# CDSCO Finalizes Guidance for AI Medical Device Software > Source: > Published: 2026-07-29 12:24:08+00:00 # CDSCO Finalizes Guidance for AI Medical Device Software India's Central Drugs Standard Control Organisation published final Medical Device Software guidance on July 21, including provisions for AI and machine-learning systems. It maps standalone software to Classes A through D by clinical consequence, explains licensing and submission pathways, and calls for lifecycle controls covering bias, drift, cybersecurity, algorithm changes and post-market performance. India's Central Drugs Standard Control Organisation published final guidance on July 21 for software regulated as a medical device under the Medical Devices Rules, 2017. The 62-page document applies to Medical Device Software, including in-vitro diagnostic software, and includes specific expectations for artificial-intelligence and machine-learning systems. The document is guidance rather than a replacement for the governing statute or rules. CDSCO says not every piece of software used in healthcare is a medical device: intended medical purpose and claimed use remain the starting points for deciding whether the framework applies. ### Risk class follows the clinical consequence CDSCO retains the four MDR-2017 risk classes: Class A for low risk, B for low-moderate risk, C for moderate-high risk and D for high risk. Software that drives or influences a hardware medical device generally follows that device's class. For standalone software, the guidance combines two questions: how serious the patient's situation is and whether the output treats or diagnoses, drives clinical management, or only informs it. Software used for treatment or diagnosis in a critical situation maps to Class D; software that merely informs management in a non-serious situation maps to Class A. The guidance also warns that software used by non-clinical users in a serious situation may need to be treated as operating in a critical situation when specialist support is absent. ### AI systems need a documented change path Applications are expected to describe the analysis method, including whether an algorithm is fixed or adaptive, along with users, patient populations, deployment settings, inputs, outputs and the software-development lifecycle. The risk file should address dataset selection, external validation, cybersecurity, bias, misuse, residual risk and indirect harm from erroneous or delayed information. For systems that may change after approval, CDSCO says an Algorithm Change Protocol may document data governance, monitoring metrics, retraining, software updates, rollback triggers and user communication. This does not amount to blanket approval for self-updating models; it creates an evidence trail for assessing whether changes preserve safety and intended use. ### Monitoring continues after release The post-market plan must be proportionate to the device's risk. For AI-based software, the guidance expects monitoring for performance drift, bias, false outputs, clinical safety signals and user feedback, alongside complaint handling, adverse-event reporting, patch tracking and cybersecurity monitoring. It also calls for real-world evidence from Indian healthcare settings and documented controls for privacy, consent, interoperability and traceability. For practitioners, the main implementation consequence is that model evaluation cannot stop at an offline validation score: the regulatory file must connect the intended use, target population, change process and production monitoring to the clinical risk the software creates. ## Key Points - 1CDSCO's July 21 guidance applies MDR-2017 pathways to Medical Device Software, including AI/ML and in-vitro diagnostic software. - 2Standalone software is classified from A to D using the seriousness of the clinical situation and how strongly its output affects care decisions. - 3AI developers are expected to document bias, drift, cybersecurity, dataset selection, algorithm changes, rollback and post-market performance. ## Scoring Rationale The guidance gives AI medical-device teams a concrete Indian regulatory map for classification, licensing, change control and post-market monitoring. Its practitioner impact is high for healthcare AI in India, although it clarifies an existing MDR-2017 framework rather than creating a new statute. ## Sources Primary source and supporting public references used for this report. Practice with real Health & Insurance data 90 SQL & Python problems · 15 industry datasets 250 free problems · No credit card [See all Health & Insurance problems](/problems/datasets/health)