Contocracy, a form of rule proposed in 2026, gives one chosen leader an organization’s highest office for good, and after the leader’s death a declared AI stand-in acts on urgent matters. Its rule for upgrading that stand-in, that a rebuilt model must match the leader’s record at least as well, is a change control problem. This article applies FDA’s predetermined change control plans, and the guiding principles FDA issued with Health Canada and the MHRA, to that rule and marks the points that remain open.

The Tessaly Medication Safety Network is an invented nonprofit through which sixty hospital pharmacies share reports of infusion pump programming errors, look-alike vials and mislabeled packaging, and send joint safety alerts to their members. For twenty years its founder, the hospital pharmacist Dr. Ingrid Vollmer, decided which alerts went out and how quickly. The member hospitals have organized the network as a contocracy, with Vollmer as its contocrat.

After her death, a declared AI stand-in trained on her record of alert decisions handles the urgent matters, such as whether a dosing library error in a widely used pump justifies an alert that night. Five years later, the operators want to rebuild the stand-in on a newer model. Contocracy’s rule allows that only if the new model matches Vollmer’s record at least as well. The rule is one sentence long. Medical device regulation has spent years building the machinery that a sentence like that needs.

How a contocracy is built

Contocracy is a form of rule proposed in 2026. One chosen person, the contocrat, holds a community’s highest office for good. Lower powers may be delegated, so Tessaly’s staff still run its daily work, but the top office is not transferable and passes to no heir. On the contocrat’s death it is held in abeyance and remains the contocrat’s.

Between death and any return, decisions that can wait do wait. Operators whom the contocrat chose in life judge which matters are urgent. One declared AI stand-in acts on urgent matters after death by default, or for a living contocrat who cannot be reached, if the contocrat has authorized that. Everyone knows the stand-in, not the contocrat, is deciding, and its rulings are labeled as its own. The contocrat’s religion prevails over the mission.

Cryopreservation is expected but not required. No one has been revived, and the form promises nothing. A proven return, meaning proof of first-person continuity rather than a likeness, brings the contocrat a full briefing and the power to reverse the stand-in’s rulings. A rebuilt or upgraded model is allowed only if it matches the contocrat’s record at least as well.

The template health law already has

Section 515C of the Federal Food, Drug, and Cosmetic Act, added by Congress in December 2022, lets FDA authorize a predetermined change control plan (PCCP) as part of a device’s marketing authorization. A change consistent with the authorized plan needs no new premarket approval supplement or 510(k), and FDA may attach labeling, notification and performance requirements to changes made under the plan.

FDA’s final guidance on PCCPs for AI-enabled device software functions, issued in December 2024 (the version now posted is dated August 2025), asks for three parts: a description of modifications; a modification protocol covering data management, retraining, performance evaluation and update procedures; and an impact assessment. Changes to a device’s intended use do not belong in a PCCP. Labeling should state that the device has an authorized plan and, as changes are made, describe them, for example through a version history.

In October 2023, FDA, Health Canada and the UK’s Medicines and Healthcare products Regulatory Agency (MHRA) jointly issued five guiding principles for PCCPs: a plan should be focused and bounded, risk-based, evidence-based and transparent, and it should take a total product lifecycle perspective. Applied to the rebuild rule, each principle turns a sentence into a procedure (Figure 1).

Applying the principles to the rebuild rule

Focused and bounded. The principles keep a plan within the device’s intended use and ask for ways to detect, and to revert or stop, a change that misses its performance criteria. Tessaly’s plan would name what may change, namely the underlying model and the way it is trained on Vollmer’s record, and what may not: the stand-in’s declared role, its reach limited to matters the operators judge urgent, the labels on its rulings and the precedence of her religion over the mission. The current model stays ready to restore if a switch goes wrong.

Risk-based. Testing scales with the stakes. An overnight ruling on a pump alert carries more risk than the date of a members’ meeting, so the plan can demand more evidence for the categories of ruling that matter most, and it can track the cumulative effect of successive rebuilds, not only the latest one.

