The inspection team arrived at 9 AM. Three CDSCO officials, risk-based audit checklists in hand, walked into Vikram Rao's ventilator manufacturing facility in Hyderabad. Vikram had been confident. His ISO 13485 certification was current. His documentation files were organised. His production team had run through every process the week before. What he had not prepared for was the auditor's first question: "Show me your risk management traceability matrix — from hazard identification to production floor controls, linked to your Device Master File."
The binder Vikram produced covered hazard identification well. It said almost nothing about production floor controls. The audit was paused. The MD9 application was placed on hold pending supplementary documentation. Fourteen weeks and a complete risk file revision later, Vikram's license was granted. His competitors — two of whom had prepared the traceability matrix he had missed — had been manufacturing and selling for three months before him.
📑 Quick Navigation
- What Is the CDSCO MD9 Manufacturing License?
- Class C and D Devices — Classification and Risk
- Form MD7 and the Central Licensing Authority Pathway
- MD9 vs MD5 — Key Differences
- Complete Documentation Checklist
- 8-Step MD9 License Application Process
- The On-Site Facility Audit — What to Expect in 2026
- License Validity and Retention
- Frequently Asked Questions
What Is the CDSCO MD9 Manufacturing License?
The CDSCO MD9 manufacturing license is the legal authorisation required to manufacture Class C and Class D medical devices for sale and distribution in India. It is issued under the Medical Devices Rules, 2017 (MDR 2017) by the Central Licensing Authority — CDSCO, New Delhi — and represents the most rigorous manufacturing license pathway in India's medical device regulatory framework.
Unlike the MD5 license for lower-risk Class A and B devices, which is processed by the State Licensing Authority, the MD9 license is a central government authorisation. Its scope reflects the nature of the devices it covers: products that are implanted in the human body, that support life-critical functions, or that deliver therapeutic or diagnostic energy with the potential for serious adverse outcomes if they fail.
No entity may legally manufacture, offer for sale, stock, or distribute Class C or Class D medical devices in India without a valid MD9 license. The penalties for non-compliance under MDR 2017 and the Drugs and Cosmetics Act include product seizure, facility closure, financial penalties, and criminal liability for responsible persons within the organisation.
Class C and D Devices — Classification and Risk
The MD9 license covers India's two highest-risk medical device classes. Understanding precisely what distinguishes these classes — and why the regulatory requirements are proportionally demanding — is essential before you begin any application process.
| Class | Risk Level | Representative Examples | Licensing Authority |
|---|---|---|---|
| C | Moderate to high risk | Cardiac stents, X-ray machines, MRI machines, ventilators, infusion pumps, bone fixation implants, dialysis equipment | Central Licensing Authority (CLA) — MD9 |
| D | High risk | Drug-eluting stents, implanted pacemakers, artificial heart valves, artificial joints, cochlear implants, deep brain stimulators | Central Licensing Authority (CLA) — MD9 |
The defining characteristic of Class C and D devices is their proximity to life-critical systems. Class C devices interact with or support major physiological functions — cardiovascular, respiratory, musculoskeletal. Class D devices are implanted in the body or are otherwise integral to sustained life support. Device failure in either class carries a direct and serious risk of patient harm or death. This is why the MD9 process mandates on-site facility inspection, live audit of manufacturing and QMS controls, and clinical performance evidence that goes beyond what lower-risk device applications require.
Form MD7 and the Central Licensing Authority Pathway
The MD9 application is submitted using Form MD7 through the SUGAM portal, directed to the Central Licensing Authority at CDSCO, New Delhi. The CLA pathway is structurally different from the SLA pathway used for MD5 applications in several important ways — longer timelines, mandatory on-site inspection, deeper technical review, and a higher documentation standard throughout.
