FDA’s Software Precertification Program 2026: What Pharma AI Teams Should Track

From Pre-Cert Pilot to Today: What Actually Happened

The Pre-Cert Program was ambitious in ways that are easy to forget now. When the FDA launched the pilot in 2017 as part of its Digital Health Innovation Action Plan, the premise was that some software products change so rapidly that traditional premarket review, product by product, submission by submission, could not keep pace. The agency proposed pre-certifying entire organizations on the basis of five excellence principles: patient safety, product quality, clinical responsibility, cybersecurity responsibility, and proactive culture. A pre-certified company would then be able to bring qualifying software to market with a lighter review, on the theory that a demonstrably excellent organization posed lower risk than one being assessed for the first time.¹

Nine companies participated in the pilot, including Apple, Fitbit, Johnson & Johnson, Roche, Samsung, Verily, Pear Therapeutics, Phosphorus, and Tidepool. Over five years, the FDA published a working model, a test plan, and eventually a September 2022 report that acknowledged what most observers already understood: the pilot had run into two structural problems the agency could not solve on its own. First, its existing statutory authorities did not comfortably accommodate an organization-level pre-certification concept for medical devices. Second, measuring organizational quality with a repeatable, defensible methodology proved harder than measuring a specific product.²

The 2022 report was clear-eyed. It concluded that the pilot had been useful as an exploration, but that new statutory authority would be needed to operationalize the model at scale. That authority never came. Instead, Congress passed the Food and Drug Omnibus Reform Act (FDORA) in December 2022, which included Section 3308 authorizing Predetermined Change Control Plans, a targeted mechanism for pre-authorizing iterative changes to specific products rather than pre-certifying entire organizations. Pre-Cert, in effect, was superseded by a narrower, more surgical instrument that Congress was willing to grant.³

Why Pharma AI Teams Should Care About a Device Program

The first objection is reasonable. Pre-Cert and its successor guidances speak in the language of medical devices and 510(k) submissions. Most pharma AI initiatives are not devices. They are models used to optimize manufacturing yield, triage adverse event reports, predict clinical trial enrollment, or draft regulatory narratives. Why should a regulatory affairs director in pharma care about a program aimed at software as a medical device?

Three reasons, each of which the FDA has made increasingly explicit in the last eighteen months.

The Same Concepts Are Migrating into Pharma Guidance

In January 2025, the FDA issued a draft guidance titled “Considerations for the Use of Artificial Intelligence to Support Regulatory Decision-Making for Drug and Biological Products.” This is not a device guidance. It applies to models used across the nonclinical, clinical, post-marketing, and manufacturing phases of the drug product lifecycle when the output supports a regulatory decision about safety, effectiveness, or quality.⁴

The draft guidance is structured around two concepts that trace directly back to Pre-Cert and to the AI/ML SaMD Action Plan: the idea of a “context of use” that scopes what the model is doing and why, and a risk-based framework for establishing model credibility appropriate to that context. Sponsors are expected to define the model’s role, assess risks, and compile credibility evidence that scales with the consequences of getting the model’s output wrong. This is Pre-Cert’s total product lifecycle thinking translated into pharma vocabulary.⁵

Pharma Companies Are Increasingly Building Devices

The line between pharma and med tech is blurring. Companion diagnostics, drug-device combination products, digital therapeutics adjuncts, and AI-enabled clinical decision support tools deployed alongside a drug all sit at the intersection. If a pharma company launches an AI-enabled patient monitoring tool alongside its therapy, that tool is very likely software as a medical device, and everything the FDA has said about AI-enabled device software functions applies directly. The 2025 draft guidance on lifecycle management is the operative document.⁶

Global Regulators Are Aligning Around Common Principles

The Good Machine Learning Practice (GMLP) principles first published jointly by the FDA, Health Canada, and the UK MHRA in 2021 were finalized by the International Medical Device Regulators Forum (IMDRF) in 2025 as ten guiding principles covering the AI lifecycle from data through deployment and monitoring. GMLP principles are non-binding, but they are increasingly expected in submissions and lifecycle documentation, and they apply the same logic to any AI-enabled system where clinical performance matters, regardless of whether the artifact is technically a device.⁷

Add to this the FDA-EMA joint principles on responsible use of AI in drug development, published in early 2025, and the direction is unmistakable. The regulators expect a consistent set of controls, data quality, model documentation, risk-proportionate validation, human oversight, and post-deployment monitoring, whether the model sits in a device, a manufacturing execution system, or a regulatory submission workflow.⁸

The Practical Overlap Nobody Talks About

There is a quieter reason pharma teams should care, and it rarely surfaces in vendor pitches or trade press coverage. Modern pharma organizations increasingly deploy the same underlying AI infrastructure across regulated and unregulated use cases. A large language model used to draft internal memos may also, six months later, be used to summarize adverse event narratives. A vision model built for warehouse logistics may be repurposed to inspect vial fill lines. When the model crosses that threshold, the regulatory expectations change immediately, and the documentation that would have satisfied an inspector needs to already exist, not be reconstructed after the fact.

