Part of the AI Regulation News hub.
CMS and the CDC are asking whether facilities that only interpret data, including medical device software manufacturers, need a CLIA certificate, and how laboratories verify the performance of AI tools
The CLIA regulations were implemented in 1992. The question CMS is now asking is whether a company that never touches a specimen, and only interprets genetic data or digital images, is running a clinical laboratory.
Bottom line: A request for information, not a rule. Responses may inform what action, if any, CMS and the CDC take to update the CLIA regulations through future notice and comment rulemaking. Two of its sections go directly to AI: postanalytic interpretation using AI, and whether data-only facilities require a CLIA certificate.
Who this affects: Clinical laboratories and pathology groups, digital pathology and radiogenomics vendors, developers of AI interpretation software and medical device software manufacturers, laboratory directors responsible for performance verification, and health-system counsel advising on CLIA certification.
Issue date: Published 16 July 2026 at 91 FR 43586. To be assured consideration, comments must be received by 14 September 2026, referring to file code CMS-3485-NC.
What changed: Nothing yet. This is an information-gathering step. Its significance is that CMS has put the data-only certification question, which it says it has received inquiries about, into a public docket.
Analysis: Section 7 is the one to answer. If a facility that only processes analytical data or provides specialised data interpretation is a laboratory under 42 CFR 493.2, then AI interpretation businesses acquire a certification regime, proficiency testing and personnel requirements they may currently be operating without. If it is not, the interpretive step in an AI-assisted diagnostic sits outside CLIA entirely. CMS is asking which.
Primary sources: Request for Information, official GPO text (91 FR 43586) · Same document, GPO PDF
- Instrument
- Request for Information; Clinical Laboratory Improvement Amendments of 1988 (CLIA) Regulations
- Authority
- Centers for Medicare & Medicaid Services and Centers for Disease Control and Prevention, Department of Health and Human Services
- Citation
- 91 FR 43586, pages 43586 to 43591, published 16 July 2026
- Regulatory identifiers
- 42 CFR Part 493; file code CMS-3485-NC; RIN 0938-AW01
- Jurisdiction
- United States, federal
- Status
- Request for information. Open.
- Bindingness
- None. An RFI creates no obligation. Responses may be used to inform whether the CLIA regulations are updated through future notice and comment rulemaking.
- Issue date / next deadline
- Published 16 July 2026. Comments must be received by 14 September 2026 to be assured consideration.
- Scope of the RFI
- Breath testing; laboratory processes and procedures; emergency preparedness, biosafety and biosecurity, and cybersecurity; and specialty testing areas
- Editorial Note
- Informational analysis for working professionals, not legal advice. Confirm how any rule applies to your situation with qualified counsel.
- Primary source
- https://www.govinfo.gov/content/pkg/FR-2026-07-16/html/2026-14358.htm
The question that matters most to AI companies
Section 7 of the RFI is headed Data-Only Facilities, and it is the part of this document with the largest commercial consequence.
The starting point is the definition. Section 493.2 of the CLIA regulations defines a laboratory as a facility for the biological, microbiological, serological, chemical, immunohematological, hematological, biophysical, cytological, pathological, or other examination of materials derived from the human body, for the purpose of providing information for the diagnosis, prevention or treatment of any disease or impairment, or the assessment of health.
Against that definition CMS records a development: facilities that only process analytical data or provide specialised data interpretation, some of which may be manufacturers of medical device software, have emerged. It says it has received inquiries on whether these types of data-only facilities require a CLIA certificate, and that those inquiries have focused in part on facilities that review and interpret genetic data, review and interpret digital images, and perform calculations of risk factors.
The question it asks is narrow and answerable: what activities do data-only facilities perform to generate, or help to generate, test results and interpretations?
That is precisely the description of a large part of the clinical AI sector. Anyone whose product interprets a slide image, a variant call file or a risk model output, without ever handling a specimen, is being described here.
The AI questions in the testing process
Section 6 is headed Postanalytic Interpretation and Use of Artificial Intelligence. CMS says it has received multiple inquiries about which postanalytic activities it considers part of the testing process, and observes that test systems are becoming increasingly complex and integrated with advanced technology and AI systems.
It also notes the overlap with a different regime: certain software and software functions are subject to regulation as medical devices under the Federal Food, Drug, and Cosmetic Act. The RFI does not attempt to resolve the boundary; it asks about it.
Five specific questions follow. How does the laboratory use software algorithms or AI tools in the postanalytic process. Under what circumstances are software functions, including certain AI tools, used to interpret test results, giving next generation sequencing, histocompatibility and pharmacogenomics as examples. What roles do software functions play in interpreting histopathology slides or results.
The fourth question is the operational one: what methods do laboratories use to verify the performance of the software functions used with a test system, including image resolution accuracy and quality, AI tools, and the performance of computers and monitors. That is a request for the current state of practice in validating an AI tool inside a regulated testing workflow.