MD9 vs MD5 — Key Differences Manufacturers Must Understand
Manufacturers who have previously held an MD5 license and are expanding into Class C or D devices frequently underestimate how different the MD9 process is. The two licenses are not simply different tiers of the same process — they represent fundamentally different regulatory engagements.
| Dimension | MD5 (Class A/B) | MD9 (Class C/D) |
|---|---|---|
| Issuing authority | State Licensing Authority | Central Licensing Authority (CDSCO) |
| Application form | Form MD3 | Form MD7 |
| Facility inspection | May be waived for Class A | Mandatory — no exceptions |
| Audit type | Sampling or desk review | Full risk-based on-site audit |
| Clinical evidence | Performance data sufficient | Clinical performance evaluation required |
| Typical timeline | 4–10 weeks | 12–24 weeks |
| Post-market requirements | Standard vigilance | Enhanced vigilance, periodic safety reviews |
Complete Documentation Checklist
The MD9 technical dossier is the most demanding documentation exercise in India's medical device regulatory framework. It must be comprehensive, internally consistent, and structured to survive a live audit review — not just a desk review. Every section of the dossier will be tested against physical evidence at your facility during the inspection.
Core Documents Required for All MD9 Applications
- Covering letter addressed to the Central Licensing Authority with complete application details and device scope
- Organisation identity proof — Certificate of Incorporation, UDYAM Aadhaar, PAN card, or equivalent
- Proof of premises — Sale Deed or Rent/Lease Agreement establishing legal occupation of the manufacturing facility
- Dimensioned building layout plan — room-by-room drawings showing equipment locations, cleanroom classifications, material flows, personnel flows, and utility runs
- Plant Master File — complete description of the manufacturing facility including infrastructure, utilities, environmental controls, HVAC validation data, and contamination control measures
- Device Master File — full technical specifications, design history file, engineering drawings, manufacturing process description, production controls, and finished device acceptance criteria
- Essential Principles Checklist — aligned with Schedule I of MDR 2017 and all applicable Indian and international standards for the device type
- Risk Management File — fully compliant with ISO 14971 (current edition), with complete traceability from hazard identification through risk estimation, risk evaluation, risk control measures, and production and post-production controls
- ISO 13485 certificate — valid, in-scope for the specific device category, issued by a NABCB-accredited or internationally recognised certification body
- Clinical Performance Evaluation report — demonstrating clinical safety and performance evidence appropriate to the device class and intended use
- Biocompatibility evaluation — compliant with ISO 10993 series for all patient-contacting materials
- Sterilisation validation documentation — applicable for sterile Class C and D devices
- Qualification and competency documentation for manufacturing, quality control, and technical personnel
- Audit reports from recognised testing laboratories or notified bodies
- Certificate of Analysis for three consecutive production batches
- Environmental compliance documentation
- Labelling — complete proposed labelling reviewed against MDR 2017 Schedule IV requirements
- Fee payment receipt (challan) generated through SUGAM at application submission
Additional Requirements for Implantable and Life-Support Class D Devices
- Implant card or patient implant record system documentation
- Long-term biocompatibility and material durability data
- Accelerated ageing and shelf-life validation studies
- Post-market clinical follow-up plan with defined data collection protocols
- For software-enabled devices — cybersecurity documentation, algorithm validation datasets, and software lifecycle documentation
8-Step MD9 License Application Process
Below is the complete pathway from classification confirmation through to license receipt, with the specific actions at each stage that determine whether your application moves efficiently or stalls.
Formally establish your device's class under MDR 2017 before any other action. If your device has features that could place it at the Class B/C boundary, obtain a written classification opinion from a regulatory specialist. Filing Form MD7 for a device that the CLA subsequently reclassifies creates significant delays and in some cases requires a complete resubmission.
Compile the complete documentation package — ISO 13485 certificate, ISO 14971 risk management file with full traceability, Essential Principles Checklist, Plant Master File, Device Master File, clinical performance evaluation, biocompatibility data, sterilisation validation (if applicable), three-batch Certificate of Analysis, and all personnel and environmental compliance documentation. Do not open SUGAM until every document is complete and internally reviewed.