This is the practical failure mode we see most often in pharma AI programs: the model becomes GxP-relevant before anyone in quality or regulatory notices. By the time it matters, the training data lineage cannot be reconstructed, the validation dataset was never versioned, and the monitoring instrumentation was designed for uptime rather than performance drift. Pre-Cert’s original insight, that quality and lifecycle discipline are properties of the organization, not the product, is exactly the insight pharma teams need to internalize before their AI systems find their way into GxP workflows.

How PCCPs Actually Work in AI/ML Submissions

The Predetermined Change Control Plan is the single most consequential AI-specific regulatory mechanism to emerge from the Pre-Cert lineage. The FDA finalized the guidance in December 2024 and updated it in August 2025. Any pharma organization touching AI-enabled device software should understand it, and the underlying logic informs how the FDA thinks about controlled iteration for AI models more broadly.⁹

What a PCCP Is and What It Solves

A PCCP is a manufacturer-proposed plan submitted alongside a marketing application (typically a 510(k), De Novo, or PMA) that pre-authorizes specific modifications the manufacturer intends to make after clearance. Without a PCCP, most substantive changes to a cleared device require a new marketing submission. With one, the modifications described in the plan can be implemented under a controlled protocol without a new submission, provided the manufacturer stays within the plan’s scope.¹⁰

The mechanism was authorized by Section 515C of the Federal Food, Drug, and Cosmetic Act, added by FDORA in December 2022. Its practical value for AI-enabled devices is enormous. A retrained model, an updated performance envelope, an expanded intended-use population, changes that would previously have required a new submission each time, can now be handled through a pre-authorized change plan, provided the manufacturer has done the work to describe those changes and their controls upfront.¹¹

The Three Required Sections

Where Pharma AI Teams See PCCP Logic Applied

Even when a model is not a device, the PCCP’s underlying logic, describe the change, describe the protocol, describe the impact, is showing up in FDA expectations for AI in drug development. The January 2025 draft guidance on AI in drug development does not use the term “PCCP,” but it does ask sponsors to describe how models will be maintained and updated over their lifecycle, how retraining decisions will be triggered, and how the credibility case survives model updates. In practice, a well-constructed PCCP-equivalent will satisfy a growing share of these expectations.¹²

Common PCCP Design Mistakes to Avoid

Reviewing PCCPs that have gone well and those that have not, a small number of design mistakes account for most of the friction with the FDA. The most common is scope drift, writing modifications so broadly that the plan cannot credibly bound the impact assessment. A PCCP that says “the model may be retrained on new data” without specifying what kind of data, from what sources, meeting what quality criteria, will not survive review. The second is treating the modification protocol as a checklist of steps rather than a scientifically justified methodology. The FDA wants to see that the protocol will actually detect problems if the modification introduces them, not just that a procedure will be followed. The third is a thin impact assessment that considers each modification in isolation rather than in combination with prior authorized changes. The cumulative effect of small changes is often where risk accumulates.

The teams that build PCCPs well treat them as living design documents rather than one-time submission artifacts. They rehearse modifications against the plan before executing them, use tabletop exercises to identify gaps in the protocol, and revise the plan proactively when their operating experience reveals new failure modes. This mirrors how mature pharmaceutical quality systems handle change control for other GxP software: the discipline exists precisely because the guarantees the plan makes are only as good as the plan’s fidelity to actual practice.

