity incidents
- User complaints
Continuous monitoring is central to agile compliance.
The Major Benefits of PCCPs for Manufacturers
Reduced Administrative Burden
One of the biggest advantages of PCCPs is the reduction in repetitive regulatory submissions.
Manufacturers may avoid:
- Frequent amendment applications
- Duplicate technical reviews
- Unnecessary audit activity
- Repeated documentation cycles
This can significantly reduce regulatory costs.
Faster Delivery of Updates to Patients
Healthcare software often requires rapid improvement cycles.
PCCPs allow manufacturers to:
- Deploy cybersecurity patches faster
- Improve algorithms more efficiently
- Respond to clinical feedback quickly
- Deliver usability improvements sooner
Ultimately, patients and healthcare providers gain faster access to safer and more effective technologies.
Improved Cybersecurity Responsiveness
Cybersecurity threats evolve constantly.
PCCPs support faster implementation of:
- Security patches
- Vulnerability remediation
- Network protection updates
- Authentication improvements
- Encryption enhancements
This is becoming increasingly important as regulators place greater focus on connected device security.
Greater Alignment With Modern Software Development
PCCPs align regulatory compliance with:
- Agile development methodologies
- DevOps environments
- Continuous integration/continuous deployment (CI/CD)
- AI lifecycle management
- Modern software engineering practices
This creates a more realistic regulatory model for digital healthcare innovation.
Common PCCP Challenges Manufacturers Should Avoid
- Overly Broad Change Definitions
- PCCPs must remain specific and controlled.
- Trying to include unlimited future changes may raise concerns with regulators and Notified Bodies.
Weak Risk Management Linkage
PCCPs that are not properly integrated into:
- ISO 14971 files
- Clinical evaluation
- PMS systems
- Cybersecurity frameworks
may face significant scrutiny.
Poor Documentation Structure
Manufacturers should ensure:
- Clear traceability
- Version control
- Defined approval processes
- Cross-referenced validation evidence
- Structured technical documentation
Poorly organised PCCPs can delay approvals.
Key Actions Manufacturers Should Take Now
1. Assess Whether Your Software Would Benefit From a PCCP
PCCPs are especially valuable for:
- Frequently updated software
- AI systems
- Connected medical devices
- Cloud-based platforms
- Cybersecurity-sensitive products
2. Review Existing Change Management Procedures
Many organisations will need to strengthen:
- Software lifecycle procedures
- Configuration management
- Validation workflows
- Documentation systems
3. Strengthen PMS and Cybersecurity Monitoring
Agile compliance depends heavily on ongoing lifecycle monitoring.
Manufacturers should enhance:
- Signal detection
- Complaint trending
- Cybersecurity vigilance
- Real-world performance analysis
4. Align Regulatory and Development Teams
Successful PCCPs require collaboration between:
- Regulatory Affairs
- Software Engineering
- Quality Assurance
- Cybersecurity teams
- Clinical specialists
Cross-functional governance is essential.
Frequently Asked Questions About PCCPs
Do PCCPs eliminate all future regulatory reviews?
No. Significant changes affecting intended purpose, risk profile, or clinical performance may still require formal reassessment.
Are PCCPs only for AI devices?
No. PCCPs can apply to many types of medical device software, including traditional SaMD platforms and connected healthcare systems.
Will PCCPs become mandatory?
Current regulatory trends strongly suggest PCCPs will become increasingly expected for modern software and AI medical devices.
However, transparency obligations begin earlier in August 2026.
Do PCCPs apply under both MDR and UKCA frameworks?
Yes. Both EU and UK regulators are actively moving toward PCCP-style agile compliance approaches.
Final Thoughts: PCCPs Are Reshaping the Future of Software Regulation
Predetermined Change Control Plans represent one of the most important regulatory innovations for digital health technologies.
For the first time, regulators are formally acknowledging that medical device software is not static — it is dynamic, adaptive, and continuously evolving.
Manufacturers that successfully implement PCCPs will benefit from:
- Faster update deployment
- Reduced administrative burden
- Improved cybersecurity responsiveness
- Stronger lifecycle management
- Better alignment with agile software development
The future of medical device compliance is shifting from rigid certification models toward continuous lifecycle governance.
