Experts: PCCPs can advance AI in combination products, be aware of state laws

PROVIDENCE, RI – A US Food and Drug Administration (FDA) official said that predetermined change control plans (PCCPs), while not required, can reduce the need to submit supplemental applications for medical devices and device-led combination products that incorporate artificial intelligence (AI).

Kathryn Drzewiecki, digital health policy team lead at the Center for Devices and Radiological Health (CDRH), updated attendees of the AFDO/RAPS Healthcare Products Collaborative Combination Products Summit on several recent guidances, including FDA’s guidances on PCCPs for medical devices and PCCPs for AI-enabled software functions, as well as its draft guidance on lifecycle management and marketing submissions for AI-enabled device software functions.

"We're very excited about PCCPS, in particular for AI due to AI technology's ability to learn from real-world use and iterate and improve safety and performance over time," said Drzewiecki. "We have talked about the use of PCCPs in a discussion paper, but in 2022 the Food and Drug Omnibus Reform Act (FDORA) added section 515(C) to the Federal Food, Drug and Cosmetic Act (FDCA), so that changes to a device constituent with a cleared or approved PCCP do not require a supplemental application."

"This provision actually applies to all devices, so even though we're talking about it today in the context of maybe software or AI-enabled devices. Generally, it's applicable to devices, and it's applicable to pre-market approvals and 510(k) applications," she added.

Drzewiecki noted FDA has issued two PCCP guidances; a draft guidance that generally addresses PCCPs in medical devices and a final guidance on marketing submission recommendations for PCCPs for AI-enabled device software functions. She noted that while some of the guidances are only in draft form, the PCCP requirements are already in effect and self-executing, which means manufacturers can already submit their PCCPs for FDA approval and clearance.

Elaborating on the final guidance on PCCPs for AI-enabled device software function (DSF) guidance, Drzewiecki said that while PCCPs are not a requirement, sponsors can find them to be a helpful way to improve their products to avoid repeatedly submitting supplemental applications.

"We've seen many types of modifications as part of PCCPs, and it's definitely a way to advance the use of AI in your device," said Drzewiecki. "The recommendations of this guidance apply to the device constituent part of device-lead combination products when the device constituent part includes an AI DSF.

"To be clear, the modifications in a PCCP can be to the device constituent part, they are not to the drug or biologic parts," she added. "If a modification to the aid of staff were to impact the drug or biologic constituent part, we highly encourage early engagement with FDA on your PCCP as part of, for example, a pre-submission meeting."

If a sponsor decides to submit a PCCP, Drzewiecki says FDA recommends they should include three components. First, they want to see a description of the modifications that is very specific. Second, they want to see a modification protocol that details the methods they intend to follow to develop, validate and implement the modifications to ensure the products remains safe and effective.

"It can be very helpful when you include your modification protocol to tie certain activities in your modification protocol to a particular modification in your description of modifications," said Drzewiecki. "For example, through the use of a traceability table to help kind of map sections like that."

Lastly, Drzewiecki said they want to see an impact assessment so regulators can assess the benefits and risks of each PCCP modification. If there are multiple modifications, they also want to see the collective impact of the modifications on the device.

State-level AI legislation

While much of the attention regarding AI regulation in the medical products realm has been focused on federal laws and guidances, there are also efforts at the state level that industry should be aware of, according to Christina Kuhn, a special counsel at Covington & Burling. She noted that several emerging state laws apply to AI products, including a law in Utah that requires mental health chatbots to disclose use of AI technology, a Texas law that requires healthcare providers to disclose if they’re using AI, and a Nevada law that prohibits AI systems from representing themselves as licensed providers.

"If we're talking about AI being deployed in healthcare, whether that's a medical device or some other digital tool, which we see a lot of these days... I haven't personally yet seen an actual combination product with an AI constituent,” said Kuhn. “What I've seen more of is AI products as part of the ecosystem that might wrap around a drug product or a combination product.

“It's the digital diagnostics being used to determine eligibility for the drug or the combination product, it’s part of the monitoring we're doing, it's decision-making about what treatment might be more appropriate, the personalized medicine,” she added. “And then we're just seeing AI being used by healthcare providers to summarize documents to generate all their communications they have to have back and forth with patients and there are state laws now for all of this, it's an emerging patchwork.”

Kuhn also noted that several state laws don’t explicitly target AI but can nonetheless apply to AI products, such as state consumer protection and unfair competition laws, laws on medical licensing and limits on the corporate practice of medicine, anti-discrimination laws, and patient privacy laws.

"Most of the state laws that are health-specific are focused on the healthcare provider- or patient-side products, like mental health chat box is a hot topic right now, or there are a lot of laws about disclosure,” said Kuhn. “If you're a provider and you're using AI to generate your patient communications, you have to disclose that those communications are AI-generated.

"We're also noticing states putting up flags that they intend to use their existing health care laws to regulate AI used in health, particularly where it may not be a regulated medical device, under things like the medical practicing laws,” she added. “So, AI can't practice medicine, it shouldn't be providing medical advice, anti-discrimination laws, consumer protection laws, and the like.”

Kuhn noted that there are state laws that go beyond health and more generally address sector-agnostic issues, such as AI in unregulated digital health products and AI used for overall development and commercialization strategies. In particular, she pointed to the Colorado AI act, SB24-205, and the Texas Responsible Artificial Intelligence Governance Act.

The Colorado law was initially scheduled to take effect on February 1, 2026, but has been delayed until 30 June 2026, to allow lawmakers to finalize negotiations over the law’s framework. Kuhn noted that the legislation employs similar high-risk concepts found in the EU AI Act, such as in situations where AI is used to make or support health decisions.

Kuhn noted, however, that there are exemptions for cleared medical devices and research; however, the scope of these exemptions is still being worked on.

“These are relatively new laws, but the Colorado AI act is constantly in threat of being undone,” she added.

On the federal level, Kuhn noted that there is no overarching law governing AI. However, President Donald Trump issued an executive order earlier this year on AI, along with an action plan that may need to be taken into consideration, especially if a company is working with federal authorities.

“Trump has made AI dominance a part of his policy, and that's driving some of the FDA use of AI, but also efforts to make sure that FDA is facilitating industry’s use of AI,” said Kuhn.

Experts: PCCPs can advance AI in combination products, be aware of state laws

Related topics

Recommended content

Welcome to the new RAPS Digital Experience