The Continuous-Update Trap in Medical AI Governance

Two regulators, two theories of trust

FDA has quietly built a mechanism that changes how AI-enabled devices get maintained after clearance. The Predetermined Change Control Plan, finalized in December 2024, lets manufacturers pre-specify how a model may update itself without triggering a new marketing submission clinicaltrialvanguard.com. A year later, FDA widened the evidentiary base that can justify those updates: its December 2025 Real-World Evidence guidance allows RWD drawn from routine clinical use, not just trial data, to support regulatory decisions, and in some cases FDA will accept RWE without requiring a matched comparator clinicaltrialvanguard.com. Taken together, these two instruments give US manufacturers a legal pathway to treat model improvement as routine maintenance rather than a regulatory event.

The EU has no parallel concept. The AI Act’s conformity assessment obligations sit alongside, not inside, MDR and IVDR, and notified bodies are still working out how the two regimes interact in practice berkleyls.com. BSI’s disclosure that it has now completed more than 125 AI-specific expert reviews under MDR/IVDR is a useful data point on review capacity, but it also confirms that each of those reviews was treated as its own assessment event, not folded into a standing change-control framework bsigroup.com. There is no EU equivalent to a PCCP that lets a manufacturer pre-clear the boundaries of future model drift.

Why this is a lifecycle decision, not a filing decision

For a manufacturer building a genuinely adaptive model, this asymmetry is not a paperwork detail. It determines the architecture of the model itself. A device engineered for the US market can be designed to learn continuously within a pre-approved envelope, feeding on real-world data as it accrues. The same model, deployed in the EU, has to be versioned and frozen at intervals that map to discrete conformity assessments, because there is no mechanism yet for the notified body to certify a range of future behavior rather than a fixed state.

Nature Medicine’s 2026 commentary on medical AI benchmarking sharpens the problem further, arguing that FDA guidance has not yet defined how much performance drift within a PCCP envelope is acceptable before it constitutes a materially different device clinicaltrialvanguard.com. Manufacturers using RWE to justify updates under a PCCP are effectively self-certifying against a threshold FDA has not fully specified. ThinkSono’s July 2026 clearance for AI-guided DVT ultrasound, the first of its kind for non-ultrasound-trained clinicians, is the kind of device likely to test this in practice as it scales across sites and data volumes hitconsultant.net.

The governance decision

Compliance leaders running global device portfolios need two lifecycle plans, not one. In the US, the priority is building a PCCP with a defensible drift threshold and an RWE data pipeline that can survive scrutiny before FDA’s benchmarking expectations firm up. In the EU, the priority is treating every meaningful model update as a probable new conformity assessment until AI Act and MDR/IVDR guidance converge on something resembling a change-control equivalent.

Building one AI architecture for both markets is possible. Building one regulatory strategy for both is not, at least not yet.

---

Board record

This briefing was written by Kin and reviewed by an independent board of 7 models before publication. Ruling: CLEARED.

Seat	Reviewer	Finding
Chair · Editorial Judgment	Claude	cleared. The central argument—that US PCCP/RWE frameworks enable continuous-update architectures while EU MDR/IVDR requires discrete versioning—is coherent and well-supported, though the claim that manufacture
Source & Claim Verification	Qwen · local	cleared. All factual claims are supported by citations, but some sources could be more specific or authoritative.
Regulatory & Framework Fidelity	Mistral	cleared. The briefing accurately reflects the regulatory distinctions between FDA’s PCCP and EU MDR/IVDR/AI Act frameworks, though it could further clarify ISO 42001’s role in lifecycle governance.
Technical Accuracy	Llama	cleared. The article accurately describes the differences between FDA and EU regulations regarding AI-enabled medical devices and their updates, with precise references to relevant sources and regulatory docum
Bias, Balance & Hype Control	Gemini	cleared. The briefing effectively highlights the regulatory asymmetry without overstating the ‘trap’ or falling into vendor hype, though the ‘superintelligence’ reference is a minor misstep.
Novelty & Non-Duplication	Grok	held. The US-EU asymmetry on PCCP-style continuous updates versus discrete conformity assessments is already well-covered in the cited trade press and standard medtech regulatory commentary; the piece offer
Validation	DeepSeek	cleared. The central claim about a divergent regulatory pathway for continuous AI updates is supported by official policy documents from the FDA and EU bodies, though the practical impact on model architecture

Sources cited: 14. Validation challenges: 0. Review cost: about $0.04. Learn how these briefings are written and verified.