What 21 CFR 892.2085 asks of one narrow device type, and why every radiology department should ask the same of any AI it buys
On October 30, 2026, the FDA published a final order in the Federal Register that most radiologists will never read [1]. It creates a new device category, "radiology software for referral of findings related to fibrotic lung disease," and places it in Class II with special controls. The new regulation is 21 CFR 892.2085.
It's a narrow rule about one kind of CT software. We think it's worth reading anyway, because the special controls in it are a clear, plain list of what good evidence for an imaging AI tool looks like. That list applies well beyond fibrotic lung disease.
What the order does
The category comes from a De Novo request. The FDA received it on June 29, 2022, and granted it on January 12, 2024 [1, 2]. The October 30 order codifies that classification in the Code of Federal Regulations [1].
That step matters for one reason. New devices with no predicate land in Class III by default, which means premarket approval. A granted De Novo creates a Class II category, and once it exists, later devices of the same type can use the 510(k) pathway with the first device as a predicate [1]. The FDA hasn't exempted this category from 510(k), so a premarket submission is still required [1].
The regulation defines the device as prescription image processing software that "analyzes computed tomography images to suggest the presence of disease or of an imaging finding suggestive of disease." Its output is "intended to be used as adjunctive information as part of a referral pathway in the overall diagnostic assessment process" [1].
Read that last line twice. The device supports a referral. It doesn't make a diagnosis. That's a narrower claim than a lot of marketing in this space.
The risks the FDA named
The order lists five risks to health and how each one is mitigated [1]:
- False positives that lead to wrong or delayed management of a patient whose fibrotic lung disease is actually a different entity.
- False negatives that lead to wrong or delayed management of a patient who does have fibrotic lung disease.
- Misuse on an unintended patient population, or on images from incompatible hardware or acquisition parameters.
- Misreading the output, or relying on it too much during image interpretation.
- Device failure: no result, a late result, or a wrong result.
The first three are handled by clinical performance testing, postmarket surveillance and labeling. The fourth is handled by labeling alone. The fifth is handled by software verification, validation and hazard analysis [1].
Number four is the one we think about most. Overreliance isn't a software defect. It's a workflow problem, and the FDA's answer is to tell the user clearly what the device does and doesn't do. That puts real weight on the label, and on whether anyone in the reading room ever sees it.
The special controls, in plain language
Here's what a device in this category has to show [1].
Performance against a real reference standard. The validation report has to describe the data, criteria and methods used to define the reference standard, and that standard has to be justified for the condition named in the indications.
A clinical comparison. Performance must be compared to an appropriate clinical control, such as clinicians doing the same task. A tool that looks good in isolation but adds nothing over a radiologist reading the same scan doesn't clear this bar on paper.
Pre-specified accuracy measures. Sensitivity, specificity, predictive values, ROC analysis and likelihood ratios have to be chosen before the analysis, not picked afterward.
Subgroups that are big enough to mean something. The test data has to include enough cases from important cohorts to characterize performance and confidence intervals for each one. The order lists demographics, confounders, effect modifiers, other diseases, challenging cases such as early disease, and subsets defined by image acquisition.
Software documentation. A detailed technical description of the algorithms, including inputs, outputs, each major component and model limitations.
Labeling that says where it fails. The label has to describe the clinical environment and intended workflow, compatible hardware and protocols, performance for each output with confidence intervals, and stratified sub-analyses. It also needs limiting statements: situations where the device may fail or underperform, such as poor image quality or certain subpopulations, plus any limitations in the training, tuning and test data.
Postmarket data that flows back into the label. Where FDA requires postmarket surveillance, the manufacturer has to summarize that data and update the labeling to reflect real-world performance on the timeline in the approved protocol. FDA can decide that postmarket data isn't required, based on the premarket evidence.
Why this is a buyer's checklist
None of these requirements is unusual. They're what a careful radiologist would want to know before letting any tool touch the worklist. What's useful is seeing them written down in one place by the agency.
In our experience, the evidence that reaches a department's AI committee often looks thinner than this. One headline AUC. One dataset. Few subgroups, and confidence intervals that are easy to miss. Little about the scanner fleet, the protocols, or the patient mix where the tool will actually run.
So here's how we'd use the order. Before go-live, ask the vendor for each item on the list:
- What reference standard did you use, and why is it right for this finding?
- How did the tool perform against radiologists reading the same cases?
- Which metrics did you pre-specify?
- Show us subgroup results with confidence intervals, including early disease and our scanner vendors and protocols.
- Where does it fail? What's missing from your training data?
- What are you collecting after deployment, and when does that change the label?
If a vendor can't answer those, that's useful information too.
What the order doesn't tell us
We want to be careful about what we're reading into this. The special controls apply to this one device type. Other categories have their own controls, and tools cleared through older pathways weren't necessarily held to this list. The order also doesn't say how well any device in this category performs. That lives in the device's own decision summary and labeling, which we haven't reviewed for this piece [2].
And codification is slow. This request was filed in June 2022, granted in January 2024, and written into the CFR in October 2026 [1, 2]. The device type was regulated as Class II the whole time after the grant. Still, more than four years from request to codified regulation is a long cycle in a field where models update much faster than that.
Where we sit
We build Portal at ApertureAI, a workflow that places AI-generated draft reports in PACS for a radiologist to review and sign. So weigh our bias here. We think the questions in this order are the right ones for any AI that touches a radiology report, including ours, and we'd rather be asked them than not.
The part we keep coming back to is the fourth risk: overreliance on the output. A label is one control. The workflow is another. A radiologist who reviews and signs every report is the last check, and the tool should make that review easier, not quieter.
A question for other radiologists
Which of these questions does your department ask before an AI tool goes live? And has anyone ever shown you subgroup confidence intervals for your own scanner fleet?
References
- U.S. Food and Drug Administration. Medical Devices; Radiology Devices; Classification of the Radiology Software for Referral of Findings Related to Fibrotic Lung Disease. Final amendment; final order. 21 CFR Part 892, Docket No. FDA-2026-N-12254. Federal Register, October 30, 2026. FR Doc. 2026-22180. https://www.federalregister.gov/d/2026-22180 (full text: https://www.federalregister.gov/documents/full_text/html/2026/10/30/2026-22180.html)
- U.S. Food and Drug Administration. De Novo Classification Request DEN220040 (Fibresolve; requester Imvaria, Inc.). Regulation 21 CFR 892.2085, product code QWO. Received June 29, 2022; granted January 12, 2024. FDA De Novo database. https://www.accessdata.fda.gov/scripts/cdrh/cfdocs/cfpmn/denovo.cfm?id=DEN220040