CDSCO is the Central Drugs Standard Control Organization, India’s national regulatory authority for drugs and medical devices. Operating under the Ministry of Health and Family Welfare, it administers the Medical Devices Rules, 2017, classifying devices into Classes A through D and granting the manufacturing, import, and clinical investigation licenses required to sell a device in India.
What is CDSCO?
CDSCO sits under the Directorate General of Health Services within the Ministry of Health and Family Welfare, headed by the Drugs Controller General of India (DCGI). Its authority over devices flows from the Drugs and Cosmetics Act, 1940, and the Medical Devices Rules, 2017 (MDR 2017), in force since 1 January 2018.
Regulatory power is split across two tiers. The Central Licensing Authority (CLA), the DCGI’s office, handles Class C and D devices, every import license, and clinical investigation permissions. State Licensing Authorities (SLAs) handle Class A and B manufacturing licenses. Applications, queries, and grants move through CDSCO’s online portals.
Why CDSCO matters in medical device development
Since notification G.S.R. 102(E) dated 11 February 2020, every medical device sold in India is treated as a drug under the parent Act. Mandatory licensing then arrived in waves: Class A and B from 1 October 2022, and previously non-notified Class C and D from 1 October 2023. Categories that once sat outside the system now sit inside it.
The consequences are concrete. Selling or importing a regulated device without a valid license is an offense under the Drugs and Cosmetics Act, 1940, exposing a company to seizure of stock, monetary penalty, and criminal liability. Timelines matter too: a Class C or D application triggers a site inspection, and dossier gaps found there push launch dates by quarters.
Misclassification is the quieter risk. An October 2025 CDSCO directive told SLAs to verify a device’s risk class against the CLA’s published list before granting any Class A or B license, after finding devices licensed at the wrong level.
How CDSCO licensing works
The pathway is risk-based, and the form numbers tell you which door you knock on.
- Classify the device. Assign Class A, B, C, or D using the First Schedule of MDR 2017 and the CLA’s published classification lists. If the device is not listed, request a classification from the CLA before applying.
- Build the quality system. The Fifth Schedule sets out the quality management system a site must operate. It maps closely onto ISO 13485, and sites are inspected against it.
- Assemble the dossier. The Fourth Schedule calls for a Device Master File, a Plant Master File, and an Essential Principles checklist, supported by the risk management file (ISO 14971), electrical safety and EMC evidence (IEC 60601-1), and software lifecycle records (IEC 62304) where software is present.
- Generate test data. Domestic manufacturers apply for an MD-12 test license, granted on MD-13, to build quality control data before commercial licensing.
- Apply.
- Class A and B: Apply on MD-3, receive MD-5 from the SLA.
- Class C and D: Apply on MD-7, receive MD-9 from the CLA.
- Importers (all classes): Apply on MD-14, receive MD-15.
- Clinical investigations: Apply on MD-22, receive MD-23.
- Maintain the license. Licenses run in perpetuity provided the holder pays the retention fee every five years. Post-market obligations continue, including adverse event reporting through the Materiovigilance Program of India (MvPI).
One exemption matters. Under G.S.R. 777(E) dated 14 October 2022, Class A non-sterile, non-measuring devices are exempt from import licensing and use a self-notification route instead.
Common challenges and best practices
Teams most often stumble on classification. Indian risk classes do not map one-to-one onto EU MDR or FDA device classes, and an accessory can carry a different class from its parent device. Settle the class first, in writing.
The second failure is dossier translation. A 510(k) summary or an EU technical file is a starting point, not a submission. The Device Master File and Plant Master File have their own structure, and reviewers read them standalone.
The third is inspection readiness. Sites that treat the Class C or D inspection as a paperwork event, rather than a working demonstration of the Fifth Schedule system, collect observations.
Post-grant discipline is where good companies drift. Retention fees, change control, recall procedures, and MvPI reporting persist for the life of the license. Watch the pipeline too: draft amendment G.S.R. 883(E), published 4 December 2025, proposes further changes to registration and validity.
How SJML helps with CDSCO
Syrma Johari MedTech (SJML) is an end-to-end medical device CDMO with design, engineering, manufacturing, and regulatory compliance under one roof. For India market access, SJML supports CDSCO manufacturing-license, test-license, and import-registration work, alongside device classification and regulatory strategy. Its manufacturing sites operate under ISO 13485 quality systems with process validation and traceability, shortening the distance between a site inspection and a granted license. Risk management and software lifecycle records are produced during development, not reconstructed afterward.
Frequently asked questions
CDSCO, the Central Drugs Standard Control Organization, regulates medical devices in India under the Drugs and Cosmetics Act, 1940, and the Medical Devices Rules, 2017. It works through a Central Licensing Authority, headed by the Drugs Controller General of India, and State Licensing Authorities. The CLA covers Class C and D devices plus all imports; SLAs cover Class A and B manufacturing.
MD-5 is the manufacturing license for Class A and Class B devices, granted by a State Licensing Authority after an application on Form MD-3.
MD-9 is the manufacturing license for Class C and Class D devices, granted by the Central Licensing Authority after an application on Form MD-7 and a site inspection.
Risk class determines which pathway applies.
MDR 2017 does not name ISO 13485 as a mandatory certificate, but the Fifth Schedule quality system requirements align closely with it. In practice, an ISO 13485 certificate is expected as supporting evidence, and foreign manufacturers routinely submit one with their MD-14 filing. Sites are inspected against the Fifth Schedule, not the certificate.
Licenses granted under MDR 2017 remain valid in perpetuity rather than expiring on a fixed date. The holder must deposit a retention fee every five years to keep it active. Missing that window, beyond the permitted grace period, means the license is treated as canceled, and the applicant must begin the application process again.
Related terms
- EU MDR 2017/745
- ISO 13485
- Device Master File
- Post-Market Surveillance
- Regulatory Strategy