Before submitting Form MD7, walk through your manufacturing facility, QMS, and documentation using the same risk-based audit checklist that CDSCO inspectors use for your device class. Identify gaps in risk traceability, production controls, personnel records, and infrastructure documentation. Close every gap before submission — not during the CLA's actual inspection visit.
Log in to SUGAM, select the Form MD7 application for Class C/D manufacturing license, and complete all fields with absolute accuracy. Every field — facility address, device name, device class, manufacturer details — must match your supporting documents exactly. Pay the prescribed application fee and upload all documents in the correct format. Review the portal's completeness checklist before final submission.
CDSCO's central technical review team reviews your submitted dossier. The review is substantive — it covers the completeness and quality of your risk management file, the adequacy of your clinical performance evidence, labelling compliance, and the consistency of your documentation across all sections. Queries raised at this stage must be responded to promptly and completely. Every day of delayed query response is a day added to your overall timeline.
CDSCO officials will schedule and conduct an on-site inspection of your manufacturing facility. This is not optional and cannot be waived. Inspectors will review your production floor against your Plant Master File and Device Master File, verify that risk control measures from your ISO 14971 file are physically implemented, audit your QMS documentation, review personnel records, and assess environmental controls. Prepare your entire team — not just your regulatory officer.
Inspectors will record observations — findings requiring corrective action before license grant. Respond to every observation with specific, evidenced corrective actions. Vague or incomplete responses reopen the observation cycle and extend your timeline. Where a corrective action requires physical changes to the facility or process, document those changes with photographic or procedural evidence and submit with your response.
On satisfactory completion of dossier review, facility inspection, and observation closure, the Central Licensing Authority issues your MD9 manufacturing license. Verify all details on the license — facility address, device name, class, and license number — against your application before beginning any commercial production. File the original license securely and display a certified copy at your facility as required.
The On-Site Facility Audit — What to Expect in 2026
The on-site inspection is the stage that determines most MD9 outcomes. It is also the stage where the largest number of applications encounter avoidable delays. Understanding what 2026-era CDSCO inspectors focus on — and how to prepare your facility, team, and documentation for their visit — is essential.
How 2026 Audits Differ from Prior Years
CDSCO's inspection approach for Class C and D devices has shifted significantly. Inspectors are now industry-trained specialists, not generalists, and they arrive with device-specific risk checklists rather than generic facility review forms. They expect live evidence — not static binders. The question is no longer "Do you have a risk management file?" but "Show me where this specific risk control measure is implemented on the production floor."
What Inspectors Focus On
- Risk traceability — can every hazard in the ISO 14971 file be traced to a specific production control and a post-market monitoring activity?
- QMS implementation — is the ISO 13485 system running as documented, with current records of nonconformances, CAPAs, internal audits, and management reviews?
- Personnel — are the people on the production floor qualified as documented, and can they explain their role in the quality management system?
- Infrastructure — does the facility match the Plant Master File? Are cleanroom certifications current? Are equipment calibration records up to date?
- Process validation — are manufacturing processes validated, with records available for inspector review?
- Labelling and traceability — is every batch traceable from raw material through to finished device and labelling?
- For software-enabled devices — is the software development lifecycle documented, are cybersecurity controls implemented, and is the algorithm validation evidence available?
License Validity and Retention
The CDSCO MD9 manufacturing license has no fixed expiry date — once issued, it remains valid indefinitely. But this permanence is conditional, and the conditions extend well beyond the five-year retention fee requirement.
Five-Year Retention Fee
A license retention fee must be paid to the Central Licensing Authority every five years from the date of issue. Failure to pay allows the license to lapse. Unlike some state-level processes where reinstatement is straightforward, reinstating a lapsed MD9 license can require a fresh application, including a new facility inspection — a timeline measured in months, not days. Track your retention due date from day one.
Ongoing Compliance Conditions
Beyond the retention fee, the MD9 license carries active ongoing compliance obligations. CDSCO can suspend or cancel the license if your ISO 13485 certification lapses, if your manufacturing facility changes in ways not reflected in an approved variation, if serious adverse event reporting obligations are not met, if a CDSCO surveillance inspection reveals compliance failures, or if you manufacture devices outside the scope of your licensed product list without a variation application.