The fifth asks whether there are additional technology considerations for high complexity tests, including laboratory use of automation, cloud analytics and artificial intelligence, that CMS and the CDC should consider incorporating into the CLIA regulations.
Why a 1992 regulation is the pressure point
The RFI's own framing is that clinical laboratory testing technology has advanced significantly since the CLIA regulations were implemented in 1992, and that it seeks input on whether and how those regulations should be updated.
CLIA's architecture assumes a physical laboratory: specimens, instruments, personnel qualifications tied to test complexity, proficiency testing. The interpretive step was historically performed by a person inside that facility. Distributive testing, also defined in section 493.2, already contemplates a specimen being shared between laboratories holding different certificates.
What it does not obviously contemplate is an interpretive step performed by software at an organisation that receives only data. The RFI's data-only section is CMS noticing that gap out loud.
The two possible answers have opposite consequences. Treating such facilities as laboratories brings certification, personnel and quality requirements to firms that may currently regard themselves as software vendors. Treating them as outside CLIA leaves the interpretation of genetic data and digital images governed by device regulation and contract, but not by the laboratory quality regime that governs the test it forms part of.
What to file, and the date to work to
Comments must be received by 14 September 2026 to be assured consideration, referring to file code CMS-3485-NC. The RFI sets out three permitted submission routes and asks commenters to choose only one.
The most useful responses will be descriptive rather than positional, because the questions are descriptive. CMS is asking what laboratories actually do: how AI tools are used postanalytically, how their performance is verified in practice, and what data-only facilities actually perform.
One date note. The Federal Register text sets 14 September 2026; the regulations.gov docket record displays 15 September. The published document governs, so work to 14 September.
Finally, note the modest framing of consequence. Responses may be used to help inform CMS and the CDC as to what types of action, if any, should be taken to update the existing CLIA regulations through future notice and comment rulemaking. Nothing changes on the strength of this document alone.
If your product interprets genetic data, digital images or risk calculations without receiving specimens, section 7 of this RFI is asking whether you are running a clinical laboratory. That question is open, CMS says it arose from inquiries it received, and it is on a public docket closing 14 September 2026. Two practical steps. Describe accurately, in a comment, what your facility actually does to generate or help generate results and interpretations, because the eventual boundary will be drawn from those descriptions. And separately, be ready to answer section 6's fourth question about how you verify the performance of AI tools, image resolution and display hardware inside a testing workflow, since that is the question most likely to become a requirement if the regulations are updated.
Source File
https://www.govinfo.gov/content/pkg/FR-2026-07-16/html/2026-14358.htm
Open the GPO text and confirm four things: the header showing 42 CFR Part 493 with file code CMS-3485-NC and RIN 0938-AW01, published 16 July 2026; the DATES line requiring comments by 14 September 2026; the section headed 6. Postanalytic Interpretation and Use of Artificial Intelligence (AI) with its five numbered questions; and section 7, Data-Only Facilities, which records the inquiries CMS has received about whether such facilities require a CLIA certificate.
Facilities that only process analytical data or provide specialized data interpretation, some of which may be manufacturers of medical device software, have emerged. CMS has received inquiries on whether these types of data-only facilities require a CLIA certificate. CMS and CDC, CLIA Request for Information, 91 FR 43586, 16 July 2026
FAQ
Does this change any CLIA requirement?
No. It is a request for information. CMS says responses may be used to help inform what types of action, if any, should be taken to update the existing CLIA regulations through future notice and comment rulemaking.
What is the data-only facilities question?
Whether facilities that only process analytical data or provide specialised data interpretation, some of which may be manufacturers of medical device software, require a CLIA certificate. CMS says the inquiries it received focused in part on facilities that review and interpret genetic data, review and interpret digital images, and perform calculations of risk factors.
What does CMS ask about AI specifically?
Five questions: how laboratories use software algorithms or AI tools postanalytically; when software functions including AI tools are used to interpret results, with NGS, histocompatibility and pharmacogenomics given as examples; what role they play in interpreting histopathology slides; how laboratories verify the performance of those software functions, image resolution and display hardware; and whether additional technology considerations for high complexity tests should be incorporated into the CLIA regulations.
How does this interact with FDA device regulation?
The RFI notes that certain software and software functions are subject to regulation as medical devices under the Federal Food, Drug, and Cosmetic Act. It does not resolve the boundary between that regime and CLIA; it asks for input on the use of AI-assisted interpretation in laboratories and the testing process.
When are comments due?
By 14 September 2026 to be assured consideration, referring to file code CMS-3485-NC. Note that the regulations.gov docket record displays 15 September; the Federal Register text governs.
Why now?
The RFI states that clinical laboratory testing technology has advanced significantly since the CLIA regulations were implemented in 1992, and seeks input across several areas including breath testing, laboratory processes and procedures, emergency preparedness, biosafety, biosecurity and cybersecurity, and specialty testing.
Related briefings
Sponsored Training
Practical AI training for regulated professionals, built around verification, documentation and a defensible process. See the courses.