The FDA's 2026 AI framework isn't a future concern — the PCCP guidance is already in effect for new submissions. Here's what that actually means for mid-market device manufacturers trying to ship AI-enabled products.
Let's be direct about where things stand.
The FDA's August 2025 final guidance on Predetermined Change Control Plans (PCCPs) is already in effect. If you're submitting a new marketing application for an AI-enabled device today, this isn't coming — it's here. The January 2025 draft guidance on AI-enabled device lifecycle management is still in draft, but regulatory drafts don't stay drafts forever, and the direction it signals is unmistakable.
And yet most mid-market medical device manufacturers are still treating AI governance like it's a future problem.
It isn't.
Strip away the regulatory language and the FDA is asking for three things that most AI workflows aren't built to deliver.
First: Transparency before deployment. Your premarket submission now needs to include a PCCP — a detailed plan specifying which algorithm modifications you anticipate, how you'll validate them, and what performance boundaries define acceptable drift. You can't bolt this on after the fact. It has to be baked into how you design and document your AI system from day one.
Second: Honest labeling. Training data demographics, intended use conditions, known algorithmic limitations — these must appear in device labeling. That's a meaningful shift. It means the gaps in your training data aren't just a technical footnote; they're a disclosure obligation.
Third: Post-market monitoring with teeth. Real-world performance monitoring isn't optional anymore. The FDA explicitly expects manufacturers to track model drift in production. Not just log it — monitor it, act on it, and be able to demonstrate that you did.
Layer in the QMSR, which came into force February 2, 2026, and aligns U.S. quality system requirements with ISO 13485:2016, and you have a compliance environment that demands your AI and your quality management system actually talk to each other.
Most mid-market device manufacturers don't lack the technical capability to build AI systems that meet these requirements. What they lack is the operational infrastructure to sustain them.
Here's the friction that shows up in practice:
Your data science team built the model. Your regulatory affairs team didn't know it existed until someone asked about the 510(k). Your quality team owns the QMS but has never touched an AI validation protocol. Your post-market surveillance process was designed for physical device failures, not algorithmic drift.
Nobody is wrong here. The systems just weren't designed to connect.
PCCPs require that connection to be explicit, documented, and defensible. You need a change control process that accounts for model updates. You need validation protocols that were written before you needed them, not scrambled together under submission pressure. You need post-market monitoring that generates data someone is actually reviewing.
That's a workflow problem, not a model problem.
The manufacturers who are navigating this well didn't wait for final guidance. They did a few specific things:
They mapped their AI system's anticipated lifecycle — including likely modifications — before writing the first line of validation documentation. They treated the PCCP not as a regulatory checkbox but as a forcing function for honest engineering conversations about where the algorithm might need to change and why.
They built post-market monitoring into the product roadmap, not the compliance calendar. Drift thresholds were defined at design time. Escalation paths were written before anything went to market.
And critically — they involved regulatory affairs and quality early enough to shape the architecture, not just review it.
If you're a mid-market device manufacturer trying to get your house in order, here's the sequence that actually works:
1. Audit your current AI documentation posture. Do you have a clear record of training data provenance, known limitations, and the validation approach? If not, that's your starting point.
2. Draft your PCCP before you need it. Even if you're not in active submission, working through the PCCP exercise forces cross-functional alignment between engineering, regulatory, and quality. That alignment is the point.
3. Define drift thresholds now. What does acceptable performance look like in production? What triggers a review? What triggers a submission? These aren't questions to answer in a crisis.
4. Map your post-market surveillance process to AI-specific failure modes. Algorithmic degradation doesn't look like a field complaint. Your surveillance infrastructure probably isn't designed to catch it. Fix that.
5. Close the loop between your QMS and your AI workflow. Under QMSR, your quality management system needs to cover AI-enabled processes. If your QMS and your model governance are living in separate silos, that's a problem with a deadline.
The FDA isn't asking device manufacturers to stop innovating with AI. They're asking manufacturers to take responsibility for AI that's already running. That's a reasonable ask. The companies that treat it as an operational mandate — not a regulatory burden — will be the ones still shipping in three years.
Dealing with a similar challenge?
We work with mid-market companies in regulated industries to build AI workflows that actually hold up.
Let's TalkSean Cummings
Founder of Laminar Flow Analytics. Specializes in AI workflow automation for regulated industries — medical device, financial services, and complex logistics operations.