CDSCO Issues Final Medical Device Software Guidance to Strengthen MDSW Regulation

The Central Drugs Standard Control Organisation (CDSCO) has released a final guidance document for Medical Device Software (MDSW) to provide clearer regulatory expectations under the Medical Devices Rules, 2017. This framework addresses the rapid evolution of AI, cloud computing, and connected health technologies by establishing rigorous standards for quality, safety, and compliance. For the medical device sector, this move ensures that manufacturers, importers, and researchers have a structured path for documentation, quality management, and market approval in India.

The CDSCO released the final guidance after revising a draft from October 21, 2025, incorporating stakeholder feedback and expert consultations to address the complexities of modern digital health. Dr. Rajeev Singh Raghuvanshi, the Drugs Controller General of India, stated that the document outlines classification principles, safety requirements, and post-market obligations to facilitate regulatory compliance while supporting innovation and patient safety. The guidance specifically covers software that performs medical functions independently or alongside connected devices, including AI-enabled platforms for analyzing patient data and supporting clinical decisions, while excluding software used purely for general wellness or enterprise resource planning.

Compared to previous versions, the final guidance significantly expands expectations for quality management systems, software lifecycle management, and cybersecurity. Manufacturers are now expected to maintain a Software Bill of Materials (SBOM), establish documented quality systems, and continuously monitor device performance across various healthcare settings. The document also places a heavy emphasis on interoperability, digital traceability, and secure, consent-based health data access to ensure privacy protection and reliable information exchange within the healthcare ecosystem.

To ensure practical application within the country, the CDSCO recommends that software validation consider specific Indian clinical workflows, healthcare infrastructure, and variations in user expertise. The guidance further details requirements for technical documentation, usability validation, cybersecurity risk assessments, and AI bias evaluations. By providing these specific benchmarks, the regulator aims to streamline the approval process for Medical Device Software and In-Vitro Diagnostic (IVD) software, ensuring that digital health innovations are both safe and effective for use in India's diverse medical landscape.