How FDA PCCPs Redefine Pharmacy Software Maintenance

• Predetermined Change Control Plans (PCCPs) allow manufacturers to pre-specify and deploy AI/software updates to FDA approved devices without new FDA submissions, provided they follow a specific modification protocol and impact assessment.

• While there has yet to be a flood of regulated devices in the pharmacy space, recent FDA CDS guidance suggests we should expect greater scrutiny over our advanced AI powered tools. Anticipation for how concepts like PCCP will transform our vendor relationships and the ongoing maintenance required for these advanced systems.

• Hospital pharmacies must treat PCCP-enabled features as change-managed products, requiring contract language for transparency, rollback options, and designated governance to approve updates.

• PCCPs shift postmarket failure modes onto health systems: pharmacy and P&T must own review and version awareness. This improves responsiveness but raises liability if rollback controls are limited.

• Operational workload will increase: We must consider expanding our informatics capacity to support the rigorous continuous maintenance these advanced systems will demand.

• Contracts and vendor management become critical: Procurement must insist on access to audit logs, transparent change management, and explicit version control to prevent unwanted automatic updates.

Treat PCCPs as the operating model for adaptive clinical algorithms. Prioritize governance now by assigning a pharmacy technology lead, insisting on PCCP transparency and rollback rights in contracts, and developing processes local validation and monitoring efforts.

• A PCCP includes a "Modification Protocol" (outlining retraining triggers like data drift or fixed cadence) and an "Impact Assessment" (documenting benefit-risk analysis and interdependencies).

• Updates can change embedded logic across the medication-use stack—EHRs, pharmacy information systems, compounding robotics, diversion analytics, and inventory engines.

• Validation requires pharmacy informatics and medication-safety officers to run regression tests in a staging environment using curated "golden case" test sets.

• Operational metrics need strict monitoring thresholds set jointly by the vendor and local governance (e.g., sensitivity drop >5 percentage points, override rate +30% relative, or alert volume spike >50%).

• Real-world examples are already live: although not directly related to pharmacy, recent 510(k) clearances (like Clarius OB AI and Beacon Biosignals) include authorized PCCPs with specific retraining triggers and acceptance criteria.