Software as a Medical Device (SaMD) in India

Software as a Medical Device in India is regulated by CDSCO when the software is intended for a medical purpose, irrespective of platform through which it is delivered. Intended purpose and function decide whether the Medical Devices Rules, 2017 (MDR 2017) apply. A health app with no medical purpose falls outside them.

This guide covers eligibility, classification, licensing, fees, timelines, technical documentation and post market duties.

What is Software as a Medical Device (SaMD)?

Software is a medical device when its manufacturer intends it for a medical purpose, with or without hardware. CDSCO’s guidance uses the term Medical Device Software (MDSW) and defines two types.

• Standalone MDSW performs a medical purpose without being part of a hardware device. The market calls this SaMD.
• Software that is part of a hardware device, or drives or influences it, operates, modifies or controls the device, or supplies output on its functioning.

A third group, general healthcare software, serves administrative, wellness or information purposes and may fall outside the rules.

Medical purposes include diagnosis, prevention, monitoring, treatment or alleviation of disease or injury, support of a physiological process, supporting or sustaining life, disinfection of devices and control of conception. Mitigation and prediction may also count.

CDSCO’s circular of 21 July 2026 issued the final Guidance Document on Medical Device Software. The guidance provides the following examples of software within the scope of medical device regulation:

• CAD software analysing X-rays or ECGs
• AI/ML tools for triage or screening of cancer lesions
• Image analysis of digital slides for cell counts
• Apps linked to a blood pressure cuff for medical tracking
• Digital therapeutics platforms for chronic disease
• Software built into an IVD analyser, which is part of that device

It also lists software outside the rules:

• ERP (Enterprise Resource Planning) software used in a device quality system
• Software used only for medical teaching
• Tools that only transfer, store, convert or search data
• Hospital Information System / Clinical Information System limited to admission, scheduling and billing
• Laboratory information systems and image management systems with no medical function
• General wellness software that makes no reference to disease

A system that adds a medical function can become a device. Software that measures, estimates or reports physiologic values for medical purposes is never general wellness software.

AI, cloud and mobile delivery do not exempt software. Mobile apps, AI/ML software and cloud software that meet the device definition are MDSW. IVD medical device software in India falls within the guidance too, and the intended use of IVD software adds elements such as the analyte, specimen type and self-testing. These points are the core of the SaMD regulations in India and the CDSCO SaMD guidelines.

A system may mix medical and non-device functions. The guidance lets the non-device functions sit outside review, but the manufacturer must explain how they affect the safety of the medical function. Vague claims here often cause classification delays.

For a broader comparison of how different markets regulate medical device software, read our Global Software as a Medical Device (SaMD) Regulations Guide.

SaMD Regulatory Framework in India

Medical device software is regulated through the existing medical device rules, and the guidance creates no separate regime. The legal base is the Drugs and Cosmetics Act, 1940 and MDR 2017 (G.S.R. 78(E), 31 January 2017). CDSCO confirms that all devices meeting the definition in S.O. 648(E) of 11 February 2020 are regulated under MDR 2017. The circular applies the same logic to software.

The Central Licensing Authority (CLA) is the Drugs Controller General of India. CLA covers import of all classes, manufacture of Class C and D devices, clinical investigation approvals and risk classification. State Licensing Authorities cover manufacture of Class A and B devices and sale of all classes.

Three amendments affect software work.

• G.S.R. 777(E), 14 October 2022. It added Chapter IIIB for registration of Class A non-sterile and non-measuring devices.
• G.S.R. 918(E), 31 December 2021. It substituted Rule 46. Unique device identification applies from a date the Central Government sets by order.
• G.S.R. 409(E), 2 June 2023. It lets State Governments set up testing laboratories. It does not change fees or timelines.

The regulatory framework for MDSW in India can be understood through three distinct layers:

• Binding law: The Act and MDR 2017, with their amendments.
• Official guidance: The July 2026 document, CDSCO FAQs and notices.
• Technical standards: MDR 2017 requires conformity with BIS standards first, then ISO or IEC standards, then validated manufacturer’s standards. CDSCO adds that a BIS standard, where one exists, is mandatory.

