CDSCO SaMD Guidance 2025–26: What India’s Digital Health Companies Must Do Now

CDSCO’s 76-Page Draft Guidance Has Set a New Baseline for SaMD in India

On 21 October 2025, the Central Drugs Standard Control Organisation (CDSCO) published its long-anticipated Draft Guidance Document on Medical Device Software — a 76-page document that, for the first time, comprehensively defines how India’s Medical Devices Rules, 2017 (MDR 2017) apply to software-based healthcare products. The Drugs Controller General of India (DCGI) described the document’s purpose as bringing “more clarity on the regulatory aspects” of medical device software and aligning India’s requirements with globally harmonised practices.

The 30-day public comment window closed on 22 November 2025. With stakeholder consultations now concluded, the final version of the guidance is expected to be formalised, and companies currently developing or importing software-based medical products need to be treating this draft as the operative regulatory standard.

This is not a minor update. For AI-powered diagnostic platforms, clinical decision-support apps, cloud-hosted health tools, and remote monitoring software, this guidance reshapes classification, licensing, documentation, and post-market obligations — all at once.

SiMD vs. SaMD: The Critical Distinction You Must Get Right

The draft guidance draws a clear functional boundary between two categories of medical software, and getting this classification right determines your entire regulatory pathway.

Software in a Medical Device (SiMD)

SiMD refers to software that is integrated within a hardware medical device and enables or controls its functioning — for example, embedded firmware in pacemakers, software driving insulin pumps, or operating systems integral to diagnostic analysers. This software does not independently perform a medical purpose and assumes the risk classification of the parent hardware device. Separate classification is not required.

Software as a Medical Device (SaMD)

SaMD is standalone software that independently performs a medical purpose without being embedded in a hardware medical device. This includes AI-powered radiology tools, computer-aided detection software, and mobile applications intended to monitor or analyse medical conditions. SaMD must be classified independently, based on its intended use and clinical impact, in accordance with the First Schedule to the MDR 2017.

Administrative and non-clinical software — such as hospital billing systems or appointment management platforms — remains outside the regulatory scope entirely.

The Risk-Based Classification Matrix for SaMD

The draft adopts a four-tier, risk-based classification framework consistent with existing MDR 2017 rules and aligned with International Medical Device Regulators Forum (IMDRF) principles. Classification is driven by two key factors: the significance of the information provided by the software and the seriousness of the healthcare situation it addresses.

• Class A (Low Risk): Software that does not directly interface with critical patient data or guide treatment decisions in serious conditions. Subject to basic quality management requirements.
• Class B (Low-to-Moderate Risk): Software supporting clinical management in non-critical scenarios. Requires more documentation than Class A.
• Class C (Moderate-to-High Risk): Software that plays a role in managing or diagnosing serious conditions. Subject to rigorous CDSCO-level review.
• Class D (High Risk): Software directly involved in diagnosing or guiding treatment in critical or life-threatening clinical scenarios — for example, AI-based cancer detection tools or autonomous diagnostic decision systems.

Critically, the 2026 update reinforces that intended use determines classification — not just the technical architecture. Even minor wording changes in labelling, promotional materials, or instructions for use can shift a product from Class B to Class C if they suggest diagnostic or life-supporting functionality.

Licensing Pathways: Who Approves What

The licensing structure follows the existing MDR 2017 hierarchy, but the draft provides much-needed clarity on which authority handles which class of software:

• Class A and Class B SaMD: Licensed by State Licensing Authorities (SLA).
• Class C and Class D SaMD: Licensed by the Central Licensing Authority (CDSCO) at the national level.

Applications must be submitted through the CDSCO Medical Device Online Portal (www.cdscomdonline.gov.in) for manufacturing and import approvals. Test licences for SaMD must be filed via the National Single Window System (NSWS). The draft also provides documentation templates and submission checklists to reduce administrative delays.

Approval timelines under MDR 2017 vary by class: Class A typically takes 30–60 days; Class B, 60–120 days; Class C, 120–240 days. Higher-risk SaMD applications, particularly those involving AI/ML, should plan for the upper end of these ranges given the depth of technical review required.

