The FDA just shifted from product approval to process approval. Your AI-cleared moat got drained.

The FDA published its final guidance on Predetermined Change Control Plans for AI-and-ML-enabled medical devices on December 5, 2024. The guidance shifted the regulatory model for AI in healthcare from product approval to process approval in a specific and structurally important way. Vendors with PCCP-cleared products can now update the underlying AI models post-market, including substantive performance characteristics, without resubmitting the device for clearance, provided the changes fall inside the pre-approved change-control plan that the PCCP describes.

The shift has substantial implications for the healthcare-AI vendor moat. The vendor-class through 2018-2024 had been pitching FDA clearance as a durable, time-and-capital-intensive moat that protected the cleared vendor from new entrants. The PCCP guidance changes the shape of the moat. The new moat is the PCCP-cleared change-control process, not the cleared product. Vendors still pitching the FDA-cleared product as the moat are pitching the wrong asset. This is the explainer.

What PCCP is

Predetermined Change Control Plans are a regulatory mechanism specifically designed for AI and machine-learning medical devices, where the natural lifecycle of the model includes ongoing updates as the training data evolves, the deployment-context shifts, and the model architecture is improved. The 2018-2024 regulatory approach required vendors to submit a new clearance for material changes to the model, which created an operational friction that worked against the natural AI development cycle.

The PCCP framework lets vendors describe in advance the kinds of changes the AI model is expected to undergo, the methodology the vendor will use to validate each change, the performance metrics the change has to maintain or improve, and the change-control infrastructure (versioning, deployment, rollback) that supports the post-market update flow. The FDA reviews and approves the PCCP at the initial clearance stage. Subsequent updates that fall inside the PCCP can be deployed without separate FDA submission, with the vendor maintaining documentation that demonstrates the update complied with the PCCP.

The structural change is from per-update approval to per-process approval. The vendor with a strong PCCP can update the model continuously inside the approved change envelope. The vendor without a PCCP, or with a weaker PCCP, has to submit each material change for separate clearance.

What the FDA-cleared moat used to mean

Through 2018-2024 the vendor pitch on the FDA-cleared moat ran roughly as follows. The clearance took 12-24 months of submission-and-review work, plus the underlying clinical-validation work that produced the submission package. The total time-and-capital cost was meaningful, with first-mover advantage on a clearance translating into a defensible market position because subsequent competitors had to absorb the same time-and-capital cost to enter the market.

The moat was real for vendors who had invested the time and capital. The first-mover in a category typically had 18-30 months of clear runway before competitors could ship cleared alternatives. The moat was time-bounded, but the time was long enough to build customer-and-data graph relationships that compounded into longer-term defensibility.

Importantly, the 2018-2024 moat was on the cleared product. The vendor's specific AI model, trained on a specific dataset, validated against a specific performance benchmark, was the asset the FDA had cleared. Material updates required new clearance work, which meant the cleared product was a relatively static artifact.

What it means now

The PCCP guidance changes the structural shape of the moat in two ways.

The first change is that the cleared-product moat shrinks because the cleared product is now expected to update continuously inside the PCCP envelope. The vendor's specific model at the time of clearance is no longer the asset; the model-and-process pair is the asset. A vendor pitching the cleared-product moat is pitching a slice of the asset that no longer corresponds to what the vendor actually has.

The second change is that the PCCP itself becomes the moat. A vendor with a strong PCCP can iterate on the model continuously, capture new training data, deploy improvements, and respond to operational feedback without the regulatory friction the 2018-2024 model imposed. A vendor with a weak PCCP cannot. A new entrant has to either acquire a comparable PCCP through their own clearance work or accept the per-update-clearance friction that the existing vendor avoids.

The new moat shape is structurally different from the old one. The old moat was a one-time barrier; the new moat is an ongoing operational advantage. The vendor with a strong PCCP and a strong post-market update infrastructure produces a model trajectory that compounds, while a vendor with a weak PCCP produces a model that lags.

What the vendor class should pitch instead

For healthcare-AI vendors raising capital or selling into health systems through 2025-2026, the operator-class advice is to update the pitch deck. The slide that says "we are FDA-cleared" should be replaced with a slide that says "we have a strong PCCP plus an established post-market update cadence with documented performance trajectory." The detail under the slide should describe the PCCP's scope (what kinds of changes are pre-approved), the validation methodology the vendor uses for each change, the performance trajectory the model has demonstrated through the update cycles, and the change-control infrastructure that supports the cadence.

Vendors who have not invested in the PCCP-and-post-market-update infrastructure are pitching against the old moat that no longer exists. The pitch lands less well with sophisticated investors who have read the PCCP guidance and understand the regulatory shift, and the pitch lands less well with sophisticated buyers who care about whether the vendor can keep the model current as the deployment context evolves.

The vendor-class read on the PCCP shift is that the bar for entry has moved up, not down. The old bar was the FDA-clearance work itself, which was substantial but time-bounded. The new bar is the FDA-clearance work plus the PCCP development plus the post-market update infrastructure plus the demonstrated performance trajectory. The combined bar is higher, more durable, and harder to replicate. Vendors who have built the full stack have a moat that is structurally stronger than the 2018-2024 moat. Vendors who have only the cleared product have a moat that is structurally weaker than they have been pitching.

The buyer-class read on the same shift is that the diligence question on healthcare-AI vendors should now include the PCCP detail. A buyer evaluating two cleared vendors, one with a strong PCCP and one without, should weigh the PCCP heavily because the operational trajectory of the two vendors will diverge meaningfully over the deployment period. The diligence question to ask: what is your PCCP scope, your post-market update cadence, your performance trajectory through your update history.

The FDA-cleared moat got drained. The PCCP-cleared process moat replaces it. Vendors who recognize the shift and update the pitch capture the durable position. Vendors who do not are pitching the wrong asset and will continue to be priced and bought against an old framing the regulator has just superseded.

—TJ