The national telemedicine consultation helpline e-Sanjeevani has integrated an AI-enabled clinical decision support system for healthcare providers. This is just the latest example of AI’s increasing integration into medicine and medical care worldwide, and in India. As AI begins to influence clinical decisions, such as reassurance, referrals, or investigations, its regulation has now become an urgent patient-safety question. The Central Drugs Standard Control Organisation’s (CDSCO) July 2026 guidance on software in medical devices becomes important in this context. The document brings software (including AI-enabled) used for a medical purpose into a clearer approval pathway. However, it explicitly says that it reflects existing practice and is not a new regulatory control.
What is MedTech?
Medtech refers to instruments, apparatus, implants, software, or related devices used for diagnosis, prevention, monitoring, or treatment, whose primary action is not achieved through pharmacological, immunological, or metabolic means. A thermometer, glucometer, blood pressure apparatus, pacemaker, dialysis machine, and CT scanner are considered MedTech. Software is the set of instructions that makes a digital device work. A digital blood-pressure monitor, for example, uses embedded software to control cuff inflation, read pressure sensors and calculate the final BP value. Within software are algorithms, which are step-by-step rules that convert inputs into outputs.
AI (built on advanced algorithms such as machine learning and deep learning models) learns patterns from large amounts of data and uses them to make inferences. All AI depends on algorithms, but not every algorithm is AI. Netflix and YouTube recommendations are familiar examples of algorithms. But a medical algorithm is not a film recommendation. AI may reduce workload, improve consistency and extend specialist support to places where it is scarce. But a false positive can send a healthy person through anxiety and unnecessary tests, while a false negative can do the opposite. A model trained on one population, or one hospital network, may behave differently elsewhere. So, a model that works in Boston is not automatically ready for Bihar.
Risk before labels
India currently regulates medical devices by stretching the Drugs and Cosmetics Act, 1940, which was intended mainly to penalise spurious drugs. In 1982, an amendment allowed the government to classify devices as ‘drugs’. The Medical Devices Rules, 2017, established the first dedicated rulebook. The rules introduced four classes - Class A for low risk, B for low-to-moderate risk, C for moderate-to-high risk, and D for high risk. The manufacture of devices under classes A and B is generally handled by State licensing authorities, while the central authority regulates manufacture of devices under classes C and D as well as the import of all classes. In 2020, all devices meant for medical use, including software, came under the law. While AI does not create a fifth class, the risk it poses depends on its intended use and the consequences of incorrect output.
The July guidance translates this risk-based approach classification specifically to software as Software in a Medical Device (SiMD - embedded in or controlling hardware), or Software as a Medical Device (SaMD -where the software itself performs the medical function). Software that only stores or transfers patient information is treated differently from one that influences diagnosis or treatment. Standalone medical software is assessed according to both the severity of the clinical situation and the extent to which its output guides medical decisions. Software intended solely for general wellness or routine tracking of body parameters may remain outside the medical-device framework.
Proof followed by surveillance
Validation for AI-enabled devices is sought uniquely. The CDSCO seeks evidence of a sound clinical association between the output and the condition; whether the software technically produces the intended result, and whether it performs clinically in the population and setting (deployment) where it will be used.
Developers are expected to describe training, validation and test datasets, including demographic, geographic and clinical diversity when using AI. Models developed outside India may require justification and validation in representative Indian populations. Bias, generalisability and subgroup performance matter because even ‘95% accurate’ means little without asking — accurate at what, in whom, and against which reference standard? Approval is also a continuous process as algorithms can be retrained, software can be upgraded, while performance can drift. The CDSCO discusses change in management, retraining, rollback, version control and post-market surveillance of the system.
Guidelines, not law
India’s AI regulation is outlined in policy papers of NITI Aayog, the Indian Council of Medical Research (ICMR), and the Ministry of Electronics and Information Technology. In 2018, NITI Aayog released the National Strategy for Artificial Intelligence, which named health care a priority. ICMR then, in 2023, issued ethical guidelines for AI in health care, stressing the need for accountability, fairness and patient autonomy. In November 2025, the Electronics & IT Ministry’s AI Governance Guidelines chose not to propose a separate AI law, leaving each sector’s regulator to act.
In February 2026, the Health Ministry launched the Strategy for Artificial Intelligence in Healthcare for India (SAHI), which addresses governance, data, validation, deployment and monitoring of AI across healthcare. The United States Food and Drug Administration (FDA) has developed AI-specific lifecycle approaches, including predetermined change-control plans for defined future modifications. Europe combines medical-device regulation with the EU AI Act, which adds requirements for high-risk AI such as risk management, data quality and human oversight.
Way forward
The new guidance raises a larger question: can a technology that decides who is sick and who is sent home be governed by guidelines alone? India’s guideline-led approach has enabled regulators to move quickly without waiting for Parliamentary legislation. While its insistence on Indian data is ahead of many similar guidelines elsewhere, a dedicated statute for AI-enabled medical devices could make Indian validation mandatory for high-risk tools, clarify liability, and create a public registry of approved AI devices.
The question is whether technologies that can influence life-and-death decisions should continue to rely on guidance built on an 80-year-old law or be governed by a clear statutory framework that patients and clinicians can trust.
(Dr. C. Aravinda is an academic and public health physician. The views expressed are personal. aravindaaiimsjr10@hotmail.com)