On October 21, 2025, CDSCO released a draft Guidance Document that establishes how medical device software will be regulated under IMDR 2017. For manufacturers developing software-based medical solutions, understanding the classification system and corresponding regulatory pathways is critical for successful market entry in India.
The guidance introduces a risk-based classification system with four classes - A, B, C, and D - determined by the intended use and severity of potential harm. Software embedded in hardware devices (SiMD) automatically inherits the risk classification of the parent hardware device. The classification of standalone software (SaMD) depends on three criteria: the intended medical purpose, the significance of information provided for healthcare decisions, and the severity of the healthcare situation being addressed.
Class A software carries minimal risk of injury and only requires online registration with CDSCO. Class B software, where minor or temporary harm could occur, may require quality assurance audits before licensing. Class C software, which could cause serious injury or significant health complications, demands regulatory approval. Class D - the highest risk category including AI-based diagnostic software used in critical situations - requires the most stringent controls and approval from the Central Licensing Authority.
The guidance notes that if multiple classification rules apply to the same software, the strictest rule resulting in the highest classification must be applied. This ensures that products addressing critical clinical needs receive appropriate regulatory scrutiny regardless of their technical complexity.
Class A: Manufacturers submit online registration through the CDSCO Medical Devices Portal. No licensing is required, making this the fastest route to market for low-risk applications.
Class B: Prior to obtaining a license, manufacturers may need to undergo a notified body audit to verify Quality Management System compliance. Once the QMS is validated, the state licensing authority issues the manufacturing or import license. This pathway typically involves a 60–90-day timeline depending on audit findings.
Class C and D: These classifications require Central Licensing Authority (CLA) approval. Manufacturers must submit comprehensive applications through the CDSCO online portal, including technical documentation, risk assessments, and quality management evidence. The CLA review process for Class C typically takes 90-120 days, while Class D applications may require 120-180 days due to additional scrutiny and potential clinical data requirements.
For investigational medical devices or new in vitro diagnostics, manufacturers must first obtain CLA permission before initiating clinical investigations. This involves submitting a Test License application (Form MD-23) for clinical investigations or a Clinical Performance Evaluation form (Form MD-25) for diagnostic evaluations. The CLA issues a test license only after approving the clinical protocol, allowing manufacturers to lawfully conduct investigations in India while developing evidence for commercial approval.
This staged approach—obtaining test license approval before clinical work—ensures that investigations follow approved protocols and meet Indian regulatory standards from the outset.
Regardless of classification, manufacturers must prepare technical documentation demonstrating safety and effectiveness. This includes system and software architecture design, Software Requirement Specifications (SRS), and Software Design Specifications (SDS). A Risk Management Report is mandatory, detailing software-specific risks such as cybersecurity vulnerabilities, deployment outside manufacturer control, and potential for rapid changes.
For AI and machine learning-based software, manufacturers must develop an Algorithm Change Protocol (ACP) that establishes procedures for validating algorithmic updates without requiring full reapproval for every improvement. This recognition of AI's dynamic nature allows manufacturers flexibility while maintaining safety oversight.
The guidance requires conformance to IS/ISO 13485 (Medical Device Quality Management Systems), IS/ISO 62304 (Software Life Cycle Processes), and relevant AI Risk Management standards. Quality Management Systems must incorporate design controls, validation and verification processes, change management procedures, cybersecurity measures, and post-market surveillance.
The mandatory QMS requirement for all software classifications—not just high-risk products—reflects the guidance's commitment to consistent quality standards across the market.
This guidance remains in draft form pending final CDSCO approval. The 30-day consultation period has closed, and the final version may incorporate changes based on industry feedback. Manufacturers should monitor the CDSCO website (cdsco.gov.in) for the official release announcement.
For manufacturers planning to enter or expand in the Indian medical device software market, reviewing this guidance now allows time to align product development, documentation preparation, and quality management systems with the anticipated regulatory requirements. The guidance provides clarity on a previously uncertain regulatory landscape, offering manufacturers a defined pathway to commercialization.
