The Governance Gazette

CMS-3485-NC (RIN 0938-AW01) — a Request for Information on the Clinical Laboratory Improvement Amendments of 1988 (CLIA) regulations at 42 CFR part 493, issued jointly by CMS and the CDC and published in the Federal Register on July 16, 2026 at 91 FR 43586–43591. Comments are due September 14, 2026, to docket CMS-2026-2345.

It is pre-rulemaking. In the notice’s own words, responses “may be used to help inform CMS and the CDC as to what types of action, if any, should be taken to update the existing CLIA regulations through future notice and comment rulemaking.” The agencies add that CMS “will not respond to questions about the policy issues raised in this RFI.” The document was approved by CMS Administrator Mehmet Oz on July 8, 2026 and by Jay Bhattacharya for the CDC on July 13, 2026, and signed by HHS Secretary Robert F. Kennedy, Jr.

The SUMMARY, verbatim and complete as to scope: this RFI “seeks input from the public regarding various topics related to the CLIA regulations, including: breath testing; laboratory processes and procedures; emergency preparedness, biosafety and biosecurity, and cybersecurity; and specialty testing areas.” Four topics. Artificial intelligence is in none of them, and the word does not appear on the notice’s first page.

It appears on page 43588, as subsection 6 of topic B, under the heading “Postanalytic Interpretation and Use of Artificial Intelligence (AI).” The framing sentence explains why it is there at all: “CMS has received multiple inquiries regarding which postanalytic activities CMS considers part of the testing process.” The five questions, verbatim:

• “How does the laboratory use software algorithms or AI tools in the postanalytic process?”
• “Under what circumstances are software functions, including certain AI tools, used for the interpretation of the results of a test? For example, NGS, histocompatibility, and pharmacogenomics testing.”
• “What roles do software functions, including certain AI tools, currently play in the interpretation of histopathology slides or results?”
• “What methods do laboratories use to verify the performance of the software functions (including image resolution accuracy and quality, and AI tools as well as the performance of computers and monitors) used with a test system?”
• “Are there additional technology considerations for high complexity tests, including but not limited to laboratory use of automation, laboratory use of cloud analytics, and laboratory use of artificial intelligence, that CMS and the CDC should consider incorporating into the CLIA regulations?”

What that means. The tempting read is that CLIA says nothing about AI. That read is wrong, and the accurate one is more interesting. CLIA already assigns responsibility for the postanalytic phase — to a named human. Under 42 CFR 493.1445(e)(1), the laboratory director must “ensure that testing systems developed and used for each of the tests performed in the laboratory provide quality laboratory services for all aspects of test performance, which includes the preanalytic, analytic, and postanalytic phases of testing.” An AI-assisted interpretation is squarely inside “all aspects of test performance.” Someone is already accountable for it.

What is missing is not accountability. It is method — any language in which that accountability could be discharged and then surveyed. Three provisions show the gap:

• The verification metrics are analyte metrics. § 493.1253(b)(2) tells a laboratory introducing a test system not cleared by FDA to establish “accuracy… precision… analytical sensitivity… analytical specificity to include interfering substances… reportable range of test results for the test system… reference intervals (normal values).” Those are measurements of a substance. A classifier that scores a slide has no reportable range and no interfering substances, and its errors are not analytical.
• “Test system” is defined in wet-bench nouns. § 493.2: “Test system means the instructions and all of the instrumentation, equipment, reagents, and supplies needed to perform an assay or examination and generate test results.” Software is neither named nor excluded — which is precisely the ambiguity generating the inquiries CMS cites.
• The only postanalytic standard is a plumbing standard. § 493.1291 requires an “adequate manual or electronic system(s)… to ensure test results and other patient-specific data are accurately and reliably sent from the point of data entry… to final report destination,” and requires the report to carry “the test result and, if applicable, the units of measurement or interpretation, or both.” The interpretation must arrive intact. Nothing addresses how it was produced.

The sleeper is the next subsection. B.7, “Data-Only Facilities,” asks whether organizations that “only process analytical data or provide specialized data interpretation, some of which may be manufacturers of medical device software” require a CLIA certificate at all — naming facilities that “review and interpret genetic data, digital images, and perform calculations of risk factors.” That is the AI-vendor question without the acronym. And the answer is not obvious on the face of the rule, because § 493.2 defines a laboratory as a facility for the examination of “materials derived from the human body” — while a data-only facility examines a file. Whichever way that resolves decides who holds the duty: give such a facility a certificate and it acquires a laboratory director, proficiency testing, and personnel standards of its own; leave it outside, and the whole burden stays with the ordering laboratory’s director under § 493.1445(e)(1), for a system built somewhere else.

The jurisdictional context is one sentence in the RFI and two years of litigation behind it. The notice observes only that “Certain software and software functions are subject to regulation as medical devices under the Federal Food, Drug, and Cosmetic Act.” What it does not recount is that the adjacent pathway just contracted. FDA’s May 6, 2024 rule on laboratory developed tests (89 FR 37286) added the words “including when the manufacturer of these products is a laboratory” to 21 CFR 809.3(a); on March 31, 2025 the Eastern District of Texas, in Am. Clinical Lab’y Ass’n v. FDA, No. 4:24-CV-479-SDJ, vacated and set that rule aside; and FDA removed the words from the CFR effective September 19, 2025. The device route to laboratory-built diagnostics narrowed; this RFI asks whether the certificate route should widen.