Frequently Asked Questions
Can one MD9 license cover multiple Class C and D devices?
Yes. A single MD9 license can cover multiple Class C and Class D devices manufactured at the same facility, subject to the CLA's assessment of the facility's technical capability and the device-specific dossiers submitted. Each device in scope must be listed on the license. Adding a new device to an existing MD9 license requires a variation application to the CLA, not a fresh license application.
What is the typical timeline for an MD9 license in 2026?
A well-prepared MD9 application with complete documentation, no pre-inspection queries, a clean facility audit, and prompt response to post-inspection observations typically completes in 12 to 18 weeks. Applications with documentation gaps, multiple query rounds, or observations requiring physical facility changes extend to 20 to 30 weeks or beyond. Early preparation is not optional for Class C/D manufacturers — it is the primary factor that controls your timeline.
Do I need a separate MD9 license if I also manufacture Class A or B devices?
Yes. The MD5 and MD9 are separate licenses covering different device classes, issued by different authorities. A manufacturer producing both Class B and Class C devices at the same facility must hold both an MD5 (from the SLA) and an MD9 (from the CLA). There is no combined license that covers all four device classes.
What happens if my ISO 13485 certificate expires during the MD9 application process?
An expired ISO 13485 certificate will halt your application. The CLA will not grant an MD9 license without a valid, in-scope ISO 13485 certificate, and an expired certificate discovered during a facility inspection will result in the inspection being suspended until the certification is renewed. Monitor your ISO 13485 renewal date and build in sufficient lead time — ISO 13485 recertification typically takes eight to fourteen weeks from audit to certificate issuance.
Is clinical performance data always required for the MD9 application?
Yes for Class D devices, and generally yes for Class C. The clinical performance evaluation must demonstrate that the device achieves its intended clinical purpose safely and that the clinical benefits outweigh the residual risks identified in the ISO 14971 risk management file. For devices with existing international approvals (CE Mark, FDA clearance), the clinical evidence from those approvals can often form the basis of the India clinical evaluation — but it must be supplemented with any India-specific data required by the CLA and contextualised for the Indian patient population where relevant.
✓ Key Strategic Takeaways
- The CDSCO MD9 license is the mandatory manufacturing authorisation for all Class C and D medical device manufacturers in India — no exemptions apply
- Applications are filed via Form MD7 on SUGAM and processed by the Central Licensing Authority — not the State Licensing Authority
- On-site facility inspection by CDSCO is mandatory and cannot be waived — prepare your facility, team, and documentation for a live risk-based audit
- Risk traceability — from hazard identification to production floor controls to post-market monitoring — is the single most scrutinised element of the 2026 audit
- Clinical performance evaluation is required for Class C and D devices, not just technical performance data
- The MD9 process typically takes 12 to 24 weeks — start 6 months before your target launch date, not 6 weeks before
- A five-year retention fee is required to maintain an active MD9 license — track this date from day one of license grant
- Post-market vigilance obligations for Class C/D manufacturers include mandatory ASURs, defined adverse event reporting windows, and 48-hour recall filing — build these systems before you need them
Your Action Plan
The CDSCO MD9 manufacturing license is among the most demanding regulatory authorisations in Indian industry. It demands real infrastructure, genuine quality management, and documentation that reflects how your facility actually operates — not how you wish it did. The manufacturers who navigate it successfully do so because they prepare thoroughly, engage the process early, and treat the audit as a measure of their actual compliance rather than a paperwork exercise.
The commercial reward for that preparation is access to a market that remains structurally protected from non-compliant competition. Government procurement, institutional hospital buyers, and export markets all require MD9-certified products. Your certified competitors are already there.
Begin your classification review today. Assess your ISO 13485 scope. Start your risk traceability audit. The manufacturers who prepare now are the manufacturers who receive their licenses — and their market access — on the timelines their business plans require.