Regulation of SaMDs in India: navigating the regulatory maze

Darren Punnen
Nishith Desai Associates, Mumbai
darren.punnen@nishithdesai.com

Milind Antani
Nishith Desai Associates, Mumbai
milind.antani@nishithdesai.com

Immediately before the global focus shifted to battling the Covid-19 pandemic in March 2020, India’s regulator for medical devices, the Central Drugs Standard Control Organisation (CDSCO), issued two notifications which brought about sweeping changes to the regulatory framework for medical devices.^[1]

With these notifications, the regulator amended the existing law (the Medical Device Rules, 2017 issued under the Drugs and Cosmetics Act, 1940), bringing almost all medical devices within the regulatory fold, which previously covered all of 37 categories. While one notification introduced a catch-all definition of the kind of devices that are now covered under the law (as opposed to specific device categories being notified earlier),^[2] the other introduced a two-phase mechanism to ease into the new framework. During the first phase, all newly notified device manufacturers and importers could register with CDSCO with an ISO 13485 certification along with certain details of the device,^[3] in exchange for an exemption from the applicability of the full framework for a certain duration, depending on the device’s risk classification (30 months for lower risk devices, 42 months for higher risk devices). During this exemption period, manufacturers and importers could prepare for the second phase, which was the standard licensing regime with the full applicability of the law, as is applicable to the earlier regulated devices.

Among a wide range of devices, standalone medical device software or Software as a Medical Device (SaMDs) were brought into the regulatory framework for the first time through these notifications. Notably, while SaMDs were now covered, there were no software-specific changes that were brought about to supplement the existing law – 1940 legislation which was intended to cover only physical products, and a 2017 rule intended to regulate software embedded into hardware. While more than three years have passed since, and with the last of the exemptions for new devices set to end later in 2023, many questions remain on the actual working of the new framework, especially for SaMDs.

While the catch-all definition introduced by the CDSCO covers the devices that should be regulated, the responsibility for allocating a risk-classification lies with the regulator. Classification lists have since been issued, but there is no clear statement clarifying that devices which fall within the definition but are not specifically classified are not required to comply with the medical device framework. On the contrary, the classification lists are identified as dynamic documents which are subject to revision. This would mean that if a device that is not currently classified is launched, the possibility of it being subsequently classified and therefore requiring compliance with the licensing requirements cannot be ruled out, creating regulatory uncertainty. Given that the law was intended for physical products, the parameters for classification in the case of SaMDs have also not been set out, creating further uncertainty as to whether a particular SaMD would be classified as a high or low risk device. Device manufacturers and importers therefore rely on international classifications to chart out the possible classification of their SaMD, if it has not already been classified.

There are also practical challenges for SaMDs entering the licensing regime. The regulatory framework is divided between import and manufacture, and the associated licences assume that there is a physical movement of devices across borders for import, or a facility for manufacture. The documentary submissions for these licences are therefore linked to the physical activity of import or manufacture, neither of which is the case for SaMDs. The catch-all definition for the new devices closely resembles the definition prepared by the International Medical Device Regulators Forum (IMDRF),^[4] but the clarifications of definitions also adopted for SaMD manufacturers and importers do not find their way into India’s framework. This again leaves uncertainty in terms of which licence would be appropriate in each case, and also submissions to be made in this respect.

Certain issues common to all newly notified devices also apply equally to SaMDs. For example, many devices which have been regulated and approved in other jurisdictions have already been launched yet remain unregulated in India, given the limited categories of devices covered within the framework. Although there is a relatively relaxed pathway under Indian law for products that have a predicate device, the device to be relied on is required to have previously beeen approved by the CDSCO. This creates a situation where the first applicant for an existing product previously unapproved by the CDSCO would technically be required to undergo a more stringent licensing procedure (including clinical investigations) for its approval, while subsequent applicants can use the predicate device route to obtain their approvals.

The changes to the law to widen the coverage for a variety of medical devices is welcome, especially from the perspective that it increases patient safety and also levels the playing field in terms of setting standards for all players operating in the area. However, there are still many gaps in the framework which need to be filled.

Fortunately, the regulator has been forthcoming and has a good consultative process with applicants, through which some of these challenges have managed to be addressed on a case-to-case basis. There is however an urgent need for guidance documents to be issued, especially in the case of SaMDs, in order to provide much needed clarity to all players in the sector, in addition to certainty in terms of the applicable pathway.

India’s government recently released the draft of a new law intended to replace the existing regulatory framework altogether.^[5] The current draft finally carves out medical devices from within the ambit of pharmaceuticals – a long standing demand from the industry. It is hoped that through the public consultative process, further provisions will be introduced to remedy some of the inherent challenges being faced due to the patchwork implementation of new ideas into an old law created at a time when many of today’s advancements did not exist.