One Word,Three Obligations
The Validation File
One Word, Three Obligations: Validation, Verification and Clinical Validity
First in a series on the evidence a clinical assay has to produce. Which obligation you are under is a question with a precise regulatory answer — and it determines the size of the study you are about to run.
Someone says the assay has been validated. Three quite different claims are hiding in that sentence, and they carry different study designs, different sample counts, and different documents at the end.
Choosing the wrong one is expensive in both directions. A laboratory that runs an establishment study when verification would have sufficed spends months it did not need to spend. A laboratory that does the reverse discovers the gap during an inspection, or during diligence, at the point where it is most costly to fix.
The first two turn on a single question: did you change anything?
CLIA does not use the word validation in this context. It uses two, and it draws the line between them sharply. Under 42 CFR 493.1253, a laboratory introducing an unmodified FDA-cleared or approved test system must verify performance specifications: demonstrate that it can obtain performance comparable to the manufacturer's for the specified characteristics, and confirm that the manufacturer's reference intervals suit its own patient population1.
A laboratory that modifies an FDA-cleared or approved test system, or introduces a test not subject to FDA clearance at all — including methods developed in-house — or uses a system for which the manufacturer supplies no performance specifications, must instead establish them. Seven characteristics are named: accuracy, precision, analytical sensitivity, analytical specificity including interfering substances, reportable range, reference intervals, and any other performance characteristic required for test performance1.
The asymmetry is the whole point. Verification is a comparison against a number somebody else already produced and defended. Establishment is an origination: you are the party asserting the number, and the evidence has to stand on its own. The work is not incrementally larger. It is a different kind of work.
“Modification” is broader than most teams assume
The word does most of the damage, because it sounds like it means altering the chemistry. It does not. CMS has stated plainly that running a sample type not listed in the FDA-cleared instructions for use is a modification, and requires establishment of performance specifications under 493.1253(b)(2)2. Nothing about the assay itself changed. The intended use did.
For sequencing work this is not an edge case, it is the normal case. Changing specimen type, altering extraction, running a kit on a platform it was not cleared for, adjusting a coverage threshold, substituting a caller, or reporting a region outside the cleared panel all move an assay from the first column to the second. Most clinical NGS is either an outright laboratory-developed test or a modified kit, which means most clinical NGS is on the establishment branch whether or not the team has framed it that way.
Two further points are worth holding onto. CMS describes the CLIA requirements as minimum requirements2 — your accreditor and your state may require more, and New York's programme in particular does. And a modification is also a personnel question: modified systems carry high-complexity testing requirements along with the analytical ones.
The third obligation is not in CLIA at all
Verification and establishment are both about analytical validity: whether the assay measures what it claims to measure, accurately and reproducibly. That is one of three questions in the framework the field has used since the CDC's ACCE project. Analytical validity asks whether the assay detects the variant. Clinical validity asks how well that variant corresponds to the condition, the risk, or the drug response. Clinical utility asks whether using the test improves outcomes3.
CLIA addresses the first. It does not address the second or the third4. FDA requires clinical validity for the tests it reviews; some states require evidence of it; and payers require utility in substance, whatever they call it, when they make a coverage decision.
The consequence is uncomfortable and worth stating directly: a laboratory can satisfy 493.1253 completely, pass inspection, and hold no documented evidence that a result means what its own report says it means. That is not a loophole. It is a division of labour between agencies, and it works reasonably well for assays whose clinical meaning was settled elsewhere in the literature. It works badly for a novel signature, a new algorithm, or a claim the laboratory is the first to make — which is precisely the situation of most companies building something new.
| Obligation | The question it answers | What you produce |
|---|---|---|
| Verify 493.1253(b)(1) |
Can we reproduce, in our hands, what the manufacturer established? | A comparison study against the manufacturer's stated specifications, plus a reference-interval check in your population |
| Establish 493.1253(b)(2) |
What is this assay's performance, asserted from scratch? | Seven characteristics, each with a pre-specified acceptance criterion and a study designed to test it |
| Clinically validate no CLIA citation |
Does the result correspond to the condition the report names? | Evidence linking result to phenotype, outcome or response — curated literature, a cohort, or a prospective study |
Where the seven characteristics strain
The list in 493.1253(b)(2) was written for analytes that have a concentration. Reportable range and reference intervals transfer awkwardly to a variant call, where the meaningful analogues are callable regions, coverage thresholds and limits of detection by variant class. The profession has filled much of that gap itself: the AMP and CAP joint recommendations on validating bioinformatics pipelines set out what the sequencing-specific version of this evidence looks like5, alongside the companion guidance for NGS oncology panels6.
