CDSCO issues guidance clarifying regulatory path for AI, software-based medical devices

The Central Drugs Standard Control Organization (CDSCO) guideline is intended to help manufacturers, importers, innovators and researchers prepare applications for regulatory approval from the licensing authority.

In a move to bring greater regulatory clarity and ensure patient safety, the Central Drugs Standard Control Organization (CDSCO) has released a guidance document for India’s fast-growing digital health sector detailing how software-based medical devices, including artificial intelligence (AI) products, will be regulated under the Medical Device Rules (MDR), 2017.

These guidelines are intended to assist manufacturers, importers, innovators and researchers in preparing applications for regulatory approval from the Licensing Authority. Applies to software products under the definition of a medical device. However, it does not apply to software intended solely for general well-being, promoting a healthy lifestyle, or measuring body parameters for regular tracking and fitness purposes only.

“This guidance document reflects current practices under MDR-2017 and should not be misconstrued as a new regulatory review of medical device software (MDSW), including in-vitro diagnostic (IVD) MDSW,” CDSCO said in its announcement.

CDSCO stated that the role of software in healthcare is increasingly critical as a diverse range of products serve various medical and administrative functions across clinical and private settings, and stated that any software, either alone or in combination, intended by a manufacturer for medical purposes and defined as a medical device under the Drugs and Cosmetics Act, 1940 and the Medical Device Rules, 2017 (MDR-2017) is regulated as a medical device. means.

“While the document does not introduce a new regulatory framework, it explains how the existing provisions of the Drugs and Cosmetics Act, 1940 and the Medical Devices Rules, 2017 apply to medical device software,” said a senior health ministry official.

The official said one of the key clarifications is the distinction between Software as a Medical Device (SaMD) and Software in a Medical Device (SiMD). Stand-alone software that performs medical functions, such as interpreting scans or helping doctors make diagnoses, will be regulated separately from software embedded in medical equipment. The terminology and regulatory approach are consistent with the principles developed by the International Medical Device Regulators Forum (IMDRF).

The guidelines also incorporate artificial intelligence and machine learning-based software directly into medical devices when such products are intended to diagnose, monitor, predict or treat disease. These products will be classified into risk categories – classes A, B, C and D – based on their intended use and the potential risk they pose to patients, with higher risk products subject to greater regulatory scrutiny.

The document adopts a lifecycle approach to regulation, requiring manufacturers to address software design, verification, validation, cybersecurity, updates, maintenance and post-market surveillance. It also emphasizes the creation of clinical evidence to demonstrate that the software works safely and effectively for its intended medical purpose.

“For AI companies, these guidelines provide a clearer compliance roadmap from product development to market approval. Developers of AI-based diagnostic and clinical decision support tools will now have defined expectations for risk classification, clinical validation, documentation, cybersecurity, and post-market monitoring. While this may increase regulatory obligations, it also reduces uncertainty, improves investor confidence, and may facilitate broader adoption of AI products by more predictable healthcare providers through more predictable paths.”

Published – 29 Jul 2026 17:54 IST