The evolution of medical device software presents a growing challenge for regulators and manufacturers: how to enable the continuous update of a device without turning every modification into a new regulatory pathway?

In this context, a notable document is IMDRF/SaMD WG/N90 FINAL:2026 – Essential Principles and Content of Predetermined Change Control Plans (PCCP), published in its final version by the International Medical Device Regulators Forum (IMDRF) on August 6, 2026.

Through this text, the IMDRF outlines the essential principles and elements of a Predetermined Change Control Plan (PCCP) applicable to medical device software, namely software that meets the definition of a medical device. The goal is to provide a common framework for PCCP implementation and foster greater regulatory convergence among authorities. Manufacturers can leverage the identified elements when developing and documenting a PCCP to support regulatory review.

What is a Predetermined Change Control Plan (PCCP)?

A PCCP is a plan through which a manufacturer can describe specific planned software modifications, defining in advance which changes it intends to make, how they will be implemented and controlled, and how their impact will be assessed.

When provided for and accepted by the competent jurisdiction, a PCCP allows for prior authorization of certain modifications that would otherwise require a new regulatory submission before implementation. Modifications covered by an approved PCCP can therefore be implemented without a new submission for each update, provided they remain within authorized boundaries and comply with planned controls.

A PCCP does not constitute an internal change control procedure in itself but must be integrated into the manufacturer’s processes.

What the document outlines

To ensure continued safety and effectiveness, the N90 document bases PCCPs on five essential principles:

• Focused and bounded: modifications must be bounded and always remain within the original intended use.
• Risk-based: the approach must be driven by risk management principles.
• Evidence-based: decisions require clinical and technical evidence gathered consistently throughout the product lifecycle.
• Transparent: clear, appropriate, and timely communication with users is necessary.
• TPLC Perspective: the plan requires continuous monitoring across the entire Total Product Lifecycle, integrating real-world data.

In addition to these principles, the document structures the PCCP into three closely interconnected components:

• Description of Changes: describes the nature and scope of the planned modifications. It specifies whether releases will be homogeneous (global across all devices) or heterogeneous (local adaptations for specific clinical settings), and whether implementation will occur automatically via software or manually.
• Change Plan: establishes how modifications will be developed, verified, validated, and implemented, including pre-defined acceptance and performance criteria. It also defines procedures for labelling updates and documented management in case of test failures.
• Impact Assessment: evaluates the impact on safety, clinical performance, risk management, and any cumulative effects or interactions among multiple modifications, including the periodic reassessment of critical aspects such as cybersecurity and interoperability.

Bounded modifications and intended use

Modifications included in a PCCP must strictly remain within the original intended use or intended purpose. Modifications to features or performance (for example, algorithmic updates using new datasets on existing subpopulations) can be planned, provided they are bounded and supported by the anticipated evidence.

Modifications that introduce a new intended use or fall outside the scope of the PCCP are not covered by the plan and may require a new regulatory pathway, depending on the applicable jurisdiction.

PCCPs and the quality management system

A PCCP must be integrated into the manufacturer’s existing processes, including the Quality Management System (QMS), risk management, change control, verification, validation, cybersecurity, and post-market surveillance (PMS). The objective is to ensure consistency and traceability between planned modifications and related evaluation, verification, validation, and monitoring processes.

Toward regulatory convergence

The IMDRF text is not a regulation, does not establish mandatory requirements, and does not replace local legislation. It serves as a reference framework to promote convergence among competent authorities, who will decide whether and how to apply or integrate these principles into their respective regulatory frameworks.

In the meantime, for manufacturers managing software subject to frequent modifications – particularly AI/ML systems – adopting an approach consistent with the N90 principles represents a solid strategy to structure processes and documentation from the outset, while also preparing to leverage a PCCP once incorporated into their reference regulatory framework.

Furthermore, in Europe, a PCCP is not currently a requirement under the MDR and IVDR Regulations. However, the revision proposal for both regulations presented by the European Commission in December 2025 introduces the possibility of agreeing on a PCCP between the manufacturer and the notified body within the scope of change management, aiming to make this process more proportionate and efficient.

>>> Complife supports manufacturers of Software as a Medical Device (SaMD) in managing the regulatory evolution of their products, offering strategic-regulatory consulting services designed to support innovation and streamline access to international markets.

SOURCE:

https://www.imdrf.org/documents/essential-principles-and-content-predetermined-change-control-plans