As the national telemedicine platform e-Sanjeevani integrates an AI-enabled clinical decision support system, India stands at a critical juncture in the evolution of modern medicine. This development is not merely a technological milestone; it is a manifestation of a global shift where artificial intelligence is moving from experimental research into the heart of clinical practice. However, as algorithms begin to influence life-altering decisions—ranging from diagnostic referrals to treatment investigations—the urgency of establishing a robust regulatory framework for patient safety has never been more pronounced.
The Central Drugs Standard Control Organisation (CDSCO), in its July 2026 guidance, has taken a significant step toward defining how software, including AI-driven tools, fits into the medical device ecosystem. While this guidance clarifies approval pathways, it highlights a broader, lingering question: is a guidance-based approach sufficient to govern the high-stakes world of medical AI, or does India require a dedicated, comprehensive statutory framework?
Defining the MedTech Landscape
To understand the regulation of AI in health, one must first distinguish between traditional medical technology and the emerging class of algorithmic medicine. MedTech, in its classical sense, encompasses instruments, implants, and devices whose primary action is physical, diagnostic, or monitoring-based, rather than pharmacological or metabolic. A pacemaker, a dialysis machine, or a standard CT scanner fits this definition.
At the core of digital MedTech is software—the set of instructions that dictates how a device functions. A digital blood-pressure monitor, for instance, uses embedded software to interpret sensor data. When we introduce Artificial Intelligence, we move beyond simple, rule-based programming. AI—built on advanced machine learning and deep learning models—learns from vast datasets to identify patterns and make autonomous inferences.
While every AI system relies on algorithms, not every algorithm is AI. A Netflix recommendation engine is an algorithm, but it carries no clinical risk. A medical AI model, conversely, carries the potential for profound harm. A false positive can lead to unnecessary, anxiety-inducing procedures, while a false negative can result in a delayed diagnosis, with potentially fatal consequences. Furthermore, the issue of "generalizability" remains a major hurdle; a model optimized for the healthcare infrastructure of Boston or London may falter when applied to the diverse demographic and clinical realities of rural Bihar or the urban slums of Mumbai.
A Chronology of Indian MedTech Governance
India’s journey toward regulating medical devices has been a process of adaptation rather than evolution. For decades, the primary legislative instrument has been the Drugs and Cosmetics Act of 1940. Originally drafted to curb the distribution of spurious and adulterated drugs, this law was never intended to govern complex software or diagnostic AI.
- 1982: An amendment to the 1940 Act allowed the government to categorize certain medical devices as "drugs," providing a rudimentary legal basis for oversight.
- 2017: The Medical Devices Rules, 2017, marked a watershed moment by establishing the first dedicated rulebook for the sector. This framework categorized devices into four risk-based classes (A to D), ranging from low risk to high risk.
- 2020: The scope of these rules was expanded to include all devices intended for medical use, explicitly bringing software into the regulatory fold.
- 2026: The CDSCO issued its landmark guidance on software in medical devices, further refining the regulatory approach to Software in a Medical Device (SiMD) and Software as a Medical Device (SaMD).
This regulatory progression highlights a persistent challenge: the attempt to fit 21st-century technology into an 80-year-old legislative box.
The Risk-Based Regulatory Paradigm
The CDSCO’s 2026 guidance shifts the focus from the "hardware" to the "intended use" and "clinical output" of the software. It distinguishes between software that merely stores data—which requires lower regulatory oversight—and software that actively influences clinical decisions.
Software in a Medical Device (SiMD) vs. SaMD
The guidance categorizes software based on its function:
- SiMD: Embedded software that is essential to the function of a physical device.
- SaMD: Standalone software that performs medical functions independently of any physical device.
The assessment of these technologies is predicated on the severity of the clinical situation. If an AI tool suggests a treatment plan for an oncology patient, it is classified as high risk, necessitating rigorous validation. Conversely, a general wellness application that tracks fitness metrics remains largely outside the scope of strict medical device regulation.
Validation: The Challenge of "Proof"
Validation for AI-enabled devices is fundamentally different from traditional pharmaceuticals. Traditional clinical trials are static; AI, by design, is dynamic. Algorithms can be retrained, software can be upgraded, and performance can "drift" as the underlying data changes.
The CDSCO now mandates that developers provide evidence of a "sound clinical association" between the software’s output and the medical condition. Developers are expected to disclose the nature of their training, validation, and testing datasets, with a heavy emphasis on demographic and geographic diversity.
Crucially, the guidance asserts that models developed abroad may require secondary validation within Indian populations. This is a vital safeguard. AI models are prone to bias; a system trained on homogenous, high-resource populations may lack the accuracy needed for a heterogenous, resource-constrained Indian setting. The CDSCO’s emphasis on "post-market surveillance"—monitoring the AI’s performance in real-world clinical settings after deployment—is a necessary response to the iterative nature of AI development.
Policy Landscape and Institutional Responses
The governance of AI in India is currently a patchwork of policy documents rather than a singular, unified statute.
- NITI Aayog (2018): Released the National Strategy for Artificial Intelligence, which identified healthcare as a core priority sector.
- ICMR (2023): Issued Ethical Guidelines for AI in Healthcare, emphasizing the pillars of accountability, fairness, and patient autonomy.
- Ministry of Electronics and IT (2025): The AI Governance Guidelines opted against a separate AI law, favoring a sector-specific approach.
- Health Ministry (2026): Launched the Strategy for Artificial Intelligence in Healthcare for India (SAHI), which provides a roadmap for the deployment and monitoring of AI across the health sector.
Comparatively, India’s approach is more flexible than the European Union’s, which has integrated medical device regulation with the comprehensive EU AI Act. While the US FDA has moved toward a "Total Product Lifecycle" approach, including predetermined change-control plans for future software updates, India is still finding its footing between enabling innovation and ensuring patient safety.
Implications: The Need for Statutory Clarity
The reliance on guidance documents has allowed India’s regulators to move quickly, avoiding the often-protracted delays associated with parliamentary legislation. However, the reliance on an 80-year-old law creates significant legal vulnerabilities.
The Case for a Dedicated Statute
A dedicated AI-medical device statute would provide several critical benefits:
- Mandatory Validation: While guidelines are persuasive, a law would make Indian-specific clinical validation mandatory for all high-risk AI tools, preventing the "import" of biased or inappropriate models.
- Liability Clarification: When an AI makes an error that leads to patient harm, where does the liability lie? Is it the hospital, the doctor, or the developer? A statute could codify these responsibilities.
- Public Transparency: A statutory framework could mandate the creation of a national, public registry of all approved AI-enabled medical devices, allowing clinicians and patients to verify the safety and efficacy of the tools being used in their care.
Conclusion: A Trust-Based Future
The integration of AI into platforms like e-Sanjeevani promises to democratize specialist support, extending high-quality diagnostic capabilities to the farthest reaches of the country. AI can reduce the immense workload on Indian doctors and improve consistency in care. Yet, the technology’s promise is inextricably linked to the public’s trust.
Can we continue to govern life-and-death clinical decisions through guidelines that act as an extension of pre-Independence laws? As AI matures, the "guideline-led" approach may eventually prove inadequate. To truly leverage AI for the public good, India must transition toward a clear, statutory framework that balances the rapid pace of innovation with the non-negotiable imperative of patient safety. Only by establishing a robust, transparent, and legally binding structure can we ensure that the algorithmic pulse of modern medicine beats for the benefit of every patient.
