CDSCO Medical Device Registration in India: What's Changed in 2026 (And What Still Applies)

India's medical device market is one of the fastest-growing in the world, and the Central Drugs Standard Control Organization (CDSCO) has kept pace — issuing a wave of regulatory clarifications, new software guidance, and process improvements since our original guide was published in 2024. If you read our original CDSCO registration guide, most of the foundational information still holds. But enough has evolved that it's worth a thorough update before you start building your India submission dossier.

Let's go through what's new, what's changed, and what you need to know before entering one of Asia's most important medical device markets.

The Foundation Hasn't Changed — But the Details Have

The core regulatory framework remains the Medical Devices Rules, 2017 (MDR 2017), enforced by CDSCO under the Ministry of Health and Family Welfare. Devices are still classified into four risk-based classes:

• Class A — Low risk
• Class B — Low-to-moderate risk
• Class C — Moderate-to-high risk
• Class D — High risk

Applications for new devices are still submitted in Form MD-14 (Class A/B) or Form MD-15 (Class C/D) through the online Sugam portal, and licenses are still issued in Form MD-5 (Class A/B) or Form MD-6 (Class C/D), valid for five years.

What has changed is the operational detail around software devices, post-approval procedures, labeling, and the efficiency of the Sugam portal itself. Here's a breakdown.

1. Software as a Medical Device (SaMD): India Now Has a Framework

This is the single biggest development since our original post, and it directly affects anyone developing digital health tools, AI-driven diagnostics, clinical decision support software, or any standalone software intended for a medical purpose.

In October 2025, CDSCO released a draft Guidance Document on Medical Device Software — the most comprehensive regulatory clarification India has issued for software-based devices. It establishes a clear distinction between two categories:

• SiMD (Software in a Medical Device): Software embedded in and inseparable from a physical device (e.g., firmware in a pacemaker or IVD analyzer). SiMD inherits the risk classification of the parent hardware device.
• SaMD (Software as a Medical Device): Standalone software performing a medical function independently — diagnostic apps, AI-based imaging tools, remote patient monitoring platforms, clinical decision support systems.

How SaMD is classified

SaMD classification under the draft guidance follows a risk-based approach using three criteria: the medical purpose of the software, the significance of the information it provides for clinical decision-making, and the severity of the condition being addressed. The result maps to the same Class A–D system:

• Class A — Online registration only; no licensing required, fastest route to market.
• Class B — State licensing authority approval; may require a notified body audit to verify QMS compliance (typically 60–90 days).
• Class C/D — Central Licensing Authority (CDSCO) approval; full technical dossier, risk assessments, QMS evidence, and clinical data required (90–180 days depending on class).

Software used purely for administrative functions — hospital billing systems, appointment management — falls outside scope entirely.

What SaMD manufacturers need to prepare

The draft guidance introduces SaMD-specific documentation requirements beyond the standard Device Master File. These include an executive summary covering software description, versioning, lifecycle, algorithm logic, intended users, and an Algorithm Change Protocol (ACP) for AI/ML models that update post-deployment. System architecture documentation, cybersecurity risk assessments, and post-market surveillance (PMS) plans are also expected.

This aligns India more closely with international frameworks like IEC 62304 (software lifecycle) and ISO 14971 (risk management), which many global manufacturers will already be familiar with. For more on how risk management and design controls feed into your technical documentation, Qualio's guides are a useful reference.

Important: This guidance is still in draft form as of publication. The 30-day consultation period has closed, and the final version may incorporate industry feedback. Monitor cdsco.gov.in for the official release.

2. Three FAQ Addenda — Key Clarifications You Need to Know

Since the MDR 2017 took effect, CDSCO has been refining its interpretation through a FAQ series. Three significant addenda have been released since mid-2024, closing gaps that were causing real-world compliance confusion:

Addendum No. 1 (April 2025) — Addressed regulatory procedures, biocompatibility requirements, site-specific applications, and post-market surveillance obligations. If your PMS program was built around FDA 21 CFR Part 822 or EU MDR Article 83, you'll want to review this addendum to understand where India's requirements align and diverge. Our guide on post-market surveillance for medical devices covers the global PMS landscape and is a good starting point.

Addendum No. 2 (July 2025) — Provided clarity on labeling rules (particularly around language and format requirements under MDR 2017), re-import approval procedures, post-approval change processes, and general licensing. The clarification on SaMD and SiMD classifications in this addendum was especially important for digital health companies navigating India for the first time.

Addendum No. 3 (November 2025) — Focused on import license requirements for raw materials and device components, documentation requirements for authorized agents, and clarifications on importing through notified ports. This addendum also confirmed that when a company changes its authorized Indian representative, a fresh import license is required — there is currently no transfer mechanism.

Taken together, these three addenda have substantially improved regulatory transparency. If you're mid-submission or planning one, reviewing all three is worthwhile.

3. Post-Approval Changes: A More Defined Pathway

One area that had been under-specified in the original MDR 2017 framework was how manufacturers should handle changes to already-approved devices — design updates, manufacturing site changes, labeling revisions. The 2025 FAQ addenda provided much-needed clarity here.

