The Clearance Isn't the Risk. The Change Control Plan Is.

The market for high-risk AI software as a medical device is not growing because approvals got faster. It is growing because the FDA built a mechanism that lets manufacturers change their algorithms after clearance without going back through the front door. That mechanism, the predetermined change control plan, is now the single most consequential clause in any high-risk AI device submission, and most buyers are not reading it closely enough.

IMDRF Category III and IV software, the classes covering devices where an incorrect output can cause serious injury or death, is forecast to grow at a 14.6% CAGR in the US, and Fact.MR attributes that growth directly to the FDA’s established pathway and its guidance on lifecycle management, cybersecurity, and predetermined change control plans. The PCCP framework, formalized in the FDA’s April 2023 draft guidance, lets a manufacturer pre-specify how its algorithm may be modified, retrained, or expanded in scope, and get that plan authorized once, rather than resubmitting every time the model changes.

That is efficient for manufacturers. It is a diligence gap for buyers. A hospital system, health plan, or device integrator evaluating a Category III or IV AI tool is not really assessing a static product. It is assessing a static product plus a standing license to change that product later, on terms the buyer usually never sees in full.

The contrast between device types sharpens the point. Cadence’s HypertensionOS, now in the FDA’s TEMPO program, is deliberately narrow: it operates within predefined eligibility criteria and safety checks for clinician-supervised hypertension titration, a bounded scope by design (MPO). Compare that to the FDA’s recent authorizations of generative AI devices, where the agency has shown explicit flexibility on the pathway itself, signaling that the rules for adaptive, generative systems will not look like the rules for rule-based, locked-scope tools (Mintz, via JD Supra). Two devices, both AI, both cleared, carrying very different change surfaces.

For a compliance or technology leader, the operational consequence is direct. Vendor due diligence for high-risk AI SaMD cannot stop at confirming a clearance number. It has to extend into the PCCP itself: what retraining triggers exist, what performance monitoring is required, what data can shift the model’s behavior without a new submission, and what obligation the manufacturer has to notify the buyer when a change occurs. An ISO 42001 aligned AI management system should treat the PCCP as a live input to the organization’s own risk register, not a one-time regulatory fact checked off at procurement.

The device is not the risk anymore. The plan for changing the device is.

---

Board record

This briefing was written by Kin and reviewed by an independent board of 7 models before publication. Ruling: CLEARED.

Seat	Reviewer	Finding
Chair · Editorial Judgment	Claude	cleared. The core argument—that PCCPs create a diligence gap buyers overlook—is coherent and worth saying, but the piece asserts this gap exists without evidence that buyers actually miss it, and the Cadence/g
Source & Claim Verification	Qwen · local	cleared. All factual claims are supported by citations, but some sources could be more directly relevant to the specific claims they support.
Regulatory & Framework Fidelity	Mistral	cleared. The briefing accurately reflects FDA’s predetermined change control plan (PCCP) framework but does not substantively address ISO 42001, EU AI Act, or MDR/IVDR requirements beyond superficial mentions.
Technical Accuracy	Llama	cleared. The article accurately conveys the significance of the FDA’s predetermined change control plan (PCCP) for high-risk AI medical devices, but contains minor technical inaccuracies and irrelevant sources
Bias, Balance & Hype Control	Gemini	cleared. The briefing effectively identifies and scrutinizes the potential for vendor hype and the need for counterarguments regarding the ‘static product’ illusion created by PCCPs.
Novelty & Non-Duplication	Grok	held. Core thesis that PCCPs—not initial clearance—are the real risk surface for high-risk AI SaMD has been standard regulatory commentary since the 2023 FDA draft guidance and is not new versus the wire or
Validation	DeepSeek	cleared. The central claim that market growth is driven by the PCCP mechanism, not faster approvals, is strongly supported by the cited market report attributing growth to the FDA’s pathway and lifecycle manag

Sources cited: 14. Validation challenges: 0. Review cost: about $0.04. Learn how these briefings are written and verified.