Other BriefingsCDSCO Moves to Regulate Medical Device Software in India: Key Takeaways
The Central Drugs Standard Control Organization (CDSCO) has released a Draft Guidance on Medical Device Software to establish a clear and predictable regulatory framework for software-based medical devices. This includes artificial intelligence (AI)-enabled, cloud-hosted, and network-based applications. The initiative signals toward aligning India’s digital health regulations with international standards and addressing long-standing ambiguities in compliance and oversight.
Regulatory background and objective
Under the Medical Device Rules (MDR), 2017, software that performs a medical function is already classified as a medical device. However, the existing framework lacks detailed direction on software-specific aspects such as risk classification, licensing, validation, cybersecurity, and post-deployment updates. This regulatory gap has made it challenging to evaluate digital health solutions, ranging from AI-driven decision support systems to standalone mobile health applications.
To close these gaps, CDSCO released the Draft Guidance on Medical Device Software on October 21, 2025. The document distinguishes between:
- Software in a Medical Device (SiMD): Software embedded in and inseparable from a physical medical device.
- Software as a Medical Device (SaMD): Standalone software that performs a medical purpose on its own or alongside hardware.
This distinction is critical for improving regulatory clarity and advancing India’s goal of building a globally competitive, innovation-driven MedTech ecosystem.
Scope and classification framework
The draft applies to software that meets the MDR definition of a medical device, i.e., a device used for diagnosis, prediction, prevention, monitoring, or treatment. Administrative and nonclinical software, such as hospital billing or appointment management systems, will remain outside the regulatory scope.
Medical Device Software (MDS) will be classified into four risk categories—Class A (low risk), Class B (low-to-moderate risk), Class C (moderate-to-high risk), and Class D (high risk).
|
Risk class |
Level of risk |
Description and examples |
|
Class A |
Low risk |
Devices with minimal potential for harm to patients. Typically used for routine monitoring or support functions where incorrect operation poses little risk. Examples: digital thermometers, stethoscopes, or basic health monitoring software. |
|
Class B |
Low to moderate risk |
Devices that have a slightly higher risk if they malfunction but are not critical to sustaining life. Examples: diagnostic ultrasound equipment, infusion pumps, or basic imaging analysis software. |
|
Class C |
Moderate to high risk |
Devices that play a key role in diagnosis or therapy where errors could result in serious injury or health deterioration. Examples: ventilators, MRI scanners, or AI-based diagnostic software for detecting diseases. |
|
Class D |
High risk |
Devices that are life-supporting, life-sustaining, or used in critical care, where malfunction may lead to death or irreversible harm. Examples: implantable defibrillators, pacemakers, or advanced AI-driven diagnostic tools for life-critical conditions. |
Software embedded in medical hardware will assume the same classification as the device it controls, while standalone medical software will be categorized based on the clinical importance of its output and the severity of the healthcare context in which it operates.
By adopting an approach consistent with frameworks used by the International Medical Device Regulators Forum (IMDRF) and the EU Medical Device Regulation (EU MDR), India aims to enhance regulatory predictability and international alignment.
Quality and compliance requirements
The guidance requires manufacturers and importers to implement a comprehensive Quality Management System (QMS) that covers the entire software lifecycle, from design and development to post-market monitoring and updates. Compliance should align with relevant Bureau of Indian Standards (BIS), International Organization for Standardization (ISO), or International Electrotechnical Commission (IEC) standards, ensuring that quality assurance is integrated into each stage of production.
Indian manufacturers must provide evidence of QMS implementation when applying for licenses, while importers must demonstrate that overseas facilities follow equivalent practices. This consistent application of quality standards is intended to strengthen accountability and enhance patient safety in India’s MedTech sector.
ALSO READ: BIS Certification in India 2025: A Comprehensive Guide for Foreign Manufacturers
Licensing and documentation process
Licensing procedures under the draft follow the existing structure of the MDR. Software classified as Class A or B will be licensed by state licensing authorities, while Class C and D software will fall under the purview of CDSCO’s Central Licensing Authority. Applications must be submitted through digital platforms such as the National Single Window System (NSWS) for test licenses and the CDSCO Medical Device Online Portal for manufacturing and import approvals; click here: www.cdscomdonline.gov.in .
The draft also provides documentation templates and submission checklists to help companies streamline compliance and reduce administrative delays, a critical step towards promoting regulatory efficiency and transparency.
Post-market oversight and algorithmic accountability
A major focus of the draft is the post-market surveillance of software-based devices. Manufacturers will be required to maintain performance records, conduct ongoing safety evaluations, submit periodic safety update reports, and report cybersecurity vulnerabilities.
Additionally, the draft introduces an Algorithm Change Protocol for software using artificial intelligence or machine learning. This requires developers to document and validate any algorithmic updates, such as model retraining, and to communicate these changes to regulators. Such measures are critical to ensuring patient safety and regulatory confidence in adaptive, data-driven medical systems.
ALSO READ: Incorporating a Healthcare Business in India: NABH Standards, FDI, and Compliance
Conclusion
The CDSCO’s draft guidance marks an important step toward modernizing India’s MedTech regulatory environment. It enhances clarity, aligns national standards with international best practices, and balances innovation with patient protection.
However, its success will depend on proportionate enforcement across risk categories, clear operational guidelines to prevent inconsistent interpretation, and realistic transition timelines for industry adaptation. Additional regulatory attention may also be needed for evolving areas such as adaptive AI and remote digital health technologies.
If implemented effectively, the framework could strengthen regulatory predictability, attract foreign investment, and position India as a competitive hub for AI-driven medical software innovation, advancing India’s broader vision for a robust, technology-enabled healthcare ecosystem.
About Us
India Briefing is one of five regional publications under the Asia Briefing brand. It is supported by Dezan Shira & Associates, a pan-Asia, multi-disciplinary professional services firm that assists foreign investors throughout Asia, including through offices in Delhi, Mumbai, and Bengaluru in India. Dezan Shira & Associates also maintains offices or has alliance partners assisting foreign investors in China, Hong Kong SAR, Vietnam, Indonesia, Singapore, Malaysia, Mongolia, Dubai (UAE), Japan, South Korea, Nepal, The Philippines, Sri Lanka, Thailand, Italy, Germany, Bangladesh, Australia, United States, and United Kingdom and Ireland.
For a complimentary subscription to India Briefing’s content products, please click here. For support with establishing a business in India or for assistance in analyzing and entering markets, please contact the firm at india@dezshira.com or visit our website at www.dezshira.com.
- Previous Article India’s Services Sector Performance and Contribution to GDP in 2025: An Overview
- Next Article Eli Lilly’s Mounjaro Tops India’s Drug Sales – What It Reveals About the Country’s Health Market