This is how medical device software regulations work in practice. CDSCO medical device software regulations are the general rules applied to software, and CDSCO software approval follows the ordinary MDR 2017 licence route.

SaMD Classification and Risk Assessment in India

Medical device software classification in India depends on intended use and the risk of harm. AI use does not set the class. MDR 2017 has four classes.

Software that drives or influences a hardware device falls automatically in the same class as that device. Standalone Software as a Medical Device (SaMD) is classified into Classes A, B, C or D based on the intended medical purpose, the healthcare situation and the level of impact on clinical management.

The following five questions help determine the applicable risk class.

• Is the output used for immediate or near-term action, such as diagnosing, screening or driving therapy?
• Does it guide the next diagnostic or treatment step, or triage?
• Does it only inform options or aggregate information?
• Is the condition critical, serious or non-serious?
• Who uses it, and could an erroneous output be detected by the user?

User role changes the result. Standalone software for non-clinical users in a serious situation, without specialist support, may be treated as used in a critical one. A product reviewed by a trained clinician therefore sits differently from one used alone by a patient.

For AI-based medical software in India, the guidance sets no AI class. The same rules apply. IVD software that controls or influences an IVD analyser takes the classification of that device. Other standalone IVD software is classified according to its intended purpose and associated risk, considering factors such as infectious disease detection, blood grouping, self-testing and near-patient testing.

CDSCO confirms the final class. CLA publishes a list of classified MDSW on the Online System for Medical Devices. If a product is missing, the applicant can apply on that portal for a risk class. A product with an intended use similar to a listed one may follow its class. If several rules apply, the strictest applies. This also governs software as a medical device classification generally and medical device classification in India.

CDSCO Registration and Licensing Requirements for SaMD

SaMD in India is regulated under the Medical Devices Rules, 2017 (MDR 2017). Cloud-based deployment or hosting does not exempt software from applicable medical device regulatory requirements.

The licensing authority is determined by the type of licence sought and the applicable risk classification under the MDR 2017.

• Import licence: CLA, all classes.
• Manufacturing licence: State Licensing Authority for Class A and B, and CLA for Class C and D.
• Test licence, clinical investigation and permission for investigational devices: CLA, all classes.
• Sale and distribution: State Licensing Authority.

These are the main SaMD licensing requirements India applies. Class A devices that are non-sterile and non-measuring are exempt from licensing and need only registration .

SaMD applications follow the prescribed forms under the Medical Devices Rules, 2017 (MDR 2017). The applicable forms are:

• Class A and B Manufacturing: MD-3 (application) and MD-5 (licence).
• Class A and B Loan Licence: MD-4 (application) and MD-6 (licence).
• Class C and D Manufacturing: MD-7 (application) and MD-9 (licence).
• Class C and D Loan Licence: MD-8 (application) and MD-10 (licence).
• Import Licence: MD-14 (application) and MD-15 (licence).
• Test Licence: MD-12 and MD-13 for manufacture, and MD-16 and MD-17 for import.

There are no separate application forms specifically prescribed for SaMD. The existing medical device licensing forms under the MDR 2017 apply.

Foreign manufacturers file through an Indian authorised agent. The agent is appointed by power of attorney and must hold a manufacturing or wholesale licence. The Power of Attorney and Agent Undertaking must be duly authenticated by a First-Class Magistrate, the Indian Embassy or through apostille, as applicable. Form MD-15 makes the agent responsible for the manufacturer’s business activities in India. This covers medical software registration in India for imported products.

For import, a free sale certificate from Australia, Canada, Japan, the EU or the USA lets the licence be granted without clinical investigation in India. For other countries, Class C and D devices may need clinical investigation in India.

A device without a predicate is an investigational medical device. It needs a clinical investigation permission (MD-22 to MD-23) and then a permission to import or manufacture (MD-26 to MD-27). A new IVD needs MD-24 to MD-25 and then MD-28 to MD-29.

On cloud-based medical software regulations in India, SaaS hosting risk is assessed case by case. The applicant should state whether the SaaS runs on a MeitY-empanelled cloud and should apply baseline security controls. On-premises risks are assessed by the manufacturer.

