Guidance on Medical Device Software Regulation under MDR-2017

“Indirect Tax I Indirect Tax Litigation I Customs & FTP I Central Licensing I Arbitration I Advisory”

Dated: 22.07.2026

Guidance on Medical Device Software Regulation under MDR-2017

India’s healthcare sector is rapidly embracing digital transformation, with Medical Device Software (MDSW) playing a pivotal role in diagnostics, treatment, and patient management. To ensure safety, quality, and innovation, the Central Drugs Standard Control Organization (CDSCO) has established a robust regulatory framework for MDSW under the Medical Devices Rules, 2017 (MDR-2017).

This article provides a detailed overview of the regulatory landscape, compliance requirements, and best practices for stakeholders involved in the development, import, and commercialization of medical device software in India.

What is Medical Device Software (MDSW)?

MDSW refers to software intended for medical purposes, either as a standalone product or as part of a hardware medical device. It includes:

Standalone software for diagnosis, monitoring, or treatment (e.g., AI-based diagnostic apps).
Embedded software/firmware that drives or influences hardware medical devices (e.g., software in pacemakers, insulin pumps).
Software interfacing with medical devices (e.g., mobile apps controlling blood pressure monitors).

Software not intended for medical purposes—such as general wellness apps, hospital information systems, or data encryption tools—are excluded from MDR-2017 regulation unless they perform medical functions.

Regulatory Framework and Scope

Governing Laws: Drugs & Cosmetics Act, 1940 and MDR-2017.
Applicability: All software meeting the definition of a medical device under MDR-2017, including in-vitro diagnostic (IVD) software.
Exclusions: General wellness, fitness tracking, and administrative software not intended for medical purposes.

Classification of Medical Device Software

MDSW is classified based on risk, as per MDR-2017:

Degree of Risk	Classification
Low risk	Class A
Low-moderate risk	Class B
Moderate-high risk	Class C
High risk	Class D

Risk class depends on:

Intended use (diagnosis, treatment, monitoring, etc.)
Impact on patient health (critical, serious, non-serious conditions)
Whether the software drives/influences hardware devices

Key Regulatory Requirements

1. Quality Management System (QMS)

Manufacturers must implement a QMS covering the entire software lifecycle (design, development, deployment, maintenance).
Compliance with standards such as IS/ISO 13485, IS/ISO 14971, IS/IEC 62304, and IS/IEC 82304-1 is expected.
Maintain a Software Bill of Materials (SBOM) for all components, including third-party and open-source software.

2. Cybersecurity and Data Protection

Ensure data encryption, access controls, audit trails, and protection of patient data integrity and confidentiality.
Align with India’s Digital Personal Data Protection (DPDP) Act, 2023.
Support interoperability and consent-driven data governance as per the Ayushman Bharat Digital Mission (ABDM).

3. Technical Documentation

Submit detailed device and software descriptions, intended use, user environment, and technical specifications.
Provide evidence of substantial equivalence with predicate devices, if applicable.
Include risk management reports, software verification and validation, and clinical evidence.

4. Regulatory Submissions and Licensing

Applications for manufacturing, import, and clinical investigations must be submitted via designated online portals (NSWS and CDSCO MD Online).
Licensing authorities vary by device class (State Licensing Authority for Class A/B, Central Licensing Authority for Class C/D).
Follow specific document checklists for each application type (test license, clinical investigation, manufacturing/import license).

5. Post-Market Surveillance (PMS)

Implement PMS plans proportionate to device risk class.
Monitor for adverse events, software bugs, cybersecurity threats, and AI model drift.
Report serious adverse events and corrective actions to the licensing authority within stipulated timelines.

Examples of Medical Device Software Covered by MDR-2017

Embedded firmware in pacemakers or insulin pumps
AI/ML-based diagnostic tools for cancer screening
Mobile apps controlling or monitoring medical devices
Digital therapeutics platforms for chronic disease management
Software for veterinary medical purposes

Not covered:

ERP systems, data encryption tools, general communication platforms, and software solely for teaching or administrative purposes.

Best Practices for Compliance

Define Intended Use Clearly: Ensure the clinical role, target population, user environment, and limitations are well-documented.
Adopt International Standards: Align development and QMS processes with recognized standards (ISO, IEC, BIS).
Maintain Robust Documentation: Prepare comprehensive technical files, risk assessments, and validation reports.
Plan for Lifecycle Management: Establish procedures for software updates, change management, and traceability.
Engage in Continuous Monitoring: Implement mechanisms for real-world performance monitoring, user feedback, and timely corrective actions.

Listen to this on our #YouTube Channel

In case you face any issues related to Indirect Tax-Customs, GST, Foreign Trade Policy (FTP), Arbitration matters and Central Licensing and related advisory matters in India then please feel free to get in touch with SJ EXIM Services.

We offer Legal advice and litigation support in matters related to Indirect Tax-Customs, FTP, other Indirect Tax matters & Arbitration law, all sorts of Central licensing and related matters. Come and explore the new way of doing business with us!

Source: CDSCO

Disclaimer

Handy Download:

CDSCO CircularDownload

Connect with us for more-

@ Team S J EXIM SERVICES, New Delhi, IN

CP: Ms. Shubhra Jha, Founder

Tel: +91-11-4999 2707 I +91-9999005693

Web: www.sjexim.services

EMAIL: operations@sjexim.services I shubhra@sjexim.services

Facebook: www.facebook.com/sjeximservices

LinkedIn: https://www.linkedin.com/company/90794255/admin/feed/posts/