AI in medical devices · Medium · 13 min lesson

FDA lifecycle guidance for AI software: performance monitoring and change control

FDA draft guidance on AI-enabled device software functions (January 2025), final PCCP guidance (December 2024), ISO 13485 clauses 7.3.9, 8.2 and 8.5, QMSR

What you will learn

Explain how the FDA draft guidance expects performance monitoring and data drift to be planned and recorded across the product life cycle.
Run a model change through design change control and decide whether it is inside an authorized PCCP, needs a submission assessment, or needs a new submission.
Read monitoring and change records against ISO 13485 clauses and spot gaps in drift response, versioning and release approval.

Key takeaways

The draft guidance asks sponsors to plan for performance change and data drift, with a monitoring plan held in the risk management file.
A monitoring plan names data sources, metrics including subgroups, thresholds, responsibilities and the actions taken when a threshold is crossed.
Signals from monitoring feed feedback, complaints, data analysis and corrective action under ISO 13485 clauses 8.2.1, 8.2.2, 8.4 and 8.5.2.
Every model change is a design change under clause 7.3.9: reviewed, verified, validated where appropriate, approved and traceable to a model version.
A change is either inside an authorized PCCP, assessed under FDA change guidance, or needs a new submission; the decision and its reasons are recorded.

Free practice question

Northgate's monthly report shows camera C2 sensitivity at 0.87 against an action level of 0.90. The analyst notes it in the meeting minutes and moves on, because pooled accuracy is still above target.

What should have happened under the quality system?

A record opened and linked to complaint review, investigation, containment and corrective action as needed.

Correct. A crossed action level is feedback under clause 8.2.1 and a trend under clause 8.4 that must start the corrective action process in clause 8.5.2.

Nothing, because pooled accuracy is above target.

Not quite. Pooled results can hide a failing subgroup, and the monitoring plan in the draft guidance expects subgroup detection. This follows ISO 13485:2016 and the FDA draft guidance.

Wait for the next quarterly review before acting.

Not quite. Delay contradicts the plan to detect performance change in use and leaves patients exposed, which clause 8.5.2 aims to prevent.

Change the action level to 0.85.

Not quite. Moving a threshold after a breach hides the signal and breaks the control intended by the monitoring plan in the draft guidance. This follows ISO 13485:2016 and the FDA draft guidance.

Key terms

data drift: A change over time in the input data or in model performance, which the FDA draft guidance asks sponsors to anticipate and address.
performance monitoring plan: A documented plan, kept in the risk management file, for detecting performance change in use and acting on it.
design change: A change to design outputs that is identified, reviewed, verified, validated as appropriate and approved before implementation (ISO 13485 clause 7.3.9).
action level: A predefined value of a monitored metric at which an investigation or corrective step must begin.
QMSR: FDA's amended 21 CFR Part 820, effective 2 February 2026, which incorporates ISO 13485:2016 by reference.
model version register: A controlled record linking each released model to its code, data snapshot, build identifier, validation report and approval.

Official sources

Go further

The full lesson has narrated slides, more scenario questions with explained answers and a simulation.

Open the Academy Watch on YouTube

Illustrative example. Educational only, not legal advice.