CDSCO issues guidance clarifying regulatory pathway for AI, software-based medical devices

Published 29 July 2026 · tech

In a move aimed at bringing greater regulatory clarity and ensuring safety for patients, the Central Drugs Standard Control Organisation (CDSCO) has issued a guidance

In a move aimed at bringing greater regulatory clarity and ensuring safety for patients, the Central Drugs Standard Control Organisation (CDSCO) has issued a guidance document for India’s fast-growing digital health sector, detailing how software-based medical devices, including artificial intelligence (AI)-enabled products, will be regulated under the Medical Devices Rules (MDR), 2017. The guidance is intended to help manufacturers, importers, innovators and researchers prepare applications for regulatory approval from the licensing authority. It applies to software products under the definition of a medical device. It, however, does not apply to software merely intended for general wellness, promoting a healthy lifestyle, or measure body parameters only for regular tracking and fitness purposes. “This Guidance Document reflects current practices under the MDR-2017 and should not be misconstrued as a new regulatory control on Medical Device Software (MDSW), including In-vitro Diagnostic (IVD) MDSW,” CDSCO noted in its announcement.

Stating that the role of software in healthcare is becoming increasingly critical, as a diverse array of products serves various medical and administrative functions across clinical and private settings, the CDSCO said that any software, whether alone or in combination, intended by the manufacturer for medical purposes and defined as medical device under the Drugs and Cosmetics Act, 1940 and Medical Devices Rules, 2017 (MDR-2017) is regulated as medical device. “While the document does not introduce a new regulatory framework, it explains how existing provisions under the Drugs and Cosmetics Act, 1940, and the Medical Devices Rules, 2017, apply to medical device software,’’ said a senior Health Ministry official. The official said that one of the key clarifications is the distinction between Software as a Medical Device (SaMD) and Software in a Medical Device (SiMD).

Standalone software that performs a medical function, such as interpreting scans or assisting clinicians in diagnosis, will be regulated separately from software embedded within medical equipment. The terminology and regulatory approach are aligned with principles developed by the International Medical Device Regulators Forum (IMDRF). The guidance also brings AI- and machine learning-based software squarely within the medical device framework when such products are intended for diagnosis, monitoring, prediction or treatment of diseases. These products will be classified into risk categories — Classes A, B, C and D — based on their intended use and the potential risk they pose to patients, with higher-risk products subject to greater regulatory scrutiny. The document adopts a lifecycle approach to regulation, requiring manufacturers to address software design, verification, validation, cybersecurity, updates, maintenance and post-market surveillance.