Software
Becomes a
Device
India has published its first full rulebook for Medical Device Software. This is the working guide to it: what it covers, how it classifies risk, and what the AI and digital health clauses actually demand.
Software has been regulated since 2020.
Until now there was no manual.
Gazette Notification S.O. 648(E) brought all medical devices under the Medical Devices Rules, 2017 six years ago. The guidance signed on 21 July 2026 is the first time CDSCO has written down how it reads that definition for software. Four things moved.
The boundary is now testable
Worked examples on both sides of the line, from pacemaker firmware to hospital information systems. Arguing you sit outside the rules now means arguing against a published list.
Standalone software gets its own grid
No more reasoning by analogy to hardware. A matrix reads what your software tells a clinician against how serious the situation is, and resolves to Class A, B, C or D.
Adaptive models get real machinery
Algorithm change protocols, retraining plans, rollback plans, dataset composition disclosure, and drift and hallucination monitoring named inside the surveillance expectations.
Local specificity became a filing requirement
ABDM alignment, the DPDP Act, MeitY cloud disclosure, and justification whenever a model was trained or validated somewhere other than India.
Which class is your software?
Two questions decide it for standalone software. Answer them and you will see the class, the licensing authority that goes with it, and the forms you file. This runs the same logic as the matrix in the guidance.
Not everything in a hospital is regulated.
The line moves more easily than you think.
CDSCO published worked examples on both sides. The exclusions matter most, because several of them survive only while a product stays administrative.
- Firmware embedded in a cardiac pacemaker, regulated as a component of that pacemaker
- Embedded software driving an insulin pump to deliver a calculated dose
- Operating software built into a clinical analyser, point of care analyser or personal glucose meter
- Software supplied separately that operates or influences an IVD analyser, treated as a distinct IVD
- An app connecting by Bluetooth to a blood pressure cuff to track readings for medical purposes
- Image analysis of body fluid preparations or digital slides for cell count and morphology review
- Computer aided detection reading X rays or ECGs to suggest or exclude conditions
- AI or machine learning tools for triage or screening of cancer lesions
- IoT platforms working with connected devices such as smart glucometers, with real time analytics
- Behaviour change and digital therapeutics platforms that mitigate progression of chronic disease
- Veterinary radiological image analysis and veterinary device operation software
- ERP and software automating design, manufacturing, labelling, packaging, distribution or complaints
- Software using device data without a medical purpose, such as encryption for transmission
- Software monitoring device performance for servicing
- Software altering data representation for cosmetic or compatibility reasons
- Software solely for medical teaching, training or education
- Transfer, storage, archiving, conversion, formatting, communication, simple search and compression
- Hospital and clinical information systems limited to admission, scheduling, billing and records
- General purpose communication systems including email, telecom, video and paging
- Laboratory information systems managing and validating information from connected analysers
- Image management systems that access, display, annotate, store, archive and share images
- General wellness software, within the limits set out in the guidance
The carve outs are conditional
A hospital, laboratory or image management system becomes a medical device the moment it gains a medical function. CDSCO names the triggers: image analysis as an aid to diagnosis, quantification of physiological parameters for clinical decision making, and real time patient monitoring. Wellness software has a similar limit. It may claim to improve a general state of health, but it cannot reference diseases, disorders or pathological conditions.
A CE marked dossier will not simply transfer
This is where an arriving manufacturer loses time. Five requirements are specific to India's digital health architecture, its data protection statute and its clinical realities, and none of them is a translation exercise.
ABDM alignment
Interoperable, standards based exchange and consent based access, with integration into ABHA, the Health Facility Registry and the Healthcare Professional Registry where applicable.
DPDP Act, 2023
Consent driven access to health data, encryption in transit and at rest, access controls, audit trails, and privacy protection across the whole AI lifecycle.
Cloud hosting disclosure
For Software as a Service, state whether the product sits on a MeitY empanelled cloud server, with baseline security controls documented for the hosted environment.
Evidence in Indian populations
Where models are trained or validated elsewhere, justify applicability to Indian clinical environments and supplement with validation in representative Indian populations.
Usability on Indian terms
Validation reflecting Indian clinical workflows: language and interface accessibility, variability in operator training, and infrastructure constraints in facilities.
Traceable diagnostic output
Diagnostics deployed in facilities should support ABDM compliant record generation, maintain consent controls, and trace outputs to registered facilities and authorised professionals.
The pathway, end to end
The report carries CDSCO's own flow charts at full page size, each with an annotation rail explaining how to read the three bands. Tap either to enlarge.
EnlargeMedical Device Software
Development to commercialisation. Test batches, the investigational device route, then manufacturing and import licences.
EnlargeIVD Medical Device Software
Development to market access. Clinical performance evaluation for the Indian population, then the same commercialisation split.
Eleven chapters, written to be acted on
Send it to my inbox
One field, no forms to fill twice. You get the full 24-page PDF, both official pathway charts at full page size, and the readiness checklist.
- The qualification test, with the in list and the out list
- Risk classification, including the escalation clause most teams miss
- Authority and form tables, from test licence to import licence
- The India layer and the rules written for AI
- A 12-point readiness checklist you can run this week
Get the reference edition
Enter your work email. The download starts on the next screen.