Rules: India, the US and Europe

Software that diagnoses, treats or monitors a disease is generally a medical device in law, whether or not it uses AI. The details differ by country.

India

• CDSCO, Medical Devices Rules 2017. Devices are classed by risk from A (low) to D (high). CDSCO issued a draft guidance on medical device software in October 2025 and guidance in July 2026 explaining how software, including AI/ML, sits under these rules; it asks AI makers to show performance in relevant Indian populations and care settings.
• Digital Personal Data Protection Act 2023. The rules were notified in November 2025. Consent-manager rules apply from November 2026 and most duties for organisations that handle personal data apply from May 2027.
• ICMR Ethical Guidelines for AI in Biomedical Research and Healthcare (2023). Principles for developing and using AI: autonomy, safety, data privacy, accountability, fairness, and the need for ethics committee review of AI research.
• NMC. No AI-specific practice regulation yet. Its chairperson has said publicly that responsibility for clinical judgement stays with the doctor.

United States

• The FDA authorises devices through three routes: 510(k) clearance (similar to an existing device), De Novo (new, low-to-moderate risk) and PMA approval (highest risk). “FDA cleared” and “FDA approved” are not the same thing.
• A predetermined change control plan lets a maker update a model within limits agreed in advance.
• The FDA revised its clinical decision support guidance in January 2026. Software that analyses medical images to give a diagnosis remains a regulated device.

European Union

• Medical AI is regulated under the Medical Device Regulation and, in addition, the EU AI Act, which classes most medical-device AI as high-risk. In May 2026 EU institutions provisionally agreed to delay the high-risk obligations; for AI inside regulated products such as medical devices the date moves to August 2028.