A New Chapter for Post-Market Compliance in India
Medical device manufacturers and importers in India can no longer treat post-market surveillance (PMS) as a paperwork formality tucked away after licence approval. Through 2026, CDSCO has steadily converted PMS from a loosely enforced obligation into an audited, timeline-bound compliance system — with the most significant codification arriving via the final Guidance Document on Medical Device Software, and parallel tightening of recall, audit, and periodic reporting norms across all device classes.
The MDSW Guidance Formalizes PMS for Software and AI-Based Devices
On July 21, 2026, the Central Drugs Standard Control Organisation, Medical Devices Division, issued a circular releasing the final Guidance Document on Medical Device Software under the Medical Devices Rules, 2017, bearing Doc No. CDSCO/MD/GD/MDSW/01/2026. This 62-page document, which finalizes a draft first circulated in October 2025, after review of industry input, is notable for regulatory affairs teams well beyond the software space because of how explicitly it ties post-market obligations to the existing MDR-2017 framework rather than inventing a parallel regime.
Section 12.5 of the guidance maps post-market surveillance, vigilance, recall, and PSUR requirements against MDR-2017 rather than creating a software-only statute — confirming that PMS is not an add-on for digital health products but a lifecycle obligation identical in principle to that for hardware devices. The document specifically requires manufacturers and importers to run an active post-market surveillance system for MDSW, covering adverse events, complaints, software malfunctions, and cybersecurity issues, with Periodic Safety Update Reports submitted as required under MDR 2017.
For AI-enabled products, the bar is set even higher. The guidance places particular emphasis on ensuring AI-enabled MDSW performs appropriately across populations, healthcare settings and operational environments relevant to its intended use, and where models have been trained or validated outside India, manufacturers may be required to justify their applicability to Indian clinical settings; these considerations extend beyond the pre-market stage, with AI-enabled MDSW expected to be continuously monitored post-market for changes in performance and AI-specific risks, including bias, model drift and hallucination. Any company running diagnostic algorithms, clinical decision-support tools, or AI-assisted imaging software in India must now build drift-detection and bias-monitoring into its PMS plan, not just adverse-event logging.
Risk-Based Audits Have Replaced Document-Only Reviews
Beyond software, CDSCO’s broader posture toward device compliance has shifted materially in 2026. CDSCO has fundamentally shifted from document-heavy reviews to risk-based on-site audits, with ISO 13485 compliance and ISO 14971 risk management traceability expected to run through the entire operation — from design and production through to post-market surveillance — and auditors now arriving with risk-specific checklists expecting live evidence, not static binders. This means PMS records — complaint logs, CAPA trails, field safety data — must be inspection-ready at all times, not assembled retroactively when a renewal or variation application is filed.
The 48-Hour Recall Window Is a Hard Deadline
Recall and Field Safety Corrective Action (FSCA) timelines have also tightened considerably this year. Device recalls must now be filed through the SUGAM portal within 48 hours of the decision to recall — a hard deadline that companies without pre-planned recall procedures, communication templates, and SUGAM filing workflows regularly miss, triggering additional regulatory scrutiny and potential licence suspension. Combined with the existing statutory FSCA framework — which requires notification, preliminary, and final reports for any product recall or corrective action affecting devices already on the market — this leaves virtually no room for improvised crisis response. Companies need recall SOPs, draft communication templates, and SUGAM access credentials ready before an incident occurs, not after.
Annual Safety Update Reports and PSURs: Digital-Only, No Exceptions
Periodic reporting obligations have also hardened. CDSCO’s PSUR circular had already mandated that all PSURs for medical devices and IVDs be filed only via the Online System for Medical Devices (Sugam portal), with offline submission methods such as hard copy filings or email submissions no longer accepted from 1 April 2024, requiring applicants to file strictly via the portal following the prescribed checklist. The standard reporting cadence requires submissions every six months for the first two years after approval and annually for the following two years, with each report covering safety data, complaints received, corrective or preventive actions taken, and an updated benefit–risk assessment.
Layered on top of this, all licensed manufacturers and importers must now submit Annual Safety Update Reports to CDSCO covering any adverse events, near-misses, field safety corrective actions, changes to risk profile, and updates to post-market clinical data. Companies managing multiple device registrations should treat PSUR and ASUR tracking as a standing regulatory calendar item, not a reactive task triggered by CDSCO queries.
What CDSCO Now Expects to See in a PMS File
Across both the MDSW guidance and general MDR-2017 enforcement, CDSCO’s expectations for an auditable PMS system now converge on a consistent set of elements: customer complaints records, adverse event reporting, field safety corrective actions, periodic safety reviews, and device performance monitoring. For Class C and D devices in particular, clinical evaluation reports and post-market surveillance plans must be prepared as part of the registration dossier itself — meaning PMS planning now begins before market entry, not after.
Practical Takeaways for Manufacturers and Importers
- Appoint a designated vigilance owner. Establish a designated Medical Device Vigilance Officer and implement automated adverse event monitoring integrated with your Quality Management System.
- Pre-build recall infrastructure. Draft FSCA notification templates and SUGAM filing workflows now so the 48-hour window is achievable under pressure.
- Audit your PMS plan against Section 12.5 of the MDSW guidance if you manufacture or import any software-driven device, including AI/ML diagnostic tools.
- Map your PSUR/ASUR calendar against each product’s approval date — six-monthly for the first two years, annual thereafter — and confirm all filings route through SUGAM.
- Prepare for live, evidence-based audits rather than document submissions; maintain CAPA trails, complaint logs, and ISO 13485/14971 traceability records in continuously inspection-ready form.
Why This Matters Now
Non-compliance is no longer a paperwork risk alone. CDSCO mandates PMS as a condition of market authorisation, and non-compliance carries significant regulatory and legal consequences — including product recalls, licence suspension, and penalties. With audits becoming risk-based and on-site, and software vigilance obligations now explicitly documented, companies that have historically treated PMS as a box-ticking exercise face real exposure heading into 2027 renewal cycles.
ACPL’s regulatory experts can help you navigate post-market surveillance and materiovigilance compliance. Contact us at info@acplgroupindia.co.in or call +91-9266665201 for a consultation.