The 2025 Lifecycle Management Draft Guidance

Released on January 6, 2025, “Artificial Intelligence-Enabled Device Software Functions: Lifecycle Management and Marketing Submission Recommendations” is the most consequential FDA document on AI in software to date. It is still a draft as of mid-2026, but its recommendations already function as de facto expectations for AI-enabled device submissions and, by extension, as a strong signal to any pharma team building AI systems that touch clinical or manufacturing decisions.¹³

What the Guidance Asks For

The draft guidance organizes recommendations around the Total Product Life Cycle. It asks manufacturers to include, in marketing submissions:

• A detailed model description, including architecture, training data provenance, and design rationale
• Data lineage documentation covering how training, tuning, and test datasets were assembled, curated, and split
• Performance evidence tied specifically to intended-use claims, not just aggregate metrics
• Bias analysis and mitigation strategies, including subgroup performance where applicable
• Human-AI workflow documentation describing where and how humans interact with model output
• Post-market monitoring plans for real-world performance, drift detection, and adverse event handling
• A PCCP where post-market modifications are contemplated

None of these are surprising individually. Together, they represent a substantially higher documentation bar than most AI submissions have historically cleared. The guidance also emphasizes bias and health equity considerations explicitly, and it treats transparency, both to users and within submissions, as a first-class deliverable.¹⁴

Real-World Performance Monitoring Comes Front and Center

One of the clearest through-lines from Pre-Cert to the 2025 guidance is post-market performance monitoring. Pre-Cert’s original vision anticipated that pre-certified organizations would supply the FDA with ongoing real-world performance data as a condition of the lighter premarket review. That specific bargain never materialized, but the expectation of real-world monitoring has become a general one. The 2025 guidance asks manufacturers to describe how they will detect performance degradation, distribution shift, and workflow changes that could affect model behavior, and how they will act on those signals.¹⁵

Comparing the US and EU: A Practical Table

The EU AI Act, which entered into force in August 2024 with a phased implementation timeline, classifies AI systems used as safety components of products regulated under the Medical Device Regulation or In Vitro Diagnostic Regulation as “high-risk.” Deadlines for these systems have been the subject of active revision as part of the EU’s Digital Omnibus proposals, but as currently structured, high-risk medical AI systems face a long-stop compliance date of August 2, 2028, with the Chapter III requirements applying after transitional periods once the Commission confirms support measures are in place.¹⁶

For pharma AI teams, the practical question is how the EU regime overlaps with, and diverges from, the FDA’s approach. The following comparison covers the areas where alignment or divergence has the biggest operational impact.

Reading the Divergence Correctly

It is tempting to treat the US and EU frameworks as if they will eventually converge into a single global standard. That expectation is unlikely to be borne out on any actionable timescale. The FDA’s approach is grounded in decades of device and drug regulatory practice, adapted for AI’s iterative nature. The EU AI Act sits above sectoral regulations as horizontal legislation, imported into pharma and med tech contexts through MDR and IVDR conformity assessment machinery. These structural differences will persist even as the substantive requirements move in similar directions.

The practical implication is that pharma organizations should design their AI governance to satisfy the stricter of the two frameworks on each dimension, and to produce artifacts flexible enough to be assembled into either an FDA submission or an EU technical documentation file. This is not a translation exercise done at the end. It is an architectural decision made at the start of the governance program, and it is the decision that most often determines whether the program scales or has to be reworked in year three.

What Pharma Quality and Regulatory Teams Should Monitor

The regulatory landscape for AI in life sciences is changing quickly enough that a static compliance program will not survive. Quality and regulatory teams should build ongoing monitoring for a defined set of upstream signals that predict where enforcement expectations will land.

FDA Signals

• Final version of the 2025 lifecycle management guidance. The draft is likely to be finalized in the second half of 2026 or early 2027. When it lands, it will crystallize submission expectations.
• Final version of the AI in drug development guidance. Same timing pattern. Its finalization will affect every sponsor using AI in nonclinical, clinical, post-marketing, or manufacturing activities.
• Updates to the FDA’s list of authorized AI-enabled medical devices. The FDA has signaled that it will tag devices using foundation models. That tagging will provide the first structured public view of how the agency treats large language models and multimodal systems in device contexts.
• CDER and CBER pilot programs. The CMC Development and Readiness Pilot (CDRP) and the AI-Enabled Optimization of Early-Phase Clinical Trials Pilot are testing science- and risk-based approaches that inform where AI will be accepted in mainstream regulatory workflows.¹⁷

Global Signals

• EU AI Act implementing acts and Commission guidelines. The Commission has been issuing guidance on high-risk classification and on general-purpose AI. Each new guideline shifts the compliance perimeter.
• EU Digital Omnibus reforms. Proposed simplifications to the interaction between the AI Act, GDPR, and sectoral rules like MDR could materially change what pharma has to do. These are moving targets in 2026.¹⁸
• IMDRF guidance evolution. With GMLP finalized in 2025, IMDRF is likely to move on to more specific work products on validation, monitoring, and transparency. These typically show up in national guidance within twelve to eighteen months.
• Notified Body positions. For EU-marketed products, NB expectations often lead formal guidance. Watch published position papers and inspection findings.

