Healthcare AI Regulation in India: CDSCO, ICMR, SAHI and What Applies

Healthcare AI regulation in India is not one law. It is four layers that apply at the same time: the Central Drugs Standard Control Organisation (CDSCO) for AI that counts as a medical device, ICMR's ethical guidelines for AI in health research and care, the Health Ministry's new national strategy (SAHI) with its BODH benchmarking platform, and the Digital Personal Data Protection Act for the data underneath.

For hospital leaders and product teams, the practical question is simpler: "Is this AI tool a regulated medical device, and if not, what do we still owe patients?" The answer depends mostly on what the tool's output is used for.

This guide explains each layer as it stands in late 2026, gives a decision table for common hospital AI use cases, and lists what to ask a vendor before you deploy. For the use cases themselves, see our overview of AI in hospital management.

Layer 1: CDSCO and software as a medical device

Software has been regulated as a medical device in India under the Medical Devices Rules, 2017 when it meets the definition of a device. What was missing was detailed guidance on how. On 21 October 2025, CDSCO released a draft guidance document on medical device software that fills that gap (India Briefing summary).

Its main points:

• Two types of software. Software in a Medical Device (SiMD) is embedded in, and inseparable from, a physical device. Software as a Medical Device (SaMD) is standalone software with a medical purpose.
• Administrative software is out of scope. Billing, appointment and other non-clinical systems are excluded. A hospital management system's billing module is not a medical device.
• Four risk classes, A to D, from low risk to high risk. Embedded software takes the class of its device. Standalone software is classed by how important its output is to clinical decisions and how serious the clinical situation is. The draft gives AI software for detecting diseases as an example in the moderate-to-high Class C band.
• Who licenses. Class A and B go to state licensing authorities. Class C and D go to CDSCO's Central Licensing Authority.
• Lifecycle quality management aligned with BIS, ISO or IEC standards.
• An Algorithm Change Protocol for AI and machine learning: developers must document and validate algorithm updates, such as retraining, and communicate them to the regulator.
• Post-market duties, including reporting cybersecurity vulnerabilities, maintaining performance records and periodic safety update reports.

Reports in 2026 differ on whether the guidance has been finalised. Check the current status on the CDSCO website before you rely on a specific clause, but the direction is clear and matches international practice.

Layer 2: ICMR's ethical guidelines

In 2023 ICMR issued its Ethical Guidelines for the Application of Artificial Intelligence in Biomedical Research and Healthcare, the first national ethics framework for health AI (Down To Earth coverage). It sets out 10 patient-centric principles, covering areas such as autonomy, safety, data privacy, accountability and liability, transparency and explainability, fairness and non-discrimination, and validity.

The guidelines are not a licensing regime. They matter in three practical ways:

1. Ethics committee review. Any AI study, pilot or validation that uses patient data in a research context goes through an ethics committee, which will read your protocol against these principles.
2. Procurement expectations. Large hospitals and government buyers increasingly ask vendors how their product addresses explainability, bias and accountability. The ICMR principles are the vocabulary for those questions.
3. Liability framing. The guidelines emphasise clarity on who is accountable when AI contributes to a decision. Your contracts and clinical policies should answer that explicitly.

Layer 3: SAHI and BODH, the 2026 national strategy

In February 2026, at the India AI Impact Summit, the Union Health Minister launched two initiatives (Business Standard):

• SAHI (Strategy for Artificial Intelligence in Healthcare for India), described by the Minister as a governance framework and national roadmap. It gives direction on governance, data stewardship, validation, deployment and monitoring of health AI.
• BODH, a benchmarking platform developed by IIT Kanpur with the National Health Authority. It evaluates AI models against diverse, anonymised real-world data without sharing the underlying datasets with the developer. It is positioned as a digital public good under ABDM.

BODH is the more immediately useful of the two for buyers. Until now, Indian hospitals had to take vendor accuracy claims largely on trust, often based on foreign datasets. An independent benchmark on Indian data, where the developer never sees the test set, is exactly what procurement teams need. Expect government and large private buyers to start asking whether a model has been evaluated on BODH.

