Your PCCP Is Now a Procurement Document: What Hospital AI Buyers Ask About Updates

A predetermined change control plan (PCCP) is written for FDA. In 2026, hospital AI buyers started asking for it too. The ACR-SIIM Practice Parameter for Imaging Artificial Intelligence, adopted by the American College of Radiology Council this year, encourages manufacturers to give practices the "Scope of any FDA-authorized predetermined change control plan (PCCP) or model update process." The Health Sector Coordinating Council's April 2026 guide on third-party AI risk proposes contract terms for update notice and a "right to delay or reject updates." CHAI's new intake controls ask vendors to tell customers about material version updates in advance.

‍

Below is what buyers now ask about updates, why your PCCP is the natural answer, and what to add so it works as a procurement document.

‍

Why buyers care about your update plan

A hospital that deploys an AI tool tests it on its own data first. The ACR-SIIM parameter asks practices to agree on "Predefined metrics for acceptable AI performance" before that local evaluation, then to run "continuous monitoring with periodic reports" on performance, "calibration, drift and subgroup performance." Every model update can change what the hospital tested. So the governance group needs to know what can change, how you test it, and when they will hear about it.

‍

They also decide without you. The same parameter says "a manufacturer or developer of an AI solution would not be expected to participate in governance discussions related to the deployment of their product at the practice." Whatever you send has to answer the question on its own.

‍

What buyers now ask about updates

Five buyer-side documents published since September 2025 cover model updates. None is a regulation, and each hospital's contract will differ, but they point the same way.

‍

• ACR-SIIM Practice Parameter for Imaging AI (adopted 2026). Manufacturers "should deliver comprehensive documentation, including release notes and model versioning" and "proactively notify customers prior to deploying new versions." They are encouraged to share PCCP or model update process scope and "Per-version change notes that flag subgroup-specific changes in performance."
• HSCC Third-Party AI Risk and Supply Chain Transparency Guide (April 2026). Proposes 30 days' notice for non-critical updates and 72 hours for security patches, a right to delay or reject updates, notification procedures for performance degradation, 12 to 18 months' end-of-life notice, and an AI bill of materials.
• CHAI AI Intake Playbook (October 2026, draft controls going to pilot). Asks that "Material version updates and any change to underlying foundation models are communicated to the customer in advance" and that a model drift or degradation response process is defined.
• HAIP AI Vendor Disclosure Framework (NEJM AI, April 2026). Asks how the system is maintained and updated and who is responsible, what performance thresholds and remediation processes are in place, how adverse events are reported, and who the designated oversight contact is.
• Joint Commission and CHAI guidance on the Responsible Use of AI in Healthcare (September 2025). Asks hospitals to test tools on local data and to scale post-deployment monitoring to risk. It now underpins a voluntary Joint Commission certification of healthcare organizations, not of products.

‍

Your PCCP already answers most of it

FDA's PCCP guidance for AI-enabled device software functions recommends the same three parts in every PCCP, and each one answers a buyer question.

‍

• Description of modifications. What can change, within what limits, and what cannot.
• Modification protocol. How each change is developed, tested and released, against acceptance criteria set in advance.
• Impact assessment. The benefits and risks of each change and of all changes together, including how unintended bias is controlled.

‍

FDA also recommends that labeling say the device has an authorized PCCP and describe each change as it ships and how users are informed. That is most of what a hospital asks for. The gap is format. A PCCP is written for a reviewer, it runs long, and parts of it are proprietary. A governance group needs a short, plain version it can read without you.

‍

Five things to add so it works in procurement

1. A buyer-facing PCCP summary. One or two pages covering each planned change in plain language, what stays fixed (intended use, inputs, users), the acceptance criteria in plain terms, and what happens if an update misses them. Build it from the authorized PCCP and your labeling, not from your product roadmap. A change outside the authorized PCCP may need a new submission, so the summary should not promise it.

‍

2. Release notes that map to the PCCP. Each release names the planned modification it falls under, the verification result against the acceptance criteria, and any change in subgroup performance. This is the per-version change note the ACR-SIIM parameter describes.

‍

3. An update notice policy. State your notice period for routine updates and for security patches, whether a customer can defer an update and for how long, how long you support an older version, and your end-of-life notice. The HSCC terms are a reference point, not a standard. Decide what your engineering and quality teams can support before a contract decides for you.

‍

4. A local revalidation trigger. Tell each site which kinds of change warrant re-running its local acceptance test and which do not. Give the site what it needs to re-run it, such as the test case definition and the metrics you used.

‍

5. The monitoring plan that sits beside the PCCP. Say what you monitor in the field, the thresholds, who acts, how a degradation notice reaches the customer, and how findings feed the next modification. FDA's draft guidance on AI-enabled device software functions says manufacturers "should have a postmarket performance monitoring plan," but that for a 510k FDA "generally does not require" one in the submission, absent certain circumstances such as a special control. Buyers increasingly expect to see it either way.

‍

No PCCP? Buyers still ask

The ACR-SIIM wording is "PCCP or model update process," so a device without a PCCP still faces the question. Without one, each change runs through your design change controls and FDA's software change guidance to decide whether a new 510k is needed. Describe that process in the same buyer-facing format, including how long a significant update could take to reach customers. Some buyers will read a slow, well-controlled path as a strength.

‍

What to watch out for

• Most of this is voluntary. The buyer documents above are a practice parameter, guides and draft controls. They show what governance groups will ask, not what any law requires.
• Share a summary, not the file. The buyer summary should match the authorized PCCP and labeling. Share more under a confidentiality agreement if a customer needs it.
• A PCCP does not replace the hospital's own testing. It authorizes changes for FDA. Sites will still want to re-check performance on their data.
• Keep claims inside the cleared indications. A summary written for sales can drift into promises the PCCP does not cover.

‍

The bigger picture

The PCCP started as a way to change an AI model without a new submission for every update. Its second audience is the hospital that has to live with those changes. Other regulators are moving the same way. IMDRF finalized its PCCP principles in 2026, and the UK plans draft PCCP guidance by December 2026, as covered in our post on the UK government response. Our PCCP guide tracks where each jurisdiction stands.

‍

This post is the first in a series on what regulators, hospital buyers and payers each ask of AI devices after clearance.

‍

How Cosm Can Help

Cosm helps AI device teams write PCCPs built for FDA review and turn them into buyer-ready summaries, release notes, update policies and monitoring plans. Our FDA PCCP template is a starting point for the plan itself. Talk to Cosm about your update plan.