Internal Signals

• Model inventory completeness. If your organization does not have a current, accurate inventory of AI/ML systems in use, and their intended contexts of use, you are behind. This is the single most useful artifact you can build in 2026.
• Change control gaps. Are model updates going through the same change control as other GxP software changes? If not, that gap will surface in the next inspection.
• Real-world performance data. Are you capturing the data you would need to demonstrate that deployed models are still performing? If the data is not being captured, the demonstration cannot be made after the fact.

A Practical Playbook for the Next 12 Months

Pharma AI teams reading this in July 2026 have a narrow but real window before both the FDA and EU frameworks harden further. A practical playbook for the next twelve months breaks into three tracks that should be executed in parallel.

Track 1: Build the Foundational Artifacts

Every organization using AI in a GxP-relevant workflow should have, by the end of 2026:

1. A complete AI/ML inventory, refreshed at least quarterly
2. A context-of-use statement for each system, at a granularity that supports credibility assessment
3. Data lineage documentation for training, tuning, validation, and test datasets
4. Documented human-AI workflow and points of intervention
5. A retraining and change control procedure that maps to PCCP-style thinking
6. Post-deployment monitoring instrumentation with defined thresholds

None of these require the guidance to be final. All of them will be needed regardless of how the final guidance reads.

Track 2: Address the Dual-Jurisdiction Reality

Organizations that market or plan to market in the EU need a compliance design that satisfies both FDA and EU AI Act expectations. This is not a translation exercise. It is a design decision about which framework’s stricter position governs each control. A common pattern that works:

• Use the FDA’s context-of-use framing as the anchor because it aligns with pharma’s existing risk-based validation vocabulary
• Layer EU AI Act Article 9 risk management as the continuous process wrapper
• Adopt EU Article 10 data governance requirements as the floor for data documentation, since they are more prescriptive than FDA’s principles
• Design change control to include a PCCP-equivalent that also satisfies the EU’s substantial modification criteria
• Instrument post-market monitoring to feed both FDA real-world performance expectations and EU Article 72 requirements

Track 3: Monitor the Regulatory Signal Stack

Assign someone accountable for monitoring the FDA, EMA, EU Commission, MHRA, IMDRF, and NIST AI publications. Not a passive subscription; an active monitoring role with a defined cadence and escalation triggers. The volume of guidance in flight makes this a real job.

A useful pattern is to run a monthly regulatory intelligence review where the assigned owner presents new guidance, warning letters, and industry positions to a small cross-functional group covering quality, regulatory affairs, IT, and the AI product owner. The review should produce two outputs: a change log that annotates the organization’s AI inventory with new applicable requirements, and a short “what changed for us” note that circulates to the broader team. Without this cadence, guidance updates land unevenly and lag by months, which is precisely when compliance debt accumulates.

Track 4: Invest in the Governance Muscle

The Pre-Cert Program’s most durable insight was that credible AI oversight is an organizational competency, not a document. The organizations that will comply well over the next three years are the ones investing now in three specific capabilities: a small central AI governance function with the authority to require documentation, a clear escalation path when a model changes context of use or crosses a risk threshold, and training for GxP quality staff on what AI-specific validation actually requires. None of these show up in a guidance document, but all of them are visible to inspectors and reviewers who have started asking about them explicitly.

Investing in this muscle is also a hedge against regulatory ambiguity. When the guidance is fuzzy, credible governance becomes the differentiator between “we are handling this well” and “we hope the reviewer does not notice.” The former posture creates trust with regulators and buys latitude when the guidance eventually clarifies. The latter posture generates deficiencies that are expensive to remediate and slow to close.

Conclusion

The Pre-Cert Program did not become the regulatory framework the FDA originally proposed, but the questions it raised, how to regulate software that changes constantly, how to monitor real-world performance, how to give manufacturers appropriate latitude to iterate, remain the animating questions of AI regulation across both devices and drugs. The Predetermined Change Control Plan mechanism, the 2025 lifecycle management draft guidance, the AI in drug development draft, and the growing body of IMDRF and joint FDA-EMA principles are the answers the agencies have been assembling. For pharma AI teams in 2026, understanding this lineage matters because it explains why the regulatory expectations are converging on a common set of controls even as the guidance documents themselves remain scattered.

Sakara Digital works with pharma and biotech organizations building the operational muscle to comply with this evolving stack without waiting for perfect clarity. If you are standing up model inventory, PCCP-equivalent change control, or a dual-jurisdiction AI governance design and want an independent perspective on where to start, we are happy to have that conversation.