CDSCO issues guidance clarifying regulatory pathway for AI, software-based medical devices
The Central Drugs Standard Control Organisation (CDSCO) issued a guidance document clarifying how software-based medical devices, including AI-enabled products, are to be regulated under the Medical Devices Rules (MDR), 2017.
The guidance formally distinguishes between two categories: Software in a Medical Device (SiMD) — code embedded in and inseparable from a physical device — and Software as a Medical Device (SaMD) — standalone software performing a medical function on its own, such as diagnostic apps, AI-based imaging tools, and clinical decision-support systems.
It lays out a risk-based classification approach for SaMD based on the software's medical purpose, the significance of the information it provides for clinical decisions, and the severity of the condition being addressed.
The document follows a draft version released for stakeholder consultation and has been revised based on feedback, giving manufacturers and innovators clearer compliance requirements around usability validation, risk management, AI bias assessment, cybersecurity, and clinical performance evaluation.
Medical Devices Rules (MDR), 2017
The Medical Devices Rules, 2017, notified by the Ministry of Health and Family Welfare, regulate the manufacture, import, sale, and distribution of medical devices in India. Medical devices are currently regulated as "drugs" under the Drugs and Cosmetics Act, 1940, with the MDR, 2017 as the specific rules framework — India does not yet have a standalone Medical Devices Act, a long-pending demand from the industry.
Key Details
- MDR, 2017 came into force on January 1, 2018, and adopts a risk-based, four-tier classification system for devices: Class A (low risk), Class B (low-moderate risk), Class C (moderate-high risk), and Class D (high risk) — modelled on the Global Harmonization Task Force (GHTF)/International Medical Device Regulators Forum (IMDRF) framework.
- Licensing authority is split by risk class: the State Licensing Authority regulates Class A and B devices, while the Central Licensing Authority (CDSCO, headed by the Drugs Controller General of India, DCGI) regulates Class C and D devices and all software/AI-based devices with higher risk classification.
- CDSCO functions under the Directorate General of Health Services, Ministry of Health and Family Welfare, and is India's national regulatory authority for drugs and medical devices.
The new guidance operationalises the MDR, 2017's risk-based classification specifically for software, extending the same four-class (A–D) risk framework used for physical devices to SaMD — closing a regulatory gap where AI diagnostic tools and clinical software previously lacked clear classification criteria.
Software as a Medical Device (SaMD) and AI in Healthcare Regulation
SaMD is an internationally recognised regulatory category (coined by the IMDRF) for software that performs a medical function independent of any hardware device — e.g., AI algorithms that analyse radiology images, symptom-checker apps, or software predicting disease risk from patient data. Regulating SaMD is a global challenge because such software can be updated frequently (unlike physical devices) and may embed machine-learning models that evolve their own behaviour ("locked" vs "adaptive" algorithms).
Key Details
- The guidance requires AI-specific due diligence: bias assessment (checking whether training data underrepresents populations, skewing predictions), cybersecurity documentation, and clinical performance evaluation, in addition to standard usability and risk-management checks.
- Comparable frameworks exist internationally: the US FDA regulates SaMD/AI-based devices under its own risk-based framework with a specific pathway for adaptive AI algorithms; the EU regulates medical device software under the Medical Device Regulation (MDR 2017/745) and, separately, high-risk AI systems in healthcare will fall under the EU AI Act.
- India's approach keeps AI-enabled medical software within the existing Drugs and Cosmetics Act/MDR framework rather than creating a separate AI-specific law, unlike the EU's dedicated AI Act route.
This guidance is significant as India's clearest regulatory articulation yet for AI-driven health-tech products — a fast-growing sector — bringing clarity for start-ups and larger manufacturers on which risk class their software falls into and what evidence they must submit to CDSCO for approval.
- Medical Devices Rules (MDR), 2017 — notified under the Drugs and Cosmetics Act, 1940; in force since January 1, 2018.
- Four risk classes for devices and software: Class A (low), Class B (low-moderate), Class C (moderate-high), Class D (high risk).
- Central Licensing Authority (CDSCO/DCGI) handles Class C and D devices; State Licensing Authority handles Class A and B.
- Draft CDSCO Guidance Document on Medical Device Software was first released for public consultation in October 2025; the final/revised guidance followed stakeholder feedback.
- SiMD = software embedded in hardware (inherits hardware's risk class); SaMD = standalone software with its own risk-based classification.