Medical AI · Regulation, ethics & governance · Lesson 5 of 7
India: CDSCO and medical-device software
Reviewed by Dr. Ram Kumar G, MBBS, MD (Internal Medicine), MPH (USA), on · Last updated
- Intermediate
- Clinical focus
- About 25 minutes
- Includes exercise
Before this lesson: Software as a Medical Device (SaMD), Privacy and de-identification: HIPAA, GDPR and India's DPDP Act
In short
In India, software with a medical purpose is a medical device regulated by the Central Drugs Standard Control Organisation (CDSCO) under the Medical Devices Rules, 2017, which sort devices into risk classes A (low) to D (high). CDSCO's guidance on medical device software, released in draft in October 2025 and published in final form in July 2026, explains how software is qualified and classified, including AI. Alongside device rules, the ICMR's 2023 ethical guidelines for AI in healthcare, the DPDP Act for personal data, and telemedicine and professional-conduct rules shape how AI can be used in Indian care.
You will learn to
- Describe how medical device software is regulated in India under the Medical Devices Rules, 2017
- Apply CDSCO's risk classes A to D to software
- Summarise the ICMR's ethical guidelines for AI in healthcare
- Identify the data protection and professional rules that affect clinical AI in India
The Medical Devices Rules, 2017
The Medical Devices Rules, 2017, administered by CDSCO, regulate the manufacture, import, sale and clinical investigation of medical devices in India. Licensing has been phased in for all classes of device: classes A and B from October 2022, and classes C and D from October 2023.
| Class | Risk | Licensing authority |
|---|---|---|
| A | Low | State licensing authority (manufacture); registration route for some low-risk devices |
| B | Low to moderate | State licensing authority (manufacture) |
| C | Moderate to high | Central licensing authority (CDSCO) |
| D | High | Central licensing authority (CDSCO) |
CDSCO's guidance on medical device software
CDSCO released a draft guidance document on medical device software in October 2025 and published the final version in July 2026. It describes software as a medical device (stand-alone) and software in a medical device (embedded), and explains how they are qualified and classified under the existing Rules; it interprets the 2017 Rules rather than creating a separate software law.
- Qualification: software is a device when the manufacturer intends a medical purpose and it performs a clinical function. General wellness apps without medical claims and administrative systems without diagnostic functions are out of scope, and disclaimers cannot override what the software actually does.
- Classification: risk classes A to D are assigned using the seriousness of the healthcare situation and how significant the software's output is to decisions, an approach similar to the IMDRF framework covered earlier. Software that drives a hardware device takes that device's class.
- AI: the guidance addresses AI and machine-learning software, including control of changes to algorithms (an algorithm change protocol where applicable), cybersecurity and a software bill of materials.
- Post-market: adverse event reporting and field safety corrective actions, which for software can include suspending downloads or remotely deactivating a version.
Check the official text
- Details of forms, portals and timelines change. Use the current guidance and notices on the CDSCO website, and regulatory advice, for any real submission.
Ethics, data and professional rules
- Registered medical practitioners remain responsible for clinical decisions made with AI support, under the professional-conduct rules that apply to them.
- Clinical research on AI tools needs ethics committee approval and, where the tool is an investigational device, CDSCO permission for clinical investigation.
| Instrument | What it covers |
|---|---|
| ICMR Ethical Guidelines for Application of AI in Biomedical Research and Healthcare (2023) | Principles including autonomy, safety, data privacy, accountability, fairness, trustworthiness and validity, plus guidance for ethics committees reviewing AI research |
| Digital Personal Data Protection Act, 2023 and DPDP Rules, 2025 | Consent, purpose limitation and security for digital personal data; research exemption applying from 13 May 2027 (see the privacy lesson) |
| Telemedicine Practice Guidelines (2020) | State that AI and machine-learning tools may assist registered medical practitioners but cannot counsel patients or prescribe medicines directly |
| Ayushman Bharat Digital Mission | Standards (FHIR R4, SNOMED CT) and consent-based health data exchange that AI tools may connect to |
Not legal or regulatory advice
- This lesson explains regulation for learning purposes, as of October 2026. Rules and guidance change; whether a real product is a medical device, and how it is classified, depends on its intended purpose and needs qualified regulatory advice and the current official texts.
Exercise
Work out the Indian regulatory path for fictional AI tools and the ethical review they would need.
Data: Fictional product descriptions written for the notebook (Created for this course)
- For five fictional tools, decide whether each is medical device software in India and assign a likely class A to D, stating your assumptions.
- Identify whether each would be licensed by a state authority or centrally by CDSCO.
- Map one tool against the ICMR AI ethical principles and list what an ethics committee would ask.
- Note which DPDP obligations apply to the tool's data and when they take effect.
The runnable notebook and worked solution will be published soon. You can work through the steps with the code on this page in the meantime.
Key takeaways
- Medical software in India is regulated by CDSCO under the Medical Devices Rules, 2017.
- Risk classes run from A (low) to D (high); C and D are licensed centrally.
- CDSCO's software guidance, final in July 2026, explains qualification, classification and AI changes.
- ICMR AI ethics guidelines, the DPDP Act and telemedicine rules also shape clinical AI use.
Terms used: De-identification, Intended purpose (intended use), SaMD (Software as a Medical Device)
Related: Privacy and de-identification: India's DPDP Act, Data standards: ABDM and FHIR, Software as a Medical Device
FAQ
Is AI software regulated as a medical device in India?
Yes, when it has a medical purpose such as diagnosis, monitoring or treatment. It is regulated by CDSCO under the Medical Devices Rules, 2017.
What are the medical device risk classes in India?
Class A (low), B (low to moderate), C (moderate to high) and D (high). Higher classes face stricter requirements and central licensing.
Has CDSCO issued guidance on medical device software?
Yes. A draft was released in October 2025 and the final guidance document on medical device software was published in July 2026.
Can an AI tool prescribe medicines in India?
No. India's Telemedicine Practice Guidelines state that AI tools may support registered medical practitioners but cannot counsel patients or prescribe directly.
What are the ICMR AI guidelines?
The ICMR's 2023 Ethical Guidelines for Application of AI in Biomedical Research and Healthcare, which set ethical principles and guidance for reviewing AI research and use in India.
Sources
- Central Drugs Standard Control Organisation (CDSCO). Medical Devices Rules, 2017, and medical device notices and guidance documents
- CDSCO. Guidance Document on Medical Device Software (final, July 2026; draft released 21 October 2025). Summary: MedDevice Guide
- India Briefing. Navigating India's medical device software framework (on the October 2025 draft)
- Indian Council of Medical Research. Ethical Guidelines for Application of Artificial Intelligence in Biomedical Research and Healthcare. 2023
- Ministry of Health and Family Welfare / Board of Governors in supersession of the Medical Council of India. Telemedicine Practice Guidelines, 25 March 2020 (section on use of artificial intelligence)
- Digital Personal Data Protection Rules, 2025 (G.S.R. 846(E), 13 November 2025)
Educational content only. This material teaches methods; it is not clinical advice. Code, models and examples here are not validated medical devices and must not be used to make decisions about real patients without proper clinical validation, governance and any required regulatory approval. Examples use synthetic or openly licensed de-identified data only. Never paste identifiable patient information into public AI tools. Mentions of models, tools or vendors are for identification, not endorsement.