CDSCO Classification for SaMD in India: Your 2026 Guide

Rohit Verma's startup had spent two years building an AI-powered fundus imaging analysis tool for diabetic retinopathy detection. It had been validated on 150,000 images. It had attracted two hospital pilots in Hyderabad. When Rohit approached a regulatory affairs consultant to begin the CDSCO licensing process, the consultant's first question was simple: "Which class is it?" Rohit said he thought it was Class B. His co-founder said Class C. His product manager said they hadn't checked yet.

The consultant checked. It was Class C. The difference meant filing Form MD7 instead of Form MD3, submitting to the Central Licensing Authority instead of the State Licensing Authority, preparing a clinical performance evaluation, and planning for a mandatory on-site audit. The documentation scope was roughly three times larger. The timeline was six to eight months longer. And the application fee was higher. Rohit had built his launch plan around a Class B assumption. The re-planning set his commercial launch back by nine months.

What Is SaMD? Definition and Regulatory Context

Software as a Medical Device (SaMD) is standalone software that performs a medical function — diagnosis, monitoring, prognosis, treatment guidance, or clinical decision support — without being embedded in or dependent on a physical medical device to perform that function. It runs on general-purpose computing infrastructure: smartphones, laptops, cloud platforms, hospital information systems, or standalone computing devices.

The distinction between SaMD and Software in a Medical Device (SiMD) is regulatory and commercially significant. SiMD is software embedded in a physical device — the firmware that runs a ventilator, the control software in an infusion pump. It is regulated as part of the device it controls. SaMD, by contrast, is regulated independently as a medical device in its own right, because its medical function is performed through the software's outputs rather than through the physical action of a device.

Applications of SaMD in Healthcare

SaMD's clinical and commercial footprint in India is growing rapidly across four primary application domains. Understanding which domain your product sits in is the first step toward understanding its likely CDSCO classification.

Why CDSCO Classification Determines Everything

Your SaMD's CDSCO class is not an administrative label — it is the variable from which everything else in your regulatory strategy flows. It determines the license type you apply for, the authority you apply to, the documentation you need to prepare, whether your facility will be inspected, and your overall licensing timeline. Getting it wrong — in either direction — has material consequences.

CDSCO SaMD Classification Overview

CDSCO applies the same four-class risk-based classification system to SaMD as to physical medical devices under MDR 2017. Classification is based on the potential severity of patient harm if the software fails or produces incorrect outputs, the proximity of the software to clinical decision-making, and whether it operates in real time on active patient data or analyses pre-recorded data retrospectively.

Class A SaMD — Low Risk

Class B SaMD — Low to Moderate Risk

Class C SaMD — Moderate to High Risk

Class D SaMD — High Risk

Which CDSCO License Does Your SaMD Need?

Once you have confirmed your SaMD's CDSCO class, the licensing pathway follows directly. Your classification determines whether you apply to the State Licensing Authority or the Central Licensing Authority, which form you use, and what documentation you need to prepare.

Frequently Asked Questions

Is all healthcare software considered SaMD by CDSCO?

No. CDSCO distinguishes between software that performs a medical function and software that supports administrative or operational healthcare functions. Hospital management systems, appointment scheduling software, billing platforms, and general health information storage systems are not SaMD. The defining criterion is whether the software's intended purpose is to diagnose, monitor, predict, prognose, or treat a medical condition — or to support a clinical decision about a patient's health. Software that does not meet this criterion is not a medical device under MDR 2017 and does not require a CDSCO license.

If my SaMD is only available as a mobile app, does it still need a CDSCO license?

Yes, if it meets the definition of a medical device. The platform — whether mobile app, web application, desktop software, or cloud service — does not determine whether a CDSCO license is required. What determines licensing is the software's intended medical use. A mobile app that tracks steps or general wellness does not require a CDSCO license. A mobile app that analyses ECG data from a connected sensor to detect cardiac arrhythmias — even if the app itself is free — requires a CDSCO license because it is performing a diagnostic medical function.

My SaMD has CE Mark and FDA 510(k) clearance — do I still need a CDSCO license?

Yes. CE Mark and FDA clearance do not substitute for CDSCO licensing. India's regulatory framework for SaMD operates independently, and CDSCO requires its own licensing process under MDR 2017 regardless of international approvals the product may hold. The CE and FDA documentation can be used as supporting evidence in the CDSCO technical dossier — particularly for the clinical performance evaluation — but the CDSCO license application must be filed and approved separately before the SaMD can be marketed in India.

How does CDSCO classify AI-enabled SaMD that may improve or change its behaviour over time?

Classification is determined by the software's intended use and risk profile at the time of application, based on its current validated functionality. An AI-enabled SaMD is classified by what it is designed and validated to do — not by its theoretical capability after future retraining. However, CDSCO's 2026 guidance on living technical files means that any significant change to the algorithm's clinical function or performance characteristics — through retraining, architecture change, or expanded intended use — requires a variation application that triggers a re-evaluation of the classification and the licensing documentation.

Can a SaMD manufacturer produce both Class B and Class C products under a single CDSCO license?

No. Class B SaMD manufacturing requires an MD5 license from the State Licensing Authority, while Class C SaMD manufacturing requires an MD9 license from the Central Licensing Authority. These are separate licenses from different authorities. A company manufacturing both Class B and Class C SaMD at the same facility must hold both licenses. The technical documentation — Plant Master File, QMS, and Device Master Files — for both classes can originate from the same facility, but the licensing applications are separate and the licenses are issued independently.

Your Classification Action Plan

CDSCO's classification framework for SaMD is logical, risk-based, and entirely navigable — once you know where your product sits. The manufacturers and importers who enter the Indian SaMD market efficiently are those who confirm their classification early, build their regulatory plan around the correct license type from day one, and do not discover their class after their application is in review.

Rohit's retinopathy tool eventually received its MD9 license. The nine-month delay was painful, but it was entirely avoidable. Classification confirmation is a half-day task. The commercial and timeline consequences of getting it wrong are measured in quarters.

Confirm your SaMD class today. Map your license pathway. Begin your documentation preparation based on the correct class — not the one you hoped for. The SaMD developers who get this right from the start are the ones who reach Indian patients on the schedule their products and patients deserve.