In a landmark move to safeguard public health in the digital age, India’s top medical regulator has released draft guidelines to regulate all forms of medical device software, including the rapidly growing market of AI-powered diagnostic tools and health-related mobile applications.

The proposal by the Central Drugs Standard Control Organisation (CDSCO) aims to bring software used for diagnosis, treatment, and monitoring under a clear, risk-based framework, ensuring that digital health tools are safe, effective, and reliable before they reach patients and clinicians. This initiative addresses a critical gap where apps and algorithms making significant health claims have largely operated in a regulatory grey area.

The guidance crucially distinguishes between general wellness apps and software with a direct medical purpose. At the heart of the framework is a four-tier risk classification system, from Class A (low risk) to Class D (high risk). A tool that helps “inform” a patient about their condition would be classified as low-risk, whereas sophisticated AI software that “drives clinical management” or makes a direct “diagnosis” for a critical disease—like identifying cancer from a medical image—will face the highest level of scrutiny, equivalent to a high-risk physical medical device.

From a public health standpoint, this tiered approach is vital. It ensures that software making life-or-death recommendations undergoes rigorous validation. Manufacturers will be required to provide robust clinical evidence of their software's performance, establish a quality management system for development, and implement stringent risk management protocols, including protections against cybersecurity threats.

Furthermore, the guidelines establish crucial post-market surveillance requirements. This means developers must have a system to monitor their software's real-world performance, report adverse events, and issue timely updates or "patches" for bugs and security vulnerabilities—much like a traditional medical device recall.

This regulatory oversight promises to build critical trust among both doctors and patients, encouraging the safe adoption of innovative technologies that can improve healthcare access and outcomes. By setting clear standards for everything from smartphone-based ECG readers to complex, cloud-based analytical platforms, the CDSCO is laying the foundation for a safer, more accountable digital health ecosystem across India. The document is currently open for stakeholder comments before being finalized.