PCCPs are at the centre of that transformation.
Need Help Building a PCCP Strategy?
At Patient Guard Ltd, we support medical device software and AI manufacturers with:
- PCCP strategy development
- SaMD regulatory compliance
- MDR Rule 11 classification
- UKCA software compliance
- AI governance integration
- Cybersecurity frameworks
- PMS system development
- Technical documentation remediation
- ISO 13485 software lifecycle integration
Whether you are developing AI-powered diagnostics, connected medical software, or cloud-based healthcare platforms, our team can help you prepare for the next generation of agile regulatory compliance.
Contact Patient Guard Ltd Today to Discuss Your PCCP and Software Compliance Strategy
References
This guide is based on the following international standards, legislation and official regulatory guidance relating to Predetermined Change Control Plans (PCCPs), Software as a Medical Device (SaMD), artificial intelligence and agile software compliance.
| Organisation | Reference | Why it's relevant |
|---|---|---|
| Medicines and Healthcare products Regulatory Agency (MHRA) | Predetermined Change Control Plans for Machine Learning-Enabled Medical Devices: Guiding Principles | Provides the UK regulatory principles for developing and implementing PCCPs for AI and machine learning-enabled medical devices. |
| U.S. Food and Drug Administration (FDA) | Predetermined Change Control Plans for Medical Devices (Draft Guidance) | Explains the FDA's proposed regulatory framework for PCCPs, including the information expected within a marketing submission and how future software modifications may be managed without additional submissions. |
| International Electrotechnical Commission (IEC) | IEC 62304 – Medical Device Software – Software Life Cycle Processes | Defines the internationally recognised software lifecycle processes that underpin software change management, verification and maintenance activities described within a PCCP. |
| International Organization for Standardization (ISO) | ISO 14971:2019 – Medical Devices – Application of Risk Management to Medical Devices | Provides the internationally recognised framework for integrating risk management into planned software modifications and lifecycle change control. |
| U.S. Food and Drug Administration (FDA) | Software as a Medical Device (SaMD) | Explains the FDA's regulatory approach to standalone medical device software and the lifecycle management of software-based medical technologies. |
| European Union | Regulation (EU) 2017/745 on Medical Devices (MDR) | Provides the legal framework governing software medical devices within the European Union, including conformity assessment and lifecycle compliance obligations. |
Software regulation, artificial intelligence, cybersecurity and lifecycle management continue to evolve rapidly. Manufacturers should always consult the latest published legislation, recognised standards and official regulatory guidance when developing and maintaining Predetermined Change Control Plans for medical device software.
Patient Guards Recent Posts
Cosmetic Product Safety Report (CPSR): A Complete Guide to UK Cosmetic Compliance
Before a cosmetic product can legally be placed on the UK market, manufacturers and Responsible Persons must demonstrate that it is safe for human use under normal or reasonably foreseeable conditions. The Cosmetic Product Safety Report (CPSR) is one of the most important regulatory documents required under the UK Cosmetics Regulation. This guide explains what a CPSR is, who can prepare one, what information it must contain, how it relates to the Product Information File (PIF) and how it supports legal cosmetic compliance.
IVDR PMPF Explained: A Complete Guide to Post-Market Performance Follow-up
Post-Market Performance Follow-up (PMPF) is a fundamental requirement under the EU In Vitro Diagnostic Regulation (IVDR), ensuring that manufacturers continually monitor the scientific validity, analytical performance and clinical performance of their in vitro diagnostic medical devices after CE marking. This guide explains IVDR PMPF requirements, PMPF Plans, PMPF Reports, Annex XIII expectations and how ongoing performance monitoring supports continued regulatory compliance throughout the device lifecycle.
IVDR Scientific Validity Explained: A Complete Guide for Manufacturers
Scientific Validity is the first pillar of IVDR Performance Evaluation and provides the scientific foundation demonstrating that an analyte or biomarker is associated with a specific clinical condition or physiological state. This guide explains Scientific Validity under Regulation (EU) 2017/746, including literature reviews, Scientific Validity Reports, Annex XIII requirements, evidence appraisal and how Scientific Validity supports successful CE marking.
Need Training?
Do you need training on Quality Management Systems or EU MDR/ EU IVDR? then check out our training courses.
