Software as a Medical Device (SaMD), especially
AI/ML-enabled SaMD, is reshaping diagnosis, monitoring, triage and clinical
decisions. Regulators worldwide are racing to balance innovation with patient
safety, and India is no exception. This post summarises the regulatory
expectations you need to design, document, and market SaMD in India (with
practical compliance steps), looks briefly at the market context, and shows how
Titans Medical Consulting can help you cross the finish line.
Why SaMD matters now
Globally and in India, SaMD growth is driven by digital
health adoption, remote monitoring, and AI-assisted diagnostics. Regulators and
public-health bodies recognise that AI/ML-enabled software is no longer “nice
to have” — it’s part of mainstream care delivery, which increases both
opportunity and regulatory attention. For India, NDHM and other national
digital health initiatives are accelerating uptake of digital tools and
highlighting interoperability, data security and lifecycle governance as top priorities.
How CDSCO (India) treats SaMD — the regulatory baseline
- SaMD
falls under the Drugs & Cosmetics Act / Medical Devices Rules, 2017.
India regulates medical devices (including stand-alone software that has a
medical purpose) under these rules; CDSCO refers to the IMDRF definition
of SaMD when deciding whether a software qualifies as a medical device.
That means SaMD is not treated as an “app” separate from device law if it
meets the IMDRF definition.
- Risk-based
classification aligned with IMDRF. India has moved towards IMDRF’s
risk-based approach for SaMD classification (how the software output is
used in clinical decision-making determines risk). Expect CDSCO to
evaluate SaMD along those lines for premarket requirements and clinical
evidence needs.
- Documentation
and compliance expectations. CDSCO’s public materials and FAQs make
clear that SaMD must meet labelling, registration and import/manufacture
rules, and that there are no blanket exemptions for standalone software.
Prepare to submit device description, intended use, risk classification,
clinical evaluation (as applicable), software lifecycle documentation and
quality systems evidence.
Cybersecurity — what regulators expect (pre-market and
post-market)
Regulators globally (and Indian cyber authorities) emphasise
cybersecurity as an integral, life-cycle activity — not an afterthought.
- Design
with security built in. The FDA and other regulators ask manufacturers
to incorporate cybersecurity risk management into design controls and
documentation (threat models, secure architecture, authentication,
encryption, update mechanisms, third-party component controls). This is
expected in premarket submissions where cybersecurity risk can affect
safety and effectiveness.
- Post-market
vigilance and vulnerability handling. Regulators require a documented
process for monitoring vulnerabilities, patching/updates, coordinated
disclosure, and timely mitigation. Post-market cybersecurity program
elements (monitoring sources, incident response, customer communication)
are treated as part of ongoing device safety.
- India:
national cyber posture and health ecosystem controls. CERT-In and
MeitY advisories highlight the healthcare sector as high-risk and provide
incident/coordination frameworks; India’s National Digital Health
initiatives also stress interoperability and data protection practices
(which intersect with device cybersecurity). Indian manufacturers should
align device cybersecurity programmes with CERT-In expectations and NDHM
interoperability/cyber hygiene principles.
Practical checklist (cybersecurity):
- Threat
modeling, secure architecture and SBOM (software bill of materials).
- Secure
update/patch mechanism and version control tied to your QMS.
- Authentication,
encryption, logging and data minimisation based on intended use.
- Vulnerability
monitoring, coordinated disclosure policy and an incident response plan.
- Evidence
of security testing and third-party component verification for regulatory
submission.
These items are commonly requested by regulators during
premarket review or expected during inspections.
AI/ML algorithms in SaMD — regulatory expectations and
lifecycle control
AI/ML brings model drift, data-bias and explainability
concerns that regulators explicitly watch for:
- Clinical
evaluation and evidence: IMDRF and other regulators expect clinical
evaluation proportional to risk — clearly documented validation/
performance metrics, training/validation datasets, and justification that
the AI model is safe and effective for the intended population. Changes to
algorithms (retraining, adaptive learning) may trigger regulatory
notifications or re-evaluation.
- Transparency,
explainability and human oversight: WHO and regulators emphasise
ethical design, human oversight, and documented governance for AI
decision-support systems. Explainability isn’t a single technical cure —
it’s a program: you must document limitations, intended users, and
safe-use conditions.
- Change-control
for AI models: Any change that affects model output, performance or
intended use requires analysis under your software change management
process; some changes may require fresh clinical evidence or
reclassification. Maintain a clear SaMD lifecycle record: data provenance,
training logs, performance monitoring and a rollback plan.
Practical checklist (AI/ML SaMD):
- Dataset
governance (representativeness, consent where required, labelled data
quality).
- Performance
metrics (sensitivity/specificity, AUC, calibration) and clinical
validation plan.
- Bias
assessment and mitigation strategies.
- Model
management: versioning, monitoring, retraining criteria and notification
triggers.
- User
instructions, limitations and human-in-the-loop guidance in labelling.
How to prepare a CDSCO-ready SaMD submission (practical
roadmap)
- Classify
the SaMD per IMDRF principles and document the classification rationale.
- Assemble
technical file: device description, software architecture, SBOM, risk
analysis (including cybersecurity), usability/HF, and clinical evaluation
proportional to risk.
- Quality
system evidence: tie software development, verification &
validation, change control, complaint handling and post-market
surveillance into your QMS.
- Security
and data protection: include threat models, penetration testing
reports, update mechanism, data flow diagrams and privacy compliance
mapping (NDHM, DPDP/DP rules where applicable).
- Post-market
plan: monitoring, vulnerability handling, periodic performance
reporting (for AI drift), and a clear communication plan for
users/authorities.
Common pitfalls
- Treating
cybersecurity as a checkbox instead of a lifecycle program;
- Using
non-representative training data without bias checks;
- Poorly
documented change control for algorithm updates;
- Submitting
incomplete clinical evidence for higher-risk SaMD;
- Missing
coordination with national cyber/health initiatives (NDHM, CERT-In).
How Titans Medical Consulting can help
Titans Medical Consulting specialises in regulatory strategy
and dossier readiness for medical devices and digital health products. We
offer:
- SaMD
classification & regulatory gap analysis mapped to CDSCO/IMDRF
expectations.
- Submission-ready
technical files (device description, software lifecycle, clinical
evaluation, cybersecurity & post-market plans).
- Regulator
liaison & submission management to reduce rounds of queries and
accelerate review timelines.
Conclusion
SaMD, especially AI/ML SaMD, is exciting but heavily regulated.
For manufacturers in India, the route is increasingly mature: utilize IMDRF
principles (accepted by CDSCO), design secure software from the outset, prepare
proportionate clinical and cybersecurity evidence, and manage AI models as
controlled, auditable products. Aligning your QMS, cybersecurity programme and
clinical evaluation plan will materially reduce regulatory friction and protect
patients, which is the whole point.
Sources:
- Medical
Devices Rules, 2017 – CDSCO.
- CDSCO
guidance / FAQs and related CDSCO materials on SaMD and medical devices.
- IMDRF
SaMD working group documents (clinical evaluation, classification
principles).
- FDA –
SaMD / Digital Health and Cybersecurity guidance pages
- WHO
guidance on Ethics & Governance of AI for Health.