The emergence of digital health technologies has fast-tracked the evolution of the healthcare sector. New-age healthcare products like wearables, telemedicine, and clinical decision-making tools use Artificial Intelligence (AI) and Machine Learning (ML) algorithms. Global Health Agencies, including CDSCO, are gearing up and devising new regulations to address the transformation.

The CDSCO, in Feb 2020, released a notification to extend the scope of the devices regulated under the Drugs and Cosmetics Act. Under the new scope, software is also considered as medical devices if it is used for;

• Diagnosis, prevention, monitoring, treatment, or alleviation of any disease or disorder
• Assistance for any injury or disability
• Investigation, replacement or modification, or support of the anatomy or a physiological process
• Supporting or sustaining life
• Disinfection of medical devices
• Control of conception

The Software as a Medical Device (SaMD) to be marketed in India is subjected to and must comply with the following regulations:

• S.O. 648(E), February 11, 2020, Medical Device Definition
• Medical Device Rules, 2017
• ISO 13485:2016 - Quality Management Systems
• ISO 14971:2019 - Application of Risk Management to Medical Devices

Additionally, the SaMD shall also comply with the applicable global harmonized standards that include:

• IEC 62304; it deals with the software lifecycle, i.e., almost everything about what software engineers do.
• IEC 60601-1 applies to embedded software in a hardware medical device
• IEC 82304-1 applies standalone software also known as Software as a Medical Device (SaMD)
• IEC 81001-5-1 adds requirements for cybersecurity
• IEC 62366-1 adds requirements about man-machine interface ergonomics
• IEC 62304 is the standard for software in medical devices

In September 2021, CDSCO released official guidelines on the classification of SaMD in harmony with IMDRF’s risk-based classification. It is categorized into low-risk (Class A), low-moderate risk (Class B), moderate risk (Class C), and high-risk (Class D) devices.  

The SaMDs, once classified, shall follow the same registration process as the regular medical devices. The compliance and the registration requirements must align with the corresponding medical device of the same risk category. In case of ambiguity with the risk classification of the SaMDs, developers and manufacturers can opt for official clarification with the CDSCO.

As clinicians are highly dependent on SaMD for diagnosing, preventing, monitoring, and treating diseases, it is extremely important to have data protection policies to prevent a data breach of patients’ sensitive information. Understanding the criticality and urgency of the subject, the Indian Parliament is working on the Personal Data Protection Bill (2019).

As the digital transformation in healthcare progresses, the Indian government and the CDSCO are taking necessary steps to ascertain device safety and mitigate potential breaches of user information. Few regulations are still under discussion and may come into force and regulate the Software as Medical Devices (SaMDs).

To know more about the medical device regulations in India, reach out to our Regulatory experts.