Key points:

• Post-approval changes (PACs) must be submitted through the Sugam portal.
• Minor modifications typically take 2–4 weeks for CDSCO review.
• Endorsements added to an existing import license are only valid for as long as the base license itself — if the base license expires, all endorsements expire with it.

This last point has caught some manufacturers out, particularly those who added products to an existing license in year 3 or 4 without tracking the original expiry. Build renewal tracking into your change control processes now, not after the fact.

4. BIS Certification: An Active Deadline You Cannot Ignore

The original blog mentioned BIS (Bureau of Indian Standards) certification in passing. It now warrants a more prominent callout.

Certain medical devices must comply with Indian Standards (IS) set by BIS under what's known as the Omnibus Technical Regulation. The compliance deadline for BIS Scheme X Certification has been extended to September 1, 2026. If your device falls within the notified BIS scope, this is a hard deadline — non-compliance after that date risks market access.

Check the current BIS notification list directly at bis.gov.in to confirm whether your device is in scope, as the list is updated periodically.

5. Sugam Portal Improvements: The Process Is Getting Faster

CDSCO has invested in making the Sugam portal more efficient, and a couple of improvements are worth noting for manufacturers managing active licenses or planning submissions:

• Auto-generated compliance certificates: Market Standing Certificates and Non-Conviction Certificates — documents frequently required by global partners and notified bodies — can now be generated digitally for licensed entities directly through the CDSCO Medical Devices Portal.
• Neutral code for export: A system-generated code is now available for manufacturers exporting devices from India, simplifying the documentation trail for international shipments.
• Disposal of long-pending applications: CDSCO has announced it will be disposing of long-pending applications on the Sugam portal that are awaiting query responses. If you have active applications, check their status and respond to outstanding queries promptly.

These improvements reduce turnaround time for routine compliance activities and are a sign of CDSCO's continued modernization efforts.

6. Sterilization Loan Licenses: A Burden That's Been Removed

A quieter but practically significant change: manufacturers who outsource sterilization to a third-party facility no longer need to obtain a separate loan license for that facility, provided the sterilizer already holds a valid CDSCO license. Previously, this was mandatory regardless of the facility's existing approvals.

This reduces paperwork, speeds up time to market for smaller manufacturers, and reflects CDSCO's broader effort to ease the regulatory burden for companies operating in the Indian market.

What Still Applies: The Core Documentation Requirements

For manufacturers new to India, the documentation requirements from our original post remain in force. You'll still need:

• Device Master File (DMF)
• Plant Master File (PMF)
• Clinical evaluation report
• Risk management report (per ISO 14971)
• Performance evaluation report (where applicable)
• ISO 13485 certification or equivalent QMS accreditation
• BIS certification (where applicable — see above)
• Labeling compliant with MDR 2017 (manufacturer details, batch number, expiry date, language requirements)

For SaMD manufacturers, add the software-specific documentation requirements described in Section 1 above.

Submission Timelines: Still Class-Dependent

Review timelines haven't changed materially, though CDSCO's processing efficiency has improved for straightforward applications. Class A and B devices typically take 3–6 months from submission, with inspections adding another 1–2 months if required. Class C and D devices should be planned for 6–12 months given the detailed technical scrutiny involved, with inspections and TAC consultations potentially adding a further 2–3 months on top of that.

For SaMD specifically, Class C applications are running approximately 90–120 days and Class D 120–180 days, though these remain estimates and documentation completeness has an outsized impact on where you land in that range.

Getting Ready for CDSCO Registration in 2026 and Beyond

India remains one of the world's most important medical device markets — and increasingly, a sophisticated one. CDSCO's recent guidance activity signals a regulator that is actively aligning with global standards, from IEC 62304 for software lifecycle management to ISO 14971 for risk, and updating its processes to reduce unnecessary friction for compliant manufacturers.

For teams planning their India market entry, a few practical recommendations:

Start with classification. The device class determines everything: the application form, the documentation depth, the review timeline, and the level of CDSCO scrutiny. For SaMD companies, the October 2025 draft guidance is your starting classification framework — even in draft, it reflects CDSCO's current approach.

Document your QMS against ISO 13485 from day one. India's mandatory requirement for ISO 13485 compliance (or equivalent) means that a well-maintained quality management system is not just good practice — it's a prerequisite for market access. The same QMS evidence base that supports your FDA, EU MDR, or MDSAP submission will largely serve your CDSCO application too.

Build post-market surveillance into your plan. PMS is no longer an afterthought under India's evolving framework. CDSCO's 2025 FAQ addenda explicitly address post-market obligations, and the SaMD draft guidance introduces additional vigilance requirements for AI/ML systems that update post-deployment.

Manage your license lifecycle actively. with a 5-year retention fee cycle, endorsement expiry rules, and BIS deadline mean that compliance is not a one-time event. Build renewal triggers into your quality system so nothing expires quietly.

For teams managing multiple global submissions simultaneously, Qualio's eQMS is designed to support this kind of multi-standard, multi-market documentation environment — keeping your design controls, risk management, change control, and post-market surveillance processes connected and audit-ready.