CDSCO Registration for SaMD & SiMD : Risk Classification, QMS, and Documentation Explained

Overview:

Central Drugs Standard Control Organization (CDSCO) Medical device registration is a mandatory process for manufacturers and importers, ensuring that all medical devices, IVD’s, Durgs and Cosmetics meet the standards defined under the Medical Devices Rules (MDR), 2017.

Medical Device (Software) in Modern Healthcare:

The role of software in medical devices is rapidly expanding, becoming central to the functionality of modern healthcare technologies. As devices increasingly rely on software for diagnosis, monitoring, treatment, and connectivity, ensuring the quality of software is critically important. Any malfunction or failure in medical device software can result in severe, and potentially life-threatening, risks to patients.

SaMD (Software as a Medical Device) and SiMD (Software in a Medical Device) are two frequently misunderstood terms, each referring to different types of technology—are SaMD (Software as a Medical Device) and SiMD (Software in a Medical Device). In this blog, we will focus on the differences between SaMD vs SiMD, exploring what it means as defined by regulatory authorities, and the key regulatory guidelines that govern its development, validation, and use.

Healthcare Software That Does Not Fall Under The Regulatory Scope of a Medical Device:

Software that does not meet the definition of an ‘Active medical device’—which is a device that operates using electrical or external energy sources rather than human, animal, or gravitational energy—Not classified as a medical device and therefore not subject to the Medical Device Rules (MDR-2017).

Software Regulated as Medical Devices:

In India, the regulation of software products as medical devices falls under the Medical Device Rules, 2017, governed by the Central Drugs Standard Control Organization (CDSCO). New Medical Devices, including software-based solutions, must comply with these regulations. CDSCO Registration is mandatory for software classified as medical devices before they can be marketed or used clinically in India.

In February 2020, the definition of medical devices was significantly expanded by the Ministry of Health and Family (MoHFW) to incorporate software-based solutions., leading to the implementation of Software products considered a Medical Device based on regulatory classification.

The CDSCO also clarifies a fundamental concept:

However, in practice, SaMDs face certain challenges when it comes to entering the licensing framework. The current regulatory system is structured around import and manufacturing, with licensing requirements that assume there is either a physical movement of products across borders (in the case of imports) or a physical manufacturing facility. Since SaMDs don’t involve either physical import or local manufacturing, the associated documentation and licensing processes don’t always align with how these products are actually developed and deployed.

Types Of Medical Device Software:

According to the Medical Devices Rules (MDR) 2017, the CDSCO regulates Software as a Medical Device (SaMD) and Software in a Medical Device (SiMD). The regulatory system under CDSCO ensures that software in medical devices adheres to safety, performance, and compliance standards. Medical device software is generally categorized into two types.

Software in a medical device (SiMD): SiMD, or Software in a Medical Device, is governed by regulations that apply to the complete device—encompassing both physical hardware and embedded software.
Software as a medical device (SaMD): Standalone software classified as (SaMD) Software as a medical device is regulated under a unique set of rules separate from hardware-based medical devices.

Recognizing the distinction between SaMD and SiMD is essential, as it shapes regulatory strategy, risk assessment, and patient confidence.

Medical Device Regulatory Affairs pertains to the steps involved in the processes and strategies required to ensure that medical devices, including software based products, comply with applicable regulations and standards prior to market entry. However, in practice, SaMDs face certain challenges when it comes to entering the licensing framework. The current regulatory system is structured around import and manufacture, with licensing requirements that assume there is either a physical movement of products across borders (in the case of imports) or a physical manufacturing facility. Since SaMDs don’t involve either physical import or local manufacturing, the associated documentation and licensing processes don’t always align with how these products are actually developed and deployed.

SaMD, SiMD, and software for IVD applications fall within the scope of “Medical Device Software.” Some of the differences are as below:

SaMD Medical Device	SiMD Medical Device
It is intended for a medical use on its own, functioning separately from any hardware-based medical equipment.	It operates only as part of a hardware medical device and cannot work separately.
Regulatory Route– Typically follows a standalone regulatory pathway, emphasizing its own safety and effectiveness	Regulatory Route – It is evaluated within the regulatory framework of the overall medical device it accompanies
Risk classification is determined by the potential harm the device may pose to patients, as with traditional medical devices.	Risk classification is influenced by the combined risk of the software and the device’s hardware
Examples: -Ai-Driven Diagnostics-Idx-DR that autonomously identifies diabetic retinopathy in early intervention -Behavioural Health Apps – Woebot support for managing anxiety and depression	Examples -Anaesthesia delivery systems that administer and monitor anaesthesia levels during surgery -AEDs that include embedded software to analyse heart rhythms and deliver electric shocks to restore normal heartbeat

Risk-Based Classification:

Below table refers to the Risk classification of CDSCO medical devices for software as per the MDR-2017. The risk class of the Medical Device Software is fundamentally based on the intended use of the software and the applicable rules in First Schedule of MDR-2017.