DIRECT for CLIA-certified laboratories performing nonwaived testing — reference and hospital laboratories, pathology and molecular groups, and the software firms that sell into them. Both subparts these questions live under are scoped by their own titles: subpart K is the “Quality System for Nonwaived Testing” and subpart H is “Participation in Proficiency Testing for Laboratories Performing Nonwaived Testing.” Question 5 narrows further still, to “high complexity tests.”

INDIRECT for skilled-nursing, senior-living, and post-acute operators — and the honest version of that call matters. A facility whose own CLIA enrollment is a certificate of waiver sits outside every question in subsection 6, because waived testing is outside subpart K entirely. Roughly four in five registered laboratories are in exactly that position (see below). The exposure is not the operator’s certificate; it is the reference laboratory’s. The pathology, molecular, and genetic reports that arrive from outside — increasingly with a software-assisted interpretation somewhere in their lineage — are produced under the rules this RFI would rewrite. Operators like these are downstream consumers of whatever standard emerges, not subjects of it, and the practical question for them is a vendor-diligence question, not a survey-readiness one.

NONE for the AI governance layer most healthcare organizations are actually building. This RFI does not touch clinical decision support in an EHR, ambient documentation, utilization-review algorithms, or any AI outside the laboratory testing process. A headline reading “CMS moves to regulate healthcare AI” would be describing a six-page notice about clinical laboratories.

Six of the RFI’s fifty-four questions — about one in nine — concern software, algorithms, or facilities that handle only data. None of the four headline topics names any of it.

Scale, from CMS’s own CLIA enrollment table (the edition served at the CLIA statistics page is dated March 2024; CMS has not posted a newer one at that address):

The four certificate types sum exactly to the non-exempt total. 244,791 of 303,010 — 80.8% — hold a certificate of waiver and are therefore outside subparts K and H by those subparts’ own terms. 58,219 laboratories perform some nonwaived testing and sit inside them. The population that could feel a new AI-validation standard is the smaller number, and the high-complexity subset of it is smaller again.

• September 14, 2026 is the whole hook. An RFI is the cheapest point of influence in the rulemaking cycle and the only one that precedes a drafted text. It is also exempt from the Paperwork Reduction Act as a general solicitation, which is why it can ask fifty-four open questions at once — and why nothing in it binds anyone. Laboratory associations, pathology societies, and diagnostic-software vendors are the constituencies with the most at stake; 125 comments were posted as of August 19.
• Question 4 quietly puts hardware in scope. It asks how laboratories verify “image resolution accuracy and quality… as well as the performance of computers and monitors.” A display- and workstation-qualification requirement for digital pathology is the least conceptually difficult thing in this subsection to write into a regulation, and the most operationally expensive to sustain — periodic monitor calibration, documented, across every reading station, forever.
• Question 5 is the hinge. The phrase is “should consider incorporating into the CLIA regulations.” Everything before it is fact-finding; that clause is the one asking whether a rule should exist. Comments that answer only the first four questions concede the fifth by default.
• Proficiency testing is the structural obstacle nobody has to name. Under § 493.801 a laboratory enrolls in PT “for each of the specialties and subspecialties for which it seeks certification” and must “test the samples in the same manner as patients’ specimens.” There is no specialty for algorithmic interpretation and no sample that exercises one. Section D of the same RFI separately asks whether new specialties should be added — which is the mechanism by which the AI question could quietly acquire an answer.
• Watch the advisory committee, not the press release. The RFI twice grounds a proposal in a CLIAC recommendation — November 2023 on blood-culture contamination monitoring, November 2024 on remote competency assessment. That is the visible route by which an idea in this notice becomes a proposed rule, and it meets in public.
• What would actually be new. Not oversight of AI in the laboratory — § 493.1445(e)(1) already reaches it. What a rule would add is a defined validation method, and with it a survey citation, a deficiency, and a plan of correction. That is the difference between a duty and an enforceable one, and it is what these five questions are really about.

• Request for Information; Clinical Laboratory Improvement Amendments of 1988 (CLIA) Regulations, CMS-3485-NC, 91 FR 43586, July 16, 2026 · full text · docket CMS-2026-2345
• 42 CFR 493.2 — definitions of “laboratory,” “test system,” and “distributive testing”
• 42 CFR 493.1253 — establishment and verification of performance specifications
• 42 CFR 493.1291 — test report · 42 CFR 493.1445(e) — laboratory director responsibilities
• 42 CFR 493.801 — proficiency testing enrollment
• Medical Devices; Laboratory Developed Tests; Implementation of Vacatur, 90 FR 45134, September 19, 2025 — FDA’s removal of the vacated LDT rule text from 21 CFR 809.3(a)
• CLIA enrollment statistics (CMS Division of Clinical Laboratory Improvement and Quality; served edition dated March 2024)