21 CFR § 892.2060 ("Radiological computer-assisted diagnostic software for lesions suspicious of cancer")

• Authority: Food and Drug Administration
• Parent authority: Federal government
• Jurisdiction: United States
• Collections: U.S. regulations, executive orders, and agency policies
• Most recent activity: Enacted
• Most recent activity date: 2020-01-22

Risk subdomain coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the risk subdomain are explicitly described.

• Unequal performance across groups
• Governance failure
• Lack of capability or robustness
• Lack of transparency or interpretability

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the risk subdomain are described.

• AI system security vulnerabilities

All other risk subdomains had no coverage in this document.

Risk Coverage Summary

The document has good coverage of approximately 3-4 subdomains, with strong focus on AI system safety failures (7.3, 7.4), unequal performance across groups (1.3), and governance failure prevention (6.5). Coverage is concentrated in system reliability, transparency, and performance equity domains.

Sector coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the sector are explicitly described.

• Health Care & Social Assistance

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the sector are described.

• Information
• Scientific Research & Development Services

All other sectors had no coverage in this document.

Sectors Summary

The document primarily governs the Health Care and Social Assistance sector, specifically regulating AI-based medical diagnostic devices used in radiological imaging for cancer detection. It also has secondary coverage of the Information sector through regulation of software development and the Scientific Research and Development Services sector through performance testing requirements.

Legislative Status

Hard Law

Legislative Status Summary

This is a binding federal regulation under the Code of Federal Regulations (CFR) with mandatory requirements for manufacturers of radiological computer-assisted diagnostic software, enforced by the FDA with legal penalties for non-compliance.

Actors

Proposer

• Entity Types: AI_Governance_Actor
• Entities: Food and Drug Administration (FDA)
• Summary: The document is a federal regulation (21 CFR § 892.2060) issued by the FDA, which has statutory authority to regulate medical devices under the Federal Food, Drug, and Cosmetic Act.

Target

• Entity Types: AI_Developer, AI_Deployer
• Entities: Manufacturers of radiological computer-assisted diagnostic software for lesions suspicious of cancer
• Summary: The regulation explicitly targets manufacturers who develop and seek to market radiological computer-assisted diagnostic software. These entities must comply with design verification, validation, and labeling requirements.

Enforcer

• Entity Types: AI_Governance_Actor
• Entities: Food and Drug Administration (FDA)
• Summary: The FDA has enforcement authority over medical device regulations through its statutory powers, including pre-market review, post-market surveillance, and enforcement actions for non-compliance with CFR requirements.

Monitor

• Entity Types: AI_Governance_Actor
• Entities: Food and Drug Administration (FDA)
• Summary: The FDA monitors compliance through its medical device regulatory framework, including review of performance testing protocols, software documentation, and post-market surveillance of device performance.

AI Lifecycle Stages

Lifecycle stages covered by the documents, as defined in the OECD Framework for the Classification of AI Systems

• Plan and Design
• Collect and Process Data
• Build and Use Model
• Verify and Validate
• Deploy
• Operate and Monitor

AI Lifecycle Summary

The document comprehensively covers multiple AI lifecycle stages with primary focus on Build and Use Model, Verify and Validate, and Deploy stages. It requires detailed algorithm documentation, performance testing, and validation protocols. The regulation also addresses ongoing monitoring through labeling requirements that specify performance limitations and failure conditions.

Technical Scope

Terms relating to technical scope that are mentioned or implicitly referenced in the document

• AI Models
• AI Systems
• Predictive AI
• Task-specific AI

Technical Scope Summary

The document explicitly addresses AI systems (radiological computer-assisted diagnostic software) and AI models (image analysis algorithms). It focuses on task-specific/narrow AI for medical image analysis and predictive AI for lesion characterization. No mention of frontier AI, general purpose AI, foundation models, generative AI, open-weight models, or compute thresholds.