When the Regulator's Capacity Becomes Your Risk

When the regulator’s capacity becomes your risk

Predetermined Change Control Plans were supposed to solve a real problem. AI-enabled devices change. Models get retrained, thresholds get tuned, performance drifts and gets corrected. FDA’s PCCP mechanism lets manufacturers pre-specify how those changes will happen and skip a fresh submission every time, folding the change management into the original authorization rather than treating each update as a new device. Quality engineering guidance now treats PCCP as one piece of a broader lifecycle stack, sitting alongside ISO 13485 design controls, ISO 14971 risk management, and ISO 20417 lifecycle documentation. That is a sensible architecture on paper.

It assumes the agency on the other side of that plan has the staff and funding to actually exercise oversight of it. That assumption is getting shakier. FDA’s draft MDUFA VI commitment letter, which sets the user fee structure funding the device review program for the next cycle, has been under negotiation since October 2025, precisely the period in which AI-enabled submissions have been rising fastest. At the same time, Holland & Knight reports that FDA’s Office of Applied Science within the Center for Veterinary Medicine is being eliminated, and that it remains unclear how broader inspection staffing changes will interact with user fees that fund inspections but not post-market surveillance activities.

Put those two signals together and the picture for AI device sponsors changes. A PCCP is not a one-time approval. It is a standing commitment that the agency will monitor conformance to the plan over the device’s life, which depends on inspection capacity and post-market surveillance funding that MDUFA fees are supposed to sustain. If those functions are under strain while AI-driven change volume increases, the practical result is a widening gap between what a PCCP authorizes on paper and what FDA can verify in practice.

For compliance and quality leaders, the decision this creates is not whether to pursue a PCCP. It is what to do about the assurance gap a PCCP no longer fully closes. Treating agency authorization as the finish line was always a stretch. It is now a specific operational risk. The lifecycle documentation under ISO 13485 and ISO 14971, and the traceability under ISO 20417, cannot simply back the FDA’s oversight anymore. In a resource-constrained review environment, they have to substitute for oversight that may not arrive on schedule, or at all, for a given device generation.

This is not a call to distrust the PCCP pathway. It remains the right mechanism for managing continuous AI change without resubmission gridlock. It is a call to stop pricing PCCP approval as risk transfer. The agency’s capacity to police the plan is now a variable sponsors have to model themselves, not a constant they can assume. Build the internal verification rigor as if the inspection might not come. If it does come, you are simply ahead of schedule.

---

Board record

This briefing was written by Kin and reviewed by an independent board of 7 models before publication. Ruling: CLEARED.

Seat	Reviewer	Finding
Chair · Editorial Judgment	Claude	cleared. The core argument—that PCCP authorization creates a standing oversight commitment whose value depends on agency capacity that is now uncertain—is logically coherent, but the causal chain from MDUFA VI
Source & Claim Verification	Qwen · local	cleared. All factual claims are supported by citations, but the article could benefit from more specific references to the cited sources for clarity.
Regulatory & Framework Fidelity	Mistral	cleared. The briefing accurately reflects FDA PCCP mechanisms and resource constraints but does not explicitly address ISO 42001, EU AI Act, or MDR/IVDR requirements.
Technical Accuracy	Llama	cleared. The article accurately describes the Predetermined Change Control Plans (PCCP) mechanism and its relation to ISO standards, but could be improved with more specific technical details on AI-enabled dev
Bias, Balance & Hype Control	Gemini	cleared. The briefing effectively identifies and counters potential vendor hype by focusing on the practical limitations of regulatory oversight rather than simply endorsing a regulatory mechanism.
Novelty & Non-Duplication	Grok	cleared. The core thesis—that strained FDA inspection/post-market capacity under MDUFA VI turns PCCP from risk-transfer into an assurance gap sponsors must self-fill—is a fresh synthesis not duplicated in the
Validation	DeepSeek	cleared. The briefing’s central claim about FDA capacity strain is supported by cited, verifiable evidence of ongoing MDUFA VI negotiations and internal staffing changes.

Sources cited: 15. Validation challenges: 0. Review cost: about $0.04. Learn how these briefings are written and verified.