CDSCO Guidance Document on Medical Device Software under the Medical Devices Rules, 2017 (July 2026)

Under the Medical Devices Rules, 2017 (MDR 2017), made under the Drugs and Cosmetics Act, 1940, software with a medical purpose already counts as a medical device. MediaNama reported in November 2025 that the rules gave no specific direction on AI-driven, digital and cloud-based software and no guardrails on cybersecurity or privacy risks from AI/ML medical software, which the draft guidance sought to address.²

CDSCO released a draft guidance on medical device software on 21 October 2025, open for public comment for 30 days. The draft aimed to align India with global practice and resolve uncertainty about AI-driven and cloud- or network-based software. It covered only software that meets the definition of a medical device under MDR 2017, including software used for in vitro diagnosis.²

The final Guidance Document on Medical Device Software under MDR 2017 followed in July 2026. MediaNama dates its issue to 21 July 2026, and BioSpectrum reported its release on 27 July 2026.⁵⁶ The official PDF is published on CDSCO's website, but it is a scanned image and its text could not be extracted for this entry, so the descriptions below rely on press coverage of the final document and the draft.¹

Scope and legal character. According to BioSpectrum, the guidance explains how manufacturers, importers, innovators and researchers should apply to the Licensing Authority for approval of medical device software, including IVD software, and states that software intended for medical purposes falls within the definition of a medical device in the Drugs and Cosmetics Act, 1940 and MDR 2017. CDSCO says the document reflects current practice and "should not be misconstrued as a new regulatory control".⁶

Classification. The draft divided software into Software in a Medical Device (SiMD), which is part of a hardware device and has no medical purpose of its own, and Software as a Medical Device (SaMD), meaning standalone software with its own medical purpose, including mobile apps, AI/ML software and cloud-based software. It used the four risk classes of MDR 2017 (A to D), with a manufacturer's intended use statement and the degree to which the software shapes diagnosis or treatment decisions driving SaMD class.² MediaNama reported that the final document drops the separate SaMD and SiMD categories and applies a function-based approach: AI software is within scope if it serves a medical purpose. It also adds detailed requirements for quality management, technical documentation and cybersecurity.³

Licensing. As described for the draft, Class A and B devices are licensed by State Licensing Authorities and Class C and D by the Central Licensing Authority. Local manufacturers must show compliance with quality management system requirements, importers need a notarised QMS certificate from the overseas regulator, and clinical investigations require permission from the Central Licensing Authority.²

AI-specific requirements. MediaNama summarised the final guidance as requiring developers to disclose how their AI models work and the datasets used to train and test them; to explain how they address bias, lack of explainability, model drift and hallucinations; to monitor AI systems after market entry; and to justify whether models trained outside India suit Indian clinical settings.³ A later report adds that an AI-enabled device intended for India should have its performance evaluated in the groups and settings where it will be used, that clinical performance validation should check whether the software gives clinically relevant outputs consistent with its intended use, and that performance should, where applicable, be evaluated across demographic, geographic and linguistic differences.⁵ The draft had also required an algorithmic change protocol, covering a risk assessment plan, data collection protocols and quality assurance so that algorithm updates do not compromise safety, and documentation of how datasets are chosen for training, external validation or retraining.²

Cybersecurity and health data. BioSpectrum reported that software should keep operating safely during cybersecurity incidents, such as partial loss of connectivity, denial-of-service conditions or compromised data integrity, and that diagnostic systems in healthcare facilities, including IVD systems, digital pathology, radiology AI and decision-support software, should support ABDM-compliant health record generation and exchange, maintain patient consent controls and allow outputs to be traced to registered facilities and authorised professionals.⁶

On 4 August 2026 the Union Minister for Chemicals and Fertilizers, J.P. Nadda, told the Lok Sabha in reply to a starred question that CDSCO has not adopted AI for regulatory approvals and relies on scientific and technical review, including its Subject Expert Committees. MediaNama noted that the reply described the Department of Pharmaceuticals' support for AI research under the PRIP scheme and that it did not mention the new guidance or explain how compliance with it would be overseen.³

On 18 September 2026, speaking at a CII pharma summit, the Drugs Controller General of India, Rajeev Singh Raghuvanshi, said CDSCO had formed an expert committee on AI, covering how to evaluate, approve and regulate AI in drug discovery. MediaNama found no order, membership or terms of reference on CDSCO's website or in a PIB release as of 21 September 2026, and noted that the committee's remit relative to clinical, diagnostic and device software was unclear.⁴

The guidance sits alongside the ethical framework issued by the Indian Council of Medical Research in 2023, which is non-binding and addresses research and clinical ethics, while CDSCO's guidance is tied to product licensing.⁴

MediaNama's commentary on the draft noted that requirements such as a device master file, periodic safety update reports, post-marketing surveillance and a quality management system covering the software lifecycle may be burdensome for small manufacturers and startups building low-risk Class A and B software, and that existing rules had left gaps on privacy and cybersecurity for AI medical software.²

In October 2026 MediaNama reported on an AI autism-screening tool being expanded from Rajasthan health centres to 125 schools without published error rates. It asked CDSCO whether the tool was assessed against the July 2026 guidance or an earlier standard and whether CDSCO holds a clinical evaluation report; CDSCO did not respond. The article noted that a Class B certificate may have been granted by the Rajasthan state licensing authority and not by CDSCO's central office.⁵ The episode illustrates a question that the guidance leaves open: how consistently state licensing authorities will apply its AI-specific expectations to lower-risk software.

As of 15 October 2026 the Guidance Document on Medical Device Software under MDR 2017 is published on CDSCO's website and is the main regulatory text applying to AI-enabled medical software in India. It is described by CDSCO as reflecting existing practice under MDR 2017 and so does not itself create new binding obligations beyond the Rules.⁶

The sources reviewed do not report any enforcement action under the guidance, a published method of verifying the disclosures it requires, or the outcome of CDSCO's announced AI expert committee. The full text of the final guidance could not be read for this entry, so readers who need the exact wording of its AI provisions should consult the CDSCO document directly.