Who Signs When the Model Updates Itself: A 2026 Buyer's Guide to FDA Change Control Plans for Clinical AI

Before your hospital accepts a clinical AI device that updates itself, ask the vendor for its predetermined change control plan. If there is none, every update becomes a decision someone in your building has to make without the paperwork.

FDA finalized its guidance on these plans for AI-enabled device software in December 2024. A manufacturer can now describe in advance how a device may change after authorization. FDA reviews that plan as part of the marketing submission, whether the route is a 510(k), De Novo or PMA. Changes that stay inside the authorized plan do not need a new submission.

That is a convenience for the manufacturer. For a hospital it moves the question. The old question was whether FDA had cleared the version in your building. The new one is whether the version in your building is still the one you evaluated, and who would know.

What a change control plan contains

FDA's guidance describes three parts:

Planned modifications. What the vendor says may change, such as retraining on new data or a widened patient population.
Modification protocol. How each change will be developed, validated and implemented.
Impact assessment. The benefits and risks of each change and how they were weighed.

A plan with all three on paper tells you what the vendor is allowed to do. It says nothing about what the vendor has to tell you.

Six questions to ask before you sign

The six questions

Is there an authorized plan, and can we read the modifications it covers?Ask for the list in writing. A vendor who says "we update continuously" has described a practice, not a plan.
Which changes reach us without notice?Split every change type into three contract tiers: notify before, notify after, never without consent. Retraining, threshold shifts and new input sources each get a tier.
How will we know the version changed?The version identifier should appear in the clinical interface and in the audit log, with a timestamp. A model that changes on a Tuesday night should leave a mark by Wednesday morning.
What do we re-test locally after an update, and who runs it?Performance at your hospital depends on your patients. Write down the minimum check and the name of the person who owns it.
Who can roll back, and how fast?Put a right and a time commitment in the contract. Twenty-four hours and "reasonable efforts" are different promises.
Who is accountable when a clinician acts on an output from a version nobody told us about?Indemnity language matters here. So does the chart: it records what the clinician decided, and rarely records which model version helped her decide.

If specific, operational analysis like this is useful, The Sarah Matt Briefing covers one item like it every Tuesday: drsarahmatt.com/newsletter-signup

Where this sits on the regulatory calendar

FDA posted its proposed CDRH guidance lists for fiscal year 2027 on October 1, with comments due November 30, 2026. Trade coverage of the lists reports final guidance on the lifecycle and marketing-submission recommendations for AI-enabled devices (the draft appeared in January 2025) and a draft guidance on generative AI. FDA's public list of AI-enabled devices now holds well over a thousand entries.

Hospitals that buy these tools cannot wait for the guidance to settle. The contract is where the plan becomes a duty.

Where to start this quarter

Pick the AI tool that touches the most patients in your hospital. Find out whether it has an authorized plan. Then find out who receives its version notices.

Write down the name.

If the name is a shared inbox, that is the finding.

Want this in your inbox on Tuesday mornings? The Sarah Matt Briefing covers what changed in healthcare operations, what it costs, and what to check first. Subscribe here.

Clinical AI Governance Assessment

Dr. Sarah Matt is a surgery-trained physician-executive currently practicing internal medicine (charity care). She advises health systems and digital health companies on clinical AI implementation, vendor contracting and operational strategy.

Book a scoping call