Degree of risk	Classification	Description
Low risk	Class A	Software that does not directly handle or process patient data.
Low moderate risk	Class B	Delivers real-time data without performing clinical diagnosis.
Moderate high risk	Class C	Assists in diagnosis and analysis of physical Activity.
High risk	Class D	It is used in critical or life-threatening situations.

Risk classification of SaMD:

The risk classification of a SaMD Medical Device depends on the intended use, the severity of the condition it addresses, and the impact on patient health if the software malfunctions. Medical devices in higher-risk categories demand stricter regulatory review and stronger proof of safety and effectiveness. The following factors may be considered in determining the risk class of a SaMD:

Healthcare Status or Condition	Significance of Information Provided by Software as a Medical Device (SaMD) to Health Care Decision
Healthcare Status or Condition	Treatment or diagnosis	Drive clinical management	Inform clinical management
Critical	D	C	B
Serious	C	B	A
Non-serious	B	A	A

QMS For Medical Device Software

Medical device software (SaMD Medical Device and SiMD Medical Device) manufacturers must implement a Quality Management System (QMS) for medical devices that covers the organization and the entire software lifecycle—from design and development to deployment and maintenance.
For imports, the overseas manufacturer must follow QMS requirements and submit a notarized QMS certificate from their national regulatory authority with the import license application.

Applicable Standards to medical Device Software:

As part of CDSCO registration, medical device software must follow the standards prescribed by BIS or those periodically announced by the Ministry of Health and Family Welfare.
In cases where no such standards are specified, the device(s) should comply with internationally recognized benchmarks such as those established by the International Organization for Standardization (ISO), the IEC, or other accepted pharmacopeial standards.
If the above-listed standards do not apply, the device should conform to the manufacturer’s own validated specifications.

Under Medical Device Regulation, medical device software manufacturers are required to implement a Quality Management System aligned with the IS/ISO 13485 standard, similar to traditional medical device producers. The following standards also apply to Medical Device Software*

*The above list mentions some of the standards that may be applicable for Medical Device Software and is not exhaustive in nature.

Registration Process Steps:

Determine the product Classification - Analyse whether the software qualifies as Software as a Medical Device classification and classify it according to risk based categories.
Gather required checklist documentation- Compile all necessary documents.
Submit Application - Complete the application process through CDSCO Sugam portal.
Post Market Surveillance - Continuous post-market monitoring of software’s performance in the market and responding to changes is required.

Medical Device CDSCO Document Checklist For Import License of Software Under MDR 2017

Documents/Certificates Required Plant/Site Master File Requirement Device File Requirement

Covering Letter
Application (Form MD-14)
Fee Challan
Power of Attorney
Wholesale license/Manufacturing license/ Registration
Certificate(Form MD-42)
Constitution details of the authorized agent
FreeSale Certificate/Marketing Authorization (if any)
FreeSale Certificate/Marketing Authorizationfrom ofany of the following countries (USA, UK, EU, Canada, Japan or Australia)
Manufacturing site/establishment/plant registration from country of origin
Latest inspection or audit report, within the last 3 years (if any)
Certificate supporting Quality Management System (duly notarized)
Full Quality Assurance Certificate/ CE type examination Certificate/ CE product quality assurance certificate, CE design Certificate, etc. as applicable (duly notarized)
Declaration of conformity (DOC)
A copy of the permission issued in Form MD-27 (applicable for Investigational Medical Devices).

Manufacturer’s Device Master File, prepared as per Appendix II of the Fourth Schedule of MDR 2017.
Executive Summary
Descriptive information of the device
Justification for the Medical Device Grouping
Product Specification, including variants, accessories, etc.
Substantial equivalence in relation to a predicate device or prior versions of the device.
Labelling information (Labels, Instruction for Use, etc.)
Device Design and Manufacturing Information
Essential Principles checklist
Risk analysis and control summary
Verification and validation of the medical device
Clinical evidence
Post Marketing Surveillance data (Vigilance reporting)
Batch Release Certificates (BRC) or Certificates of Analysis (COA) for at least three consecutive batches, or a software version release certificate.
Any other additional documents

Conclusion:

In India, the introduction of the Medical Devices Rules, 2017, marked a significant step in the regulation of “Medical Device Software.” This ensures that such software meets quality, safety, and performance standards, in line with global regulatory practices, and requires CDSCO registration of medical device before they can be legally marketed or used. Developers are required to follow these regulatory guidelines, to ensure compliance and securing the necessary approvals or clearances. By aligning with the right regulatory pathway, manufacturers can bring innovative medical technologies to market with confidence—ultimately improving patient outcomes across the globe. Accelerate innovation. Ensure compliance.

How Morulaa HealthTech Can Help?

Helping healthcare innovators worldwide get their medical device products registered— over 150+ satisfied clients. Our expert regulatory team helps clients navigate the complexities of product marketing and distribution within the Indian market. Reach out to Morulaa HealthTech to get started today on [email protected]