CDSCO issues guidance clarifying regulatory pathway for AI, software-based medical devices

In a move aimed at bringing greater regulatory clarity and ensuring safety for patients, the Central Drugs Standard Control Organisation (CDSCO) has issued a guidance document for India’s fast-growing digital health sector, detailing how software-based medical devices, including artificial intelligence (AI)-enabled products, will be regulated under the Medical Devices Rules (MDR), 2017.

The guidance is intended to help manufacturers, importers, innovators and researchers prepare applications for regulatory approval from the licensing authority. It applies to software products under the definition of a medical device. It, however, does not apply to software merely intended for general wellness, promoting a healthy lifestyle, or measure body parameters only for regular tracking and fitness purposes.

“This Guidance Document reflects current practices under the MDR-2017 and should not be misconstrued as a new regulatory control on Medical Device Software (MDSW), including In-vitro Diagnostic (IVD) MDSW,” CDSCO noted in its announcement.

Stating that the role of software in healthcare is becoming increasingly critical, as a diverse array of products serves various medical and administrative functions across clinical and private settings, the CDSCO said that any software, whether alone or in combination, intended by the manufacturer for medical purposes and defined as medical device under the Drugs and Cosmetics Act, 1940 and Medical Devices Rules, 2017 (MDR-2017) is regulated as medical device.

“While the document does not introduce a new regulatory framework, it explains how existing provisions under the Drugs and Cosmetics Act, 1940, and the Medical Devices Rules, 2017, apply to medical device software,’’ said a senior Health Ministry official.

The official said that one of the key clarifications is the distinction between Software as a Medical Device (SaMD) and Software in a Medical Device (SiMD). Standalone software that performs a medical function, such as interpreting scans or assisting clinicians in diagnosis, will be regulated separately from software embedded within medical equipment. The terminology and regulatory approach are aligned with principles developed by the International Medical Device Regulators Forum (IMDRF).

The guidance also brings AI- and machine learning-based software squarely within the medical device framework when such products are intended for diagnosis, monitoring, prediction or treatment of diseases. These products will be classified into risk categories — Classes A, B, C and D — based on their intended use and the potential risk they pose to patients, with higher-risk products subject to greater regulatory scrutiny.

The document adopts a lifecycle approach to regulation, requiring manufacturers to address software design, verification, validation, cybersecurity, updates, maintenance and post-market surveillance. It also emphasises the generation of clinical evidence to demonstrate that software performs safely and effectively for its intended medical purpose.

“For AI companies, the guidance provides a clearer compliance roadmap from product development to market approval. Developers of AI-based diagnostic and clinical decision-support tools will now have defined expectations on risk classification, clinical validation, documentation, cybersecurity and post-market monitoring. Although it may increase regulatory responsibilities, it also reduces uncertainty, improves investor confidence and could facilitate wider adoption of AI products by healthcare providers through a more predictable regulatory pathway,’’ said the official.