The regulation has not caught up, and CMS knows it. In a request for information published in July 2026, CMS and the CDC asked which testing methods have performance characteristics not already addressed in the CLIA regulations — naming next-generation sequencing explicitly, and listing somatic and germline variants, minimal residual disease, methylation and resistance mutations as applications to consider. Among the example characteristics they offered was clinical validity itself. They also asked, directly, what kinds of modifications laboratories commonly make to FDA-cleared systems7.
The comment period closes on 14 September 2026. If your laboratory has struggled to map the seven characteristics onto a sequencing assay, the agency is currently asking you to describe how. That is a rarer opportunity than it sounds.
Why the FDA branch is quiet at the moment
Some of this ambiguity would have been resolved differently had FDA's 2024 rule survived. It did not: in March 2025 the Eastern District of Texas held that FDA exceeded its statutory authority and vacated the rule in its entirety, on the reasoning that laboratory testing is a professional service rather than a manufactured device8. The agency did not appeal.
So for a laboratory-developed test today, the operative framework is CLIA, plus your accreditor, plus your state — and the clinical-validity obligation stays where it has always awkwardly sat, with the laboratory director's professional judgement and with whoever is paying. This is the part of the piece most likely to age, so treat it as current rather than settled.
What goes in the file
- A written statement of which branch you are on, and why.One paragraph naming the test system, its regulatory status, every deviation from the instructions for use, and the resulting citation — 493.1253(b)(1) or (b)(2). This is the document that makes every later argument short.
- The validation plan, dated before the data.Characteristics to be established, sample counts, and acceptance criteria fixed in advance. Acceptance criteria written after the results are known are the single most common finding.
- The clinical validity evidence, held separately.Whatever supports the claim your report makes — curated literature, a cohort, guideline citations. Keep it apart from the analytical packet, because it answers to a different audience and will be requested by people who never read the other one.
Zetobit builds and validates clinical bioinformatics pipelines, and writes the validation documentation that goes with them. If you are unsure which branch your assay is on, that question is worth settling before the study design, not after. contact@zetobit.com
References
- 42 CFR § 493.1253 — Standard: establishment and verification of performance specifications. ecfr.gov
- Centers for Medicare & Medicaid Services. CLIA FAQs: post-PHE guidance. 2023. cms.gov
- ACCE model process for evaluating genetic tests. Office of Public Health Genomics, Centers for Disease Control and Prevention. cdc.gov
- How can consumers be sure a genetic test is valid and useful? MedlinePlus Genetics, National Library of Medicine. medlineplus.gov
- Roy S, Coldren C, Karunamurthy A, et al. Standards and guidelines for validating next-generation sequencing bioinformatics pipelines: a joint recommendation of the Association for Molecular Pathology and the College of American Pathologists. J Mol Diagn. 2018;20(1):4–27.
- Jennings LJ, Arcila ME, Corless C, et al. Guidelines for validation of next-generation sequencing-based oncology panels: a joint consensus recommendation of the Association for Molecular Pathology and College of American Pathologists. J Mol Diagn. 2017;19(3):341–365.
- Centers for Medicare & Medicaid Services and Centers for Disease Control and Prevention. Request for information; Clinical Laboratory Improvement Amendments of 1988 (CLIA) regulations. 91 FR 43586, 16 July 2026. federalregister.gov
- Congressional Research Service. District court rules FDA lacks authority to regulate laboratory developed tests. LSB11312, 2025. congress.gov