What the Draft Demands: Documentation and Technical File Requirements

The draft sets out a comprehensive technical documentation framework. For any SaMD application, companies must prepare and maintain:

1. Executive Summary — covering software description, versioning, lifecycle, logic type, intended users, inputs/outputs, autonomy level, update mechanisms, change management approach, and substantial equivalence justification.
2. Risk Management Report — aligned with ISO 14971, documenting all foreseeable hazards and risk controls.
3. Algorithm Change Protocol (ACP) — mandatory for AI/ML-based systems, documenting model retraining triggers, performance drift monitoring, and update validation procedures.
4. System and Software Architecture Design Specifications — covering lifecycle documentation aligned with IEC 62304 (software lifecycle) and IEC 82304-1 (standalone software standards).
5. Quality Management System (QMS) — aligned with ISO 13485. Foreign manufacturers must demonstrate compliance with an equivalent QMS framework to qualify for import licensing.
6. Cybersecurity Documentation — the draft places a strong emphasis on cybersecurity, recognising the interconnected nature of digital medical tools.

Incomplete documentation is one of the most common reasons for application delays. A well-prepared technical file is not optional — it is the single biggest determinant of approval timelines.

AI/ML Devices: Additional Scrutiny Under the Draft

The October 2025 guidance explicitly covers artificial intelligence, machine learning, and cloud-based medical applications — a first for Indian regulation. AI/ML-based SaMD receives heightened attention, with CDSCO requiring:

• Transparent algorithm change-management protocols, including documentation of model retraining, update triggers, and mechanisms to track performance drift over time.
• Clear communication of any algorithmic updates to regulators post-deployment.
• Validation of all model updates before they affect clinical outputs.

The Medical Technology Association of India (MTaI), representing multinational medtech companies, welcomed the draft but urged CDSCO to provide greater clarity on clinical evaluation protocols and algorithm change management, particularly for AI/ML-based devices. MTaI also called for streamlined compliance requirements for low-risk SaMDs to ensure regulatory proportionality — a point the final guidance is expected to address.

Post-Market Surveillance: Ongoing Obligations That Begin at Launch

The draft introduces a robust post-market surveillance framework for SaMD, requiring manufacturers to:

• Maintain real-world performance records and conduct ongoing safety evaluations.
• Submit Periodic Safety Update Reports to the licensing authority.
• Report cybersecurity vulnerabilities and incident data.
• Manage software update lifecycles and report any changes that affect medical functionality to CDSCO for review or re-approval.

Post-market obligations are not deferred until a problem arises — they are built into the regulatory lifecycle from day one of commercialisation.

Class A Relief: NSNM Exemption Still Applies

While Class C and D regulation has tightened significantly, CDSCO has maintained meaningful relief for the lowest-risk segment. Class A Non-Sterile, Non-Measuring (NSNM) devices — including low-risk SaMD falling in this category — are exempt from the full mandatory licensing review process under Gazette Notification G.S.R. 777(E) dated 14 October 2022. Indian Authorised Agents can obtain an automatic registration number on the SUGAM portal via self-notification. However, this does not mean unregulated: post-market surveillance obligations still apply, and the registration number must be obtained before importing.

Practical Action Plan for SaMD Developers and Importers

Given where the guidance stands as of June 2026, here is what your business needs to be doing now:

1. Conduct a SaMD/SiMD determination audit — Formally document whether your product qualifies as SaMD, SiMD, or falls outside the scope of MDR 2017 entirely. This determination must be defensible.
2. Perform risk classification under the draft framework — Apply the two-axis test (information significance × condition severity) to arrive at your Class A–D designation. Have this reviewed by a qualified regulatory professional before filing.
3. Build your technical file now — Do not wait for the final guidance to be gazetted. The draft is the operative standard and the documentation requirements are clearly set out.
4. Develop your Algorithm Change Protocol — If your product uses AI/ML, the ACP must be in place before submission, not as an afterthought.
5. Appoint an Indian Authorised Agent — Foreign manufacturers must have a registered Indian Authorised Agent for any import licensing application under MDR 2017.
6. File through the correct portal — Use the CDSCO Medical Device Online Portal for manufacturing and import licences; use NSWS for test licence applications.
7. Plan for post-market surveillance from day one — Build internal systems for performance monitoring, cybersecurity tracking, and periodic safety reporting before your product reaches the market.

ACPL’s regulatory experts can help you navigate CDSCO SaMD classification, documentation, and licensing. Contact us at info@acplgroupindia.co.in or call +91-9266665201 for a consultation.