CDSCO SaMD Approval Process in India: Step by Step

CDSCO medical device approval for software follows eight steps on the general application route.

Step 1: Determine Whether the Software Qualifies as a Medical Device

Assess the software’s functionality, intended medical purpose, claims and intended users before submitting a regulatory application.

Step 2: Define the Intended Medical Purpose

Record the medical purpose, condition, patient population, users, environment, contraindications, inputs, outputs and platform. Not all elements apply to every product.

Step 3: Determine the Applicable Risk Classification

Check the product classification list on the Online System for Medical Devices. Determine the applicable risk class using the relevant classification criteria under the MDR 2017. If the product is not listed, apply to CDSCO for a risk classification determination.

Step 4: Identify the Applicable Regulatory Route

Separate domestic manufacture, import, test licence and investigational routes.

Step 5: Prepare Technical and Regulatory Documentation

Prepare the required technical and regulatory documents in accordance with the MDR 2017. Any requirement considered not applicable should be supported by a written justification.

Step 6: Submit the Application Through the Applicable CDSCO Portal

Test licences go through the National Single Window System at www.nsws.gov.in. Every other application goes through the Online System for Medical Devices at www.cdscomdonline.gov.in.

Step 7: Respond to Regulatory Queries and Complete Assessment

Expect document scrutiny and clarification requests. Class C and D manufacture involves a site inspection. Class B manufacture involves a Notified Body audit (Rule 20). Import licences may involve inspection of the overseas site. Assessment is not identical for every product.

Step 8: Obtain the Applicable Licence or Approval

The licence remains valid in perpetuity, subject to payment of the applicable retention fee every five years. The licence holder must comply with the licence conditions, approved intended use and applicable change-control requirements.

Fees for SaMD Licensing and Permissions in India

Fees depend on the licence type, the class and the number of sites and devices.

Key fees include:

Retention fees fall due every five years from the date of licence issue. A late payment adds 2 per cent of the retention fee per month, within 180 days for manufacturing licences and 90 days for import licences. Fees are paid by challan or electronic mode.

Timelines for CDSCO SaMD Approval in India

If an application meets the applicable regulatory requirements, CDSCO processes it within the statutory timelines prescribed under the MDR 2017. Actual approval timelines may vary depending on regulatory review, deficiencies and requests for additional information.

For Class C and D, a deficiency flagged within the period restarts the 45-day scrutiny from the date it is corrected. Appeals against rejection go to the Central or State Government within 45 days.

Technical Documentation and Quality Requirements for SaMD

Medical device software documentation must show that the software is safe, performs as claimed and stays under control through its life. Three sources apply. The MDR 2017, applicable CDSCO guidance and relevant technical standards. Any requirement considered not applicable should be supported by a written justification.

Key documentation requirements include:

• Software description and architecture. Name, version scheme, features, languages, platform, COTS (Commercial Off-The-Shelf) use, intended users, environment, analysis method (rule-based or AI/ML), degree of autonomy, inputs, outputs and data flow go into the Device Master File. Output limits and the clinician’s decision responsibility should be stated.
• Lifecycle documents. QMS documentation covers architecture, requirements specification, design specification, source code management, version control and release management.
• Software verification and validation. The Device Master File holds results of in-house and simulated or actual user testing before release, all hardware and operating system configurations, interoperability issues, and a system-level test protocol and report.
• Clinical evaluation and performance evidence. Evidence covers scientific validity, analytical performance and clinical performance. Sources may include literature, society guidelines, performance studies and real-world evidence. Evidence from outside India may be supplemented by validation in Indian populations.
• AI/ML validation. Applicants should disclose dataset composition for training, validation and testing, including demographic spread, geographic origin and clinical diversity. They should also show evidence on bias, generalisability and robustness across relevant Indian sub-populations. They should state whether data is real-world, public or synthetic, and justify models trained abroad.
• Risk management. The risk report under IS/ISO 14971 goes in the licence application. Documentation should cover hazards, severity and probability, cybersecurity risks, AI bias, misuse, mitigation and residual risk. Manufacturers must maintain documented risk management in accordance with IS/ISO 14971.
• Cybersecurity. SaMD manufacturers should incorporate cybersecurity measures such as secure-by-design development, threat modelling, secure default settings, a Software Bill of Materials (SBOM), encryption, access controls and audit trails. Relevant standards include IEC 81001-5-1 and ISO/IEC 27001. Cybersecurity verification and validation should also be included in the technical documentation.
• Quality management. Domestic manufacturers must submit an undertaking confirming compliance with the applicable quality management requirements, while overseas manufacturers must provide a notarised QMS certificate. ISO 13485 is a relevant quality management standard.
• Usability. Validation should reflect Indian workflows. Language access, operator training and infrastructure limits are considered. IEC 62366-1 provides relevant usability engineering requirements.
• Data, privacy and interoperability. SaMD manufacturers should consider applicable data protection requirements under the DPDP Act, 2023, and interoperability considerations aligned with the Ayushman Bharat Digital Mission (ABDM). These requirements operate separately from medical device regulations.
• Versioning and change control. A history of tested versions and traceability for field actions are expected. UDI production identifiers include the SaMD version.

