What FDA's Current AI Guidance Actually Covers
There is no verified, finalized FDA document specifically titled a 2026 AI guidance. What exists today is a combination of the Predetermined Change Control Plan (PCCP) final guidance, published in December 2024, and the January 2025 draft guidance on AI-enabled device software functions covering lifecycle management and marketing submissions. Organizations planning compliance programs around a distinct 2026 publication should treat that framing as an anticipated evolution of these two documents rather than a confirmed separate regulatory text. The January 2025 guidance remains in draft status, meaning specific provisions are not yet binding, but they signal the direction FDA is taking and are reasonable to build toward now.
Together, these documents extend FDA's existing Software as a Medical Device (SaMD) and 2021 Software Modifications frameworks to address a specific problem: AI and machine learning models that change behavior after initial clearance, either through retraining, recalibration, or adaptive learning. Prior SaMD guidance was built around the assumption that a device's function was largely fixed at clearance. The PCCP framework formally acknowledges that AI models may need to change post-deployment and gives manufacturers a mechanism to pre-authorize that change rather than filing a new submission every time a model is updated.
The Predetermined Change Control Plan (PCCP) Requirement
The PCCP is the most concrete compliance mechanism in the current framework. A PCCP submission must describe the specific modifications a manufacturer anticipates making to an AI-enabled device, the methodology used to implement and validate those modifications, and an impact assessment addressing risks to safety and effectiveness. Once FDA authorizes a PCCP, model updates that fall within its defined scope do not require a new marketing submission.
This creates a direct operational obligation: healthcare organizations and manufacturers need a way to demonstrate that any live model update actually falls within the authorized boundaries of its PCCP, and not outside them. Misclassifying a change as PCCP-covered when it should have triggered a new submission carries direct regulatory risk. This is not a documentation exercise alone. It requires a technical mapping between what was authorized on paper and what is actually deployed in production at any given time.
Lifecycle Documentation and Transparency Obligations
The January 2025 draft guidance extends documentation expectations across the total product lifecycle (TPLC), not just at initial submission. This includes training data provenance, model performance metrics, and validation methods that need to be maintained and updated as the model evolves post-deployment. FDA also recommends risk management practices aligned with existing quality system regulation and recognized standards such as AAMI and ISO frameworks for AI-specific risk management.
The guidance additionally recommends transparency documentation for clinical users, covering intended use, performance characteristics, and known limitations of the AI model. This is meant to support clinical decision-making oversight, meaning a clinician using an AI-enabled tool should have access to current, accurate information about what the model does and where its limitations lie. As models are updated under a PCCP, this user-facing documentation needs a governance process to stay current rather than reflecting only the state of the model at original clearance.
Auditability and Traceability in Practice
Neither the PCCP guidance nor the draft AI lifecycle guidance prescribes specific technical architecture for auditability. What they do establish are outcomes that organizations need to be able to demonstrate: that a deployed model version matches an authorized change boundary, that validation testing was performed according to the documented PCCP methodology, and that performance monitoring data exists to support ongoing safety and effectiveness claims.
Meeting these outcomes in practice requires traceability between training data, model versions, and the outputs those versions produce, a principle also reflected in the 2021 Good Machine Learning Practice guiding principles jointly issued with Health Canada and the UK MHRA. Without version-level tracking of what model was live at what time, and what data and validation results support that version, organizations cannot reliably answer FDA's core lifecycle questions after the fact.
Governance Tradeoffs and Risk Tiering
Not every AI-enabled system carries the same compliance weight. FDA's SaMD framework, built on the IMDRF risk categorization model, determines how intensive documentation, validation, and monitoring obligations should be for a given device. Applying the same level of change control rigor to a low-risk clinical support tool as to a high-risk diagnostic model is inefficient and does not reflect how FDA structures its expectations.
Governance programs should tier monitoring and audit depth according to device risk classification, reserving the most stringent runtime controls, such as continuous drift detection and granular change approval workflows, for higher-risk AI systems. Because the underlying guidance is still partially in draft form, governance frameworks should also be built with adaptability in mind rather than treating current draft provisions as fixed compliance criteria. Organizations that hard-code today's draft language into rigid internal policy risk rework once FDA finalizes its position.