CMS и CDC запрашивают мнения о модернизации правил CLIA для учета искусственного интеллекта и кибербезопасности

On July 16, 2026, the Centers for Medicare & Medicaid Services (CMS) and the Centers for Disease Control and Prevention (CDC) published a Request for Information (RFI) concerning potential updates to the Clinical Laboratory Improvement Amendments of 1988 (CLIA) regulations. The RFI (CMS-3485-NC) reflects the agencies’ effort to assess whether the CLIA framework should be updated to account for significant changes in laboratory technology, operations, and risk management since the regulations were implemented in 1992. Comments are due September 14, 2026. The agencies may use the responses to inform future notice-and-comment rulemaking or sub-regulatory guidance, but the RFI itself does not amend existing requirements. CMS and CDC explain that laboratory medicine has evolved substantially since the current framework was adopted. The RFI therefore seeks practical information from laboratories and other interested parties regarding four broad areas: (1) breath testing; (2) laboratory processes and procedures; (3) emergency preparedness, biosafety, biosecurity, and cybersecurity; and (4) specialty testing. This article focuses on the laboratory process, artificial intelligence (AI), data-only facility, performance-specification, and cybersecurity issues most likely to affect laboratory operations. - Laboratory Processes and Procedures In the commentary, CMS addresses several operational and technical issues, including: retention of pathology specimen blocks beyond the current two-year minimum; specimen-preparation activities and the qualifications and competency of personnel performing them; testing and reporting of suboptimal specimens; calibration verification for factory-calibrated, nonadjustable devices; artificial intelligence and software-assisted post-analytic interpretation; data-only facilities; and remote direct-observation competency assessments. - Artificial Intelligence and Data-Only Facilities The agencies are particularly interested in how laboratories use artificial intelligence , machine learning, and other software tools to interpret test results, verify software performance, and manage technologies such as automation and cloud analytics. As they noted, “CMS has received multiple inquiries regarding which post-analytic activities CMS considers part of the testing process. Test systems are becoming increasingly complex and integrated with advanced technology and AI systems.” Accordingly, CMS is seeking information about facilities that process analytical data, interpret genetic data or digital images, or calculate risk factors without handling physical specimens. Two issues are central: (1) how laboratories use AI and software; and (2) what constitutes a laboratory or specimen, including where data analysis fits within the current regulatory framework. These questions concern how CLIA should apply when software materially influences the interpretation or reporting of laboratory information, even if the underlying analytical testing occurs elsewhere. The RFI continues a policy discussion developed by the 2022 CLIA Regulations Assessment Workgroup of the Clinical Laboratory Improvement Advisory Committee (CLIAC). The workgroup examined where CLIA oversight should begin and end within the total testing process, how CLIA should address AI and other emerging technologies, whether data and digital images should qualify as materials derived from human specimens, and whether entities providing informatics or interpretive services should be subject to CLIA when they do not handle physical specimens. The workgroup recognized that AI may influence test selection, analytical processing, image analysis, variant classification, result interpretation, and reporting. It also observed that the definition of a test system may need to encompass an algorithm or software component that helps generate a test result or information used for a clinical decision. The RFI now gives stakeholders an opportunity to explain which AI activities should fall within CLIA, when an algorithm should be considered part of a regulated test system, and how oversight should apply when separate entities perform different parts of an integrated testing workflow. The workgroup also distinguished between static and adaptive AI. Static models may fit within the current framework if laboratories appropriately validate them and revalidate material changes. Adaptive models, by contrast, may require continuing revalidation or specifically defined quality-control and proficiency-testing requirements because their performance can change as they receive new data. CMS and CDC are now seeking information that could translate those concerns into workable requirements for initial validation, change control, re-verification, and continuing oversight. Commenters may wish to address how laboratories should establish baseline performance, define material changes, detect performance drift, set monitoring intervals and acceptance thresholds, investigate anomalous results, and determine when an AI tool should be corrected, retrained, revalidated, or removed from clinical use. Professional laboratory organizations have emphasized that oversight should be proportionate to an AI tool’s intended use and potential effect on patient care. Tools that directly influence diagnosis, treatment, risk classification, or test interpretation may warrant more rigorous validation, transparency, and monitoring than software used only for administrative or operational functions. Consistent with this risk-based approach, modernization of CLIA could build upon laboratories’ existing quality-management responsibilities rather than establish a separate, duplicative oversight framework. Any updated requirements may also start