Layer 4: DPDP Act and Rules

Every AI system that touches patient data is processing personal data under the Digital Personal Data Protection Act, 2023. The DPDP Rules were notified on 13 November 2025, with most obligations coming into force 18 months later, around May 2027.

For AI specifically, the issues are:

• Purpose and consent. Using clinical records to train or fine-tune a model is a different purpose from treating the patient. Your notices and consents need to cover it, or you need a lawful basis that does.
• Processors. An AI vendor processing your patients' data is your data processor. You remain responsible.
• Breach duties. If a vendor's system leaks prompts containing patient data, that is your breach to report.

Our DPDP Act checklist for hospitals covers the operational side.

Where common hospital AI tools fall

The intended-use statement drives classification. The same model marketed as "helps doctors prioritise their worklist" and "detects pneumonia" can land in different places. Read the vendor's claims, not only their brochure.

The IndiaAI Mission and what it funds

The IndiaAI Mission, approved in March 2024 with an outlay of ₹10,371.92 crore, funds compute, datasets and applications, with healthcare as one of the priority sectors. Related to it, AIIMS Delhi and IIT Delhi signed an MoU on 4 June 2025 to set up a Centre of Excellence for AI in healthcare as a Section 8 company with a reported ₹330 crore grant.

For private hospitals the relevance is indirect but real: public datasets, validated models and benchmarks coming out of these programmes will shape what "good enough" looks like in procurement, and some may become usable building blocks.

What to ask an AI vendor before you deploy

1. What is the intended use, in writing, and what is the CDSCO classification you have assumed?
2. If it is a device, what is the licence status and who holds it in India?
3. What data was the model trained and validated on? Was any of it Indian? Has it been evaluated on BODH or an equivalent independent benchmark?
4. How are model updates handled? Is there an Algorithm Change Protocol and will we be told when the model changes?
5. Where is patient data processed and stored, and is it used to train your models?
6. What monitoring do you provide for drift, bias and false outputs after go-live?
7. Who is accountable, contractually, when the AI contributes to an adverse event?

If a vendor cannot answer the first four questions clearly, the product is not ready for clinical use in your hospital, however good the demo.

How we approach this at Algon

When we build AI into hospital systems through our clinical documentation AI and AI agents in healthcare work, we start with intended use. Most hospital AI value today sits in operations, documentation and revenue cycle, outside device regulation, and that is where we usually recommend starting. Where a tool edges into clinical decision support, we design for clinician review, logging and monitoring from day one, so the evidence a regulator or ethics committee would ask for already exists.

Setting up a lightweight AI governance committee

Most Indian hospitals do not need a new department to govern AI. They need a small standing group that meets monthly and has authority to say no. A workable setup for a 100-300 bed hospital:

• Members: the medical director or a senior clinician as chair, the IT head, the quality or NABH coordinator, a data protection lead, and a nursing representative. Add the relevant department head when a tool affects them.
• Remit: approve new AI tools and significant updates, review the AI register, receive incident reports and decide when a tool should be paused.
• Inputs: the vendor answers to the questions above, a short local validation where the tool is clinical, and the data flow diagram showing where patient data goes.
• Outputs: a recorded decision for each tool, with conditions such as "drafts only, clinician must sign" or "pilot in one ward for eight weeks".

This mirrors what ethics committees already do for research and what NABH already expects for quality processes, so it fits existing hospital habits. It also gives you a ready answer when a regulator, insurer or patient asks how a decision involving AI was made.

Conclusion

India's approach to healthcare AI in 2026 is layered rather than unified. CDSCO decides what is a device and how it is controlled, including how AI models may change. ICMR sets the ethical expectations. SAHI sets national direction, and BODH gives buyers a way to test claims on Indian data. The DPDP Act governs the data throughout.

For hospitals, the practical path is clear: classify every AI tool by intended use, start with operational and documentation use cases, demand independent validation for anything clinical, and keep a register. That is good governance whichever way the final rules settle.