CDSCO issues final guidance on regulating medical device software

India’s apex drug regulator has issued its final rulebook for medical device software, formalising how artificial intelligence-driven diagnostic tools, mobile health apps and other software-based products will be classified and licensed in the country.

The Central Drugs Standard Control Organisation (CDSCO) published the Guidance Document on Medical Devices Software (MDSW) on July 21, in a circular signed by Drug Controller General of India Dr Rajeev Raghuvanshi. “This guidance clarifies regulatory expectations for Medical Device Software under the MDR-2017 [Medical Devices Rules, 2017],” the circular said. “It outlines the regulatory framework, classification, principles, applicable safety and performance requirements, documentation expectations, quality management considerations, and post-market obligations to facilitate compliance with the applicable regulatory requirements.”

The regulator has directed all stakeholders to refer to the guidance while submitting applications for regulatory approvals under the MDR-2017.

The document addresses a category of products that has expanded rapidly in recent years, as software is increasingly deployed on general-purpose, non-medical hardware and delivered across care settings on platforms such as personal computers, smartphones and cloud services, rather than on dedicated medical hardware.

Relief on frequent AI updates
The final guidance responds directly to concerns raised by industry bodies, including the Medical Technology Association of India (MTaI), and by digital health developers, who had questioned how the frequent updates and continuous learning loops typical of artificial intelligence and machine learning algorithms would be handled if every change required a fresh licence.

CDSCO has now formalised an Algorithm Change Protocol (ACP) framework. Under it, developers who lay out predefined, bounded modification rules in advance will be able to make minor algorithm updates without seeking a new licence application for each iteration. The regulator has also spelt out, for the first time, the exact process for obtaining test and evaluation permissions as well as standard commercial licences, a process that stakeholders said was only loosely outlined in earlier drafts.

A clearer line between SaMD and SiMD
The guidance also draws an explicit distinction, previously implicit in India’s regulatory framework, between two categories of medical software.

Software in a Medical Device (SiMD) is software embedded within a hardware device that drives or controls its functioning, for instance, the firmware inside a cardiac pacemaker, the operating software of a glucose analyser, or a mobile app that controls an insulin pump over Bluetooth. Its regulatory treatment follows a simple rule: SiMD inherits whatever risk classification applies to the hardware it is embedded in.

Software as a Medical Device (SaMD), by contrast, is standalone software that performs a medical function on its own, without needing a specific hardware device to work. An AI tool that screens chest x-rays for tuberculosis, a mobile app that interprets ECG readings, or a cloud-based clinical decision support system are all examples. Because these run on general-purpose computing platforms, laptops, phones or servers, they are regulated as independent medical devices in their own right. The guidance applies to such software in both human healthcare and veterinary use.

Why it matters
Any software, used alone or in combination, that a manufacturer intends for a medical purpose and that meets the definition of a medical device under the Drugs and Cosmetics Act, 1940, and the MDR-2017, is regulated as a medical device in India. But the MDR-2017 were drafted primarily with hardware-based devices in mind, leaving manufacturers of AI-assisted diagnostics, disease-monitoring applications and clinical support tools with limited clarity on how the rules applied to them.

The new document is intended to guide manufacturers, importers, innovators and researchers in submitting applications to the Licensing Authority for approvals of medical device software, including software used in in-vitro diagnostic (IVD) devices, under the MDR-2017.

CDSCO has stressed that the guidance reflects current practice under the MDR-2017 and should not be read as introducing new regulatory controls on medical device software.
MB Bureau