delineating the respective responsibilities of laboratories, software developers, vendors, contractors, and health care organizations for implementation, validation, updates, corrective action, and ongoing monitoring. The RFI’s questions about facilities that analyze data without handling physical specimens also echo the workgroup’s consideration of “data as a specimen.” The workgroup agreed that images and data may constitute materials derived from the human body and supported CLIA oversight of sites that perform informatic analysis or interpretation for patient care. Comments responding to the RFI can help CMS and CDC determine when a remote location should be treated as an extension of an existing laboratory, when a contractor or software company should be independently regulated, and how responsibility should be allocated across a distributed testing process. These questions are especially important for next-generation sequencing, digital pathology, and other services in which cloud-based tools or outside organizations may perform bioinformatic processing, variant classification, image analysis, or other steps that materially affect the reported result. Stakeholders may also wish to address vendor qualification, contractual access to validation information, audit rights, software-version controls, incident reporting, data integrity, and the laboratory director’s ability to investigate errors across the entire workflow. Data quality and harmonization are central to reliable AI performance. The 2022 workgroup also identified personnel qualifications and competency as areas requiring modernization. It considered whether CLIA should recognize emerging roles such as data scientists, bio-informaticians, variant scientists, image technicians, and other professionals who perform or support post-analytic data analysis. The workgroup recommended broadly defining new personnel roles and establishing appropriate education, training, and competency expectations. Comments on the RFI may help CMS and CDC determine which AI-related activities require qualified laboratory personnel, what expertise laboratory directors need to oversee those activities, and how laboratories should assess competency when work is performed remotely or by an outside entity. The workgroup further observed that proficiency testing may need to extend across a distributed testing process so that quality is evaluated through data transfer, algorithmic analysis, interpretation, and reporting and not solely at the site performing the physical assay. The RFI therefore moves the discussion from the conceptual and technical concerns examined by the 2022 CLIAC workgroup toward possible regulatory policy. It allows laboratories, professional organizations, developers, vendors, and data-analysis entities to explain how the workgroup’s recommendations could function in practice. Detailed comments can help CMS and CDC determine how CLIA can support responsible innovation while ensuring that AI-assisted laboratory services remain accurate, reliable, equitable, secure, transparent, and subject to appropriate professional and regulatory oversight. - What Laboratories Should Consider Now The RFI devotes specific attention to the establishment of performance specifications for tests that are not cleared or approved by the Food and Drug Administration (FDA), including modifications to FDA-cleared or approved test systems. CMS and CDC ask laboratories to identify technical challenges, test-specific acceptance criteria, performance characteristics not adequately addressed by existing regulations or guidance, in-house reagent practices, and common modifications to FDA-authorized systems. The RFI asks whether methods such as toxicology and next-generation sequencing present unique characteristics that warrant additional regulatory treatment. Examples include stability, carry-over, internal standards, ionization, and clinical validity. Responses could influence how CMS approaches laboratory-developed tests, modified test systems, and emerging methodologies in future policy. - Cybersecurity Moves to the Forefront of Laboratory Oversight The RFI recognizes the growing reliance on laboratory information systems, electronic health record integrations, automated diagnostic devices, and remote access. It asks about access controls, user verification, access from outside the United States and its territories, restrictions on ports and internet protocol addresses, incident-response planning, personnel responsibilities, training, and laboratories’ experiences managing cyber threats. Respondents are cautioned not to submit proprietary or confidential information. Comments may be submitted electronically through regulations.gov under docket CMS-2026-2345, or by one of the mail methods specified in the notice. Commenters should use file code CMS-3485-NC, and select only one submission method. Because submitted comments generally will be made publicly available, commenters should avoid including personally identifiable, proprietary, or confidential business information. What Laboratories Should Consider Now The RFI does not change laboratories’ current CLIA obligations, but it continues a long-running debate over the scope and modernization of laboratory oversight. Laboratories may wish to review their experience with the technologies and operational issues identified in the RFI, coordinate input from technical, quality, compliance, information-security, and clinical personnel, and consider submitting comments by September 14, 2026. The breadth of the RFI suggests that CMS and CDC are evaluating substantial modernization of the CLIA framework. Laboratories and other stakeholders now have an opportunity to help shape how future requirements address emerging technologies while preserving the accuracy, reliability, and safety of clinical testing.