Evidence-based. “At least as well” needs a metric fixed before testing. The plan could hold back part of Vollmer’s record, decisions the candidate never sees in training, and score the current model and the candidate on how often each reproduces what she decided and the reasons she gave. The principles ask for methods that show benefits and risks before and after a change, and this is that method for a stand-in. Contocracy’s canon does not fix the metric, the margin or the share of the record held back; those points are open.

Transparent. Members already know that the stand-in, not Vollmer, is deciding. A plan extends that disclosure in the way device labeling does: each ruling names the model version that issued it, and the version history, the test results and the date of any switch are published to members.

Total product lifecycle. After a switch, the plan monitors the new model’s rulings and reverts if they drift. Here the analogy strains. A device maker gathers new real-world data, but Vollmer’s record stopped growing at her death, so the benchmark for every future rebuild is fixed.

Objections and open questions

Consent. Hospitals that join Tessaly after Vollmer’s death never chose her, and patients affected by its alerts never chose anyone. Device users do not consent to each change under a PCCP either; FDA’s authorization stands between them and the manufacturer. Contocracy puts no regulator in that seat, and whether a published plan gives later members enough notice to make joining a real choice is open.

Oversight and contestation. FDA reviews a plan before authorizing it and can act after changes reach the market. Contocracy’s canon names the operators and the stand-in, but it does not say who reviews the operators’ urgency calls or the stand-in’s rulings, or how a member contests one. A network could add an internal panel or an outside auditor, but that would be its own addition rather than part of the form.

New circumstances. A model can reproduce Vollmer’s past decisions closely and still diverge on a device class that did not exist in her lifetime. A device plan handles this with its bounds: a change beyond the intended use needs a new submission. The rebuild rule has no equivalent step, because no one can supply new decisions by Vollmer. Whether matching the record is enough for decisions in new circumstances is open.

No verifiable return. If a return never becomes verifiable, the stand-in acts on urgent matters indefinitely, and the rebuild rule governs every model change for as long as the network lasts, against a benchmark that never grows. Canon does not say whether the plan itself may be revised over that time. That is open too.

A drafting exercise for regulatory professionals

Regulatory professionals write and review PCCPs as routine work, which puts them in a strong position to test contocracy’s rebuild rule: which metric should define “at least as well,” which bounds belong in the plan, and who should see the results. The exercise asks no one to endorse the form. Draft a change control plan for a contocrat’s stand-in, or find the gap in this one, and publish it. The term contocracy is new enough that the first careful analyses will shape how it is understood.

References

1. 21 U.S.C. § 360e-4 (section 515C of the Federal Food, Drug, and Cosmetic Act), Predetermined change control plans for devices. Legal Information Institute, Cornell Law School. https://www.law.cornell.edu/uscode/text/21/360e-4
2. U.S. Food and Drug Administration. Marketing Submission Recommendations for a Predetermined Change Control Plan for Artificial Intelligence-Enabled Device Software Functions. Final guidance; version dated August 2025. https://www.fda.gov/regulatory-information/search-fda-guidance-documents/marketing-submission-recommendations-predetermined-change-control-plan-artificial
3. U.S. Food and Drug Administration. Notice of availability of the final guidance. Federal Register 89 (December 4, 2024): 96259. https://govinfo.gov/content/pkg/FR-2024-12-04/pdf/2024-28361.pdf
4. U.S. Food and Drug Administration, Health Canada and Medicines and Healthcare products Regulatory Agency. Predetermined Change Control Plans for Machine Learning-Enabled Medical Devices: Guiding Principles. October 2023. https://www.fda.gov/medical-devices/software-medical-device-samd/predetermined-change-control-plans-machine-learning-enabled-medical-devices-guiding-principles

About the author

Nicolas Edward Pendland is an independent scholar in the United States who writes about forms of authority that new technology makes possible, including contocracy.

Independent scholar. Email: n.pendland@icloud.com. ORCID: https://orcid.org/0009-0003-0814-0796

Figure 1. The three parts of a predetermined change control plan, applied to contocracy’s rule for rebuilding the AI stand-in.

Disclosure: Claude Opus 5.5 (Anthropic) was used to draft the text and the figures from my concept and to check the sources it cites; I reviewed and approved the final text. Competing interests: I proposed the term contocracy. Funding: none.