What changed
FACT (cited): In June 2026 FDA issued a classification order placing radiological machine-learning-based quantitative imaging software WITH a Predetermined Change Control Plan into class II with special controls (Federal Register 2026-12166). This creates a new device class whose legal marketability is conditioned on complying with those special controls. INFERENCE: the controls impose recurring change-control/performance documentation duties on every model update — the order's full text has not been read in this input and this remains the load-bearing unverified assumption.
Why now
The duty class is weeks old. Early clearances under this pathway will come from AI startups with no in-house PCCP playbook, and every one of them appears in FDA's public 510(k) and Registration & Listing databases from day one — a complete, current, contactable buyer roster. First movers can define the reference process before eQMS incumbents ship a PCCP module.
Converging signals
(1) New class II special-controls pathway for ML-based QIS with PCCP (FedReg 2026-12166, FACT). (2) HYPOTHESIS from the convergence description: a companion order 2026-13140 for opioid-impairment monitors extends the same shape — not present in demand_evidence, unverified. (3) Structural fact of the domain: FDA publishes the full roster of cleared devices and registered establishments, making the obligated class enumerable. Signals array was empty; convergence rests mainly on the single rule.
Customer pain
HYPOTHESIS: a 10-40 person AI imaging startup that just cleared under this pathway must, to keep shipping model updates without new 510(k)s, maintain PCCP-conformant change logs, performance-drift evidence, and MDR readiness — work that is existential (an adulterated/misbranded device cannot be sold) but episodic, unfamiliar, and below the threshold of a full-time RA hire. No PAIN evidence items were provided, so the pain is inferred from the mandate, not observed in complaints.
Who pays
The sponsor of record for each cleared AI/QIS device — specifically founders/CTOs of sub-50-employee firms without a regulatory-affairs department. Reachable: names and addresses are in the public 510(k) database. Budget authority is the founder, not procurement.
Solved today
Regulatory-affairs consultancies (RQM+, MCRA, hourly at $250-500), eQMS platforms (Greenlight Guru, Rimsys, Ketryx) that manage general design controls, or a deferred/DIY spreadsheet approach. Ketryx in particular already markets AI/ML-specific change-control tooling to this exact segment.
Why current solutions are bad
Consultancies are engagement-priced and episodic, not continuous monitoring; generic eQMS platforms predate the PCCP order and don't yet encode its specific evidentiary schema; DIY risks the entire commercial license. INFERENCE: nobody has a productized, subscription-priced PCCP-maintenance offering purpose-built for this brand-new classification — unverified, needs a competitor sweep.
Proposed product
A $1-3k/mo 'PCCP dossier' service: structured change-log system mapped to the special-controls language, automated model-performance drift reports ingested from the customer's validation pipeline, MDR/complaint-log scaffolding, annual registration/listing calendar, and a one-click audit binder. Human-in-the-loop review by a contracted RAC-credentialed consultant (paid per review) to solve the credibility problem without a hire.
MVP version
Not software first: a manual 'PCCP audit + dossier setup' productized service for 2-3 design partners, delivered with templates + a shared workspace, at $2k setup + $1k/mo. Software (drift-report ingestion, audit binder generator) gets built under the paying engagements.
30-day build
(1) Read both classification orders in full and extract the exact recurring-evidence requirements — this is the falsification gate; stop if controls are one-time design requirements. (2) Scrape the 510(k) database for clearances under the new product codes; cross-reference LinkedIn for sponsor headcount. (3) Contract one RAC-certified reviewer on a per-hour basis for credibility. (4) Send the 20-email outreach test offering a free PCCP-readiness gap assessment.
60-day build
Run 5+ discovery calls; deliver 2 paid gap assessments ($1.5-2.5k each) as the wedge; convert at least 1 to monthly dossier maintenance; codify the special-controls checklist into the template library.
90-day revenue plan
Target 2-3 subscribers at $1-2k/mo plus assessment fees — roughly $5-10k cumulative by day 90-120. Realistic only if the 30-day falsification gate passes and medtech founders buy on a weeks-not-quarters cycle, which is unproven (see kill arguments).
Distribution path
Direct outreach to the enumerated public roster (the FDA databases are the lead list — same mechanism as the founder's ELDT play), plus content SEO on 'PCCP requirements' where search volume is nascent and winnable, plus referral deals with 510(k) submission consultants who don't want the post-market maintenance work.
Pricing hypothesis
$2-3k one-time PCCP gap assessment; $1-2.5k/mo maintenance subscription tiered by number of cleared devices/models; per-incident MDR support add-on. Anchor against the $150k+ RA salary and $300+/hr consultants.
Technical difficulty
Low-to-moderate for the software (templated document system, ingest of customer-supplied performance metrics, report generation). The hard part is regulatory-content correctness, which is bought (RAC contractor) not built.
Legal / regulatory risk
Moderate and real: the service edges into regulatory consulting where errors contribute to a customer's FDA violation. Mitigate with contracted credentialed review, clear terms that the sponsor retains regulatory responsibility, and E&O insurance. The service itself is not FDA-regulated (HYPOTHESIS — should be confirmed with counsel).
Platform dependency
Low. Depends only on public FDA databases and the durability of the PCCP framework, which is codified in a classification order and unlikely to be withdrawn.
Founder fit
Mixed. Matches the proven edge in shape (federal mandate → enumerable forced filers → per-fee compliance layer, like ELDT/TPR) and his systems/automation strengths. But it diverges in kind: FDA medtech is a credential-heavy trust market (the founder profile avoids heavily regulated medical products and multi-year trust plays), and PCCP maintenance is advisory-adjacent documentation, not mechanical portal submission — the ELDT play monetized keystrokes, this monetizes judgment. The government-portal lesson (confidence 0.80) applies only partially; the profile's medical-avoidance overrides a full 8-9 fit score.
Breakout potential
Good if validated: PCCP is expected to extend across future AI device classifications, and the same dossier engine generalizes to each new special-controls order — a compounding 'new duty class → same product' pipeline. Could also expand into post-market surveillance tooling sold to the same accounts.
Final recommendation
VALIDATE, don't build. This is a genuine forced-buyer pattern with an enumerable buyer roster, but it sits in the founder's stated avoid-zone (regulated medical, trust-cycle sales) and its core economic claim — recurring documentation duty + willingness to outsource — is unverified. Spend <2 weeks and <$500: read the two classification orders, enumerate small sponsors, run the 20-email test. Proceed only if the controls are recurring AND ≥2 discovery calls materialize; otherwise archive and reuse the roster-dossier pattern on a non-medical mandate.
Next action
Fetch and read the full special-controls text of Federal Register 2026-12166 (and locate 2026-13140); extract every recurring evidentiary obligation verbatim. This single step falsifies or funds everything else.