ENVOLOK™ is a program you run before a release. Your Predetermined Change Control Plan is the list of modifications FDA cleared you to make without filing again. ENVOLOK reads it, checks a change against it, and either clears it or stops it — then signs a record you can hand an inspector.
A 440 KB program that runs on a machine inside your quality system. Not a service, not a portal, not a consultant. There is no account and no server to call.
Somebody on your team writes the authorized PCCP out once, as structured text: which modification types are permitted, which metric ranges, which validation tests, who has to approve. An afternoon of work, and it does not change again unless the plan does.
The dataset, the candidate build, the validation results, the approval, the release record, the deployed artifact. Files your quality system already produces for every change.
A verdict in well under a second: DEPLOY, BLOCK or UNKNOWN, the failing rule named if there is one, and a signed receipt listing every check it ran. Verifiable by anyone, without ENVOLOK and without us.
It runs on the release engineer's laptop, on a validated workstation, or in your build pipeline. Nothing about your device leaves your network, because it has no way to send it anywhere.
It happens because the plan is thirty pages of prose, the person who wrote it has moved on, and the release meeting is on a Thursday with eleven other things on the agenda.
Somebody says the change is inside the plan. Somebody else agrees. It is almost always true. Almost always is a different thing from provably, and the difference only matters once — when an inspector is sitting across the table asking why this shipped, and the honest answer is that a careful person read a document and remembered it correctly.
FDA is not vague about what a deviation costs.
Deviations from the authorized PCCP … would generally cause the device to be adulterated and misbranded … FDA may take legal or regulatory action against violations of prohibited acts, including, without limitation, seizure or injunction. FDA, Predetermined Change Control Plans for Medical Devices, 22 August 2024
The plan is enforceable. In most companies nothing enforces it except attention, and attention is the thing you have least of on a Thursday.
That last line matters more than it looks. Most systems record what passed and what failed. A thing nobody measured is neither, and calling it a pass is how a gap reaches the field with a signature on it.
I cannot show you a customer. There is not one yet. Here is what I can show you instead.
FDA's guidance publishes eight worked examples. For each device the agency names the changes that belong in a plan and the changes that do not. That is 47 decisions the regulator has already made, in public. ENVOLOK was run against every one.
| FDA example | Device | Result |
|---|---|---|
| 1 | Cancer risk microarray, over the counter | agreed |
| 2 | Potassium electrode, lab analyser | agreed |
| 3 | Polyethylene surgical suture | agreed |
| 4 | Patient monitor with arrhythmia alarms | agreed |
| 5 | Sleep apnea risk app, over the counter | agreed |
| 6 | Antimicrobial susceptibility test | agreed |
| 7 | HLA typing assay | agreed |
| 8 | Implantable pulse generator | agreed |
Software, diagnostics, implantables, surgical hardware. Your own engineer can run the whole thing on a laptop with the wifi off and check the answer themselves. Nobody is asking you to trust a dashboard, or me.
FDA had authorized 1,451 AI-enabled devices by the end of 2025, and 295 of them cleared in 2025 alone. Roughly one in ten of those 2025 clearances carried an authorized change control plan. Three quarters are radiology.
The plans that exist are mostly thin. A systematic review of radiology AI devices scored PCCP documentation against an eight-point rubric drawn from FDA's own final guidance. The average score was five. Most authorized plans are missing three of the eight things the guidance asks for.
And the tracking is worse than the plans. The same review found FDA's public database listed 25 PCCP-cleared radiology devices while the actual decision summaries showed 34 — an undercount of more than a quarter, which the authors had to correct by hand.
If the agency's own database cannot reliably say which devices have a plan, the odds that every release meeting can reliably say what is inside one are not good.
Congress created these plans in 2022. FDA finished the guidance in 2024 and 2025. They are new enough that most quality systems were not built with them in mind, and the people running those systems are carrying an obligation that did not exist three years ago.
Every authorized plan is a standing commitment for the life of the device. The number of plans is going up. The number of things to verify per change is going up. The headcount checking them is not.
Redacted is fine. Under NDA is fine, and is usually what people prefer. It runs offline on your own machine, and nothing you show it leaves your network.
hello@envolok.com