ISO 13485 · Expert · 15 min lesson
AI in medical devices II: FDA PCCP, GMLP, data governance, validation and human oversight
FD&C Act section 515C, FDA PCCP final guidance (December 2024), GMLP guiding principles, ISO 13485:2016 clauses 7.3.7, 7.3.9, 8.2.1 and 8.4
What you will learn
- Audit a predetermined change control plan against FDA guidance.
- Audit good machine learning practice evidence.
- Audit data lineage, bias testing, drift monitoring and human oversight.
Key takeaways
- A PCCP has three parts: description of modifications, modification protocol, impact assessment; only described changes are covered.
- Follow one real release through the plan, data, validation, risk file, labelling and approval.
- GMLP asks for representative data, independent test sets, human-AI team testing, clear user information and monitoring.
- Lineage, subgroup results and executed drift reviews separate evidence from assertion.
- Cite quality system requirements and the company's own authorised plan; use guidance to judge adequacy.
Free practice question
Brindle's plan allows retraining on additional ECG records of the same types. Release 2.2 used the same types of record and the team ran the agreed evaluation.
What does the auditor look for first?
A documented link between the release and the matching described modification in the plan.
Correct. The PCCP guidance expects each change to match a described modification, which is why the link is checked first.
The marketing brochure for the new version.
Not quite. Marketing material does not show that a change is covered by the authorised PCCP under section 515C of the FD&C Act.
The number of lines of code changed.
Not quite. Code volume does not decide whether a change is within the PCCP; the described modification does.
Whether the data science team used a popular framework.
Not quite. Tool choice is irrelevant to PCCP scope, which depends on described modifications and the protocol.
Key terms
- predetermined change control plan (PCCP): A plan, authorised with a marketing submission under section 515C of the FD&C Act, that describes planned device changes and how they will be made safely.
- modification protocol: The PCCP part describing data management, re-training, performance evaluation and update procedures for each planned change.
- good machine learning practice (GMLP): Ten guiding principles for AI-enabled device development published by FDA, Health Canada and MHRA in 2021 and finalised by the IMDRF in January 2025.
- data lineage: The traceable history of the data used for a model version, including sources, transformations, labels and the held-back test set.
- drift: A change over time in the input data or the performance of a deployed model compared with what was validated.
- human-AI team: The GMLP focus on how clinicians perform when using the AI output, not only on the model alone.
Official sources
- Federal Register - Marketing Submission Recommendations for a PCCP for AI-Enabled Device Software Functions (4 December 2024)
- FDA - Good Machine Learning Practice for Medical Device Development: Guiding Principles
- IMDRF/AIML WG/N88 Final:2025 Good machine learning practice for medical device development: guiding principles
- FDA - Quality Management System Regulation (QMSR) overview
- ISO 13485:2016 Medical devices - Quality management systems
Go further
The full lesson has narrated slides, more scenario questions with explained answers and a simulation.
Open the AcademyWatch on YouTubeIllustrative example. Educational only, not legal advice.