The applicability of technical standards depends on the product’s intended purpose, functionality and relevant regulatory requirements. Additional standards may apply depending on the software.

Teams building AI software often document model accuracy well but give less attention to evidence from the intended clinical setting. Both are essential to demonstrate software safety and performance.

Post-Market Surveillance and Ongoing SaMD Compliance

Duties continue after approval, and software updates are the main trigger for new filings. SaMD manufacturers must comply with licence conditions and maintain a risk-based post-market surveillance plan covering:

• Complaint handling and adverse event reporting.
• Software patch tracking.
• AI model drift monitoring.
• Cybersecurity monitoring.
• Field corrective actions and collection of real-world evidence from Indian settings.

A licence holder informs the State or Central authority of a suspected unexpected serious adverse event and any recall within 15 days of becoming aware. An importer informs the authority within 15 days of any administrative action abroad. If a product may be unsafe, the manufacturer or importer informs the authority immediately. Reporting to MvPI (Materiovigilance Programme of India) is permitted, and Periodic Safety Update Reports apply to devices approved after clinical investigation.

Changes to approved SaMD are categorised as major or minor based on their impact on safety, performance, quality and intended use.

• Major changes, prior approval needed. Design changes affecting quality or indication, new clinical claims or data input types, changes of intended use, manufacturer or agent details, labels, and version changes that affect safety, effectiveness or risk controls.
• Minor changes, notification only. Design changes with no effect on quality, bug fixes and security patches with no effect on safety, version changes with no effect, and performance re-tuning within validated ranges.

Applications go through the Online System for Medical Devices. Changes under an approved ACP (Algorithm Change Protocol) still need an approval request or notification. Not every update needs a fresh licence. A change in the firm’s constitution needs a fresh application.

A release may look minor to developers but still add a data input or change a clinical output. Regulatory review should be a gate in change control.

Conclusion

Software as a Medical Device in India comes down to a few checks. These are eligibility, intended purpose, risk class, licensing authority, fees and timelines, technical evidence, software verification and validation, and change control after approval. Regulatory status follows intended purpose and function. A mobile app, cloud platform or AI engine does not settle it.

If you need support with SaMD classification, CDSCO registration, technical documentation or regulatory compliance in India, see Artixio’s medical device regulatory services in India. Contact our team at info@artixio.com for guidance tailored to your medical software product and market entry requirements.

Frequently Asked Questions

1. Is Software as a Medical Device in India regulated by CDSCO?
Yes, when the software meets the device definition in MDR 2017. It follows the same licence rules as other devices.

2. Does every healthcare application require CDSCO approval?
No. General wellness, administrative and simple data-handling software may fall outside the rules, but a medical function brings it in.

3. Is AI-based medical software considered a medical device?
Yes, when its intended purpose is medical. AI-based medical software in India is assessed on function, and the AI label does not set the class.

4. Does foreign SaMD require an Indian Authorised Agent?
Yes. Import applications are made by an authorised agent in Form MD-14, with a power of attorney and undertaking.

5. Are software updates subject to regulatory requirements?
Yes. Major changes need approval and minor changes need notification through the Online System for Medical Devices.