The 7 Types of Indian MedTech Companies Most Likely to Face CDSCO Action in 2027.
THE 7 TYPES OF INDIAN MEDTECH COMPANIES MOST LIKELY TO FACE CDSCO ACTION IN 2027 — AND WHAT THEIR DISTRIBUTORS SHOULD DO NOW
By Ankur Khare — Biomedical Engineer | Regulatory Intelligence Analyst | Founder, MedReg Intel
CDSCO has seven years of accumulated non-compliance sitting in its database. In 2027, it will start collecting.
WHY 2027 IS THE YEAR THAT MATTERS
MDR 2017 came into force on 1 January 2018. The first five years were characterised by implementation — new forms, new processes, new Notified Body infrastructure, new CDSCO online systems. Enforcement was secondary to implementation.
2023 to 2025 saw selective enforcement. CDSCO began issuing show cause notices, conducting surprise inspections, and cancelling licences for egregious violations.
2026 has brought two developments that signal accelerating enforcement. First, the CDSCO MD Online portal has matured — CDSCO now has digital visibility into who has filed what, when, and whether post-approval obligations have been met. Second, the Medical Device Software guidance document of 2026 signals that CDSCO is actively expanding its regulatory perimeter into new device categories.
2027 will not be a new enforcement era. It will be the year that seven years of accumulated non-compliance — undisclosed changes, lapsed certificates, missing audit reports, unfiled adverse event reports — becomes visible to a regulator that now has the digital infrastructure to find it.
CATEGORY 1 — MANUFACTURERS WHO HAVE NOT FILED POST-APPROVAL CHANGE NOTIFICATIONS
MDR 2017's Sixth Schedule requires manufacturers to notify CDSCO of major changes before implementing them and minor changes within specified timelines after implementation.
Seven years of MDR 2017 have produced seven years of product iterations, manufacturing process changes, supplier changes, labelling updates, and facility modifications. Most Indian manufacturers have implemented these changes. Most have not filed the corresponding Sixth Schedule notifications.
CDSCO's MD Online portal now contains the original licence records for every licensed manufacturer. As CDSCO systematically reviews these records against current product specifications and manufacturing sites — which the portal makes possible for the first time — manufacturers with undisclosed changes will face show cause notices.
Distributor risk: Ask your manufacturers now — in writing — whether all Sixth Schedule notifications are current. If they cannot confirm this in writing, your supply continuity is at risk.
CATEGORY 2 — IMPORTERS WHOSE OVERSEAS MANUFACTURER'S ISO 13485 CERTIFICATE HAS LAPSED
MD-14 import licences require the overseas manufacturer to maintain a valid ISO 13485 certificate or equivalent QMS certification. Certificate renewal is typically required every three years.
Import licences granted in 2018 and 2019 relied on QMS certificates that have since been renewed — or not. CDSCO has begun cross-checking QMS certificate validity as part of renewal and post-approval surveillance activity.
An importer whose overseas manufacturer's ISO 13485 certificate lapsed and was not updated with CDSCO faces licence suspension risk — even if the manufacturer subsequently renewed the certificate.
Distributor risk: Verify that the ISO 13485 certificate on file with CDSCO matches the current certificate held by your overseas manufacturer. A gap — even a brief one — requires proactive disclosure before CDSCO finds it.
CATEGORY 3 — MEDICAL DEVICE SOFTWARE COMPANIES OPERATING WITHOUT CDSCO REGISTRATION
The 2026 CDSCO guidance document on Medical Device Software — CDSCO/MD/GD/MDSW/01/2026 — has clarified that software meeting the definition of a medical device under MDR 2017 requires a licence.
India has hundreds of health technology companies operating apps, AI diagnostic tools, and clinical decision support software that meet this definition. Most are operating without CDSCO registration — either because they were unaware of the requirement or because they assessed the enforcement risk as low.
The guidance document signals that CDSCO is now building the framework for systematic enforcement in this category. Companies that received the guidance document as a policy development rather than an enforcement signal have misjudged its purpose.
Distributor risk: If you distribute or resell health software that has any medical purpose — diagnosis, monitoring, treatment support — verify whether CDSCO registration is required. Operating as a distributor of unregistered medical device software creates regulatory liability that runs to the distributor, not only the developer.
CATEGORY 4 — MANUFACTURERS WITH CLASS B DEVICES WHO HAVE NEVER HAD A NOTIFIED BODY AUDIT
Rule 20(4) requires Class A manufacturers to undergo a Notified Body audit after licence grant as specified under MDR 2017.
Many manufacturers who received licences in the early MDR 2017 implementation period — 2018 to 2020 — received licences before the Notified Body infrastructure was fully operational. Some received licences without the required pre-grant or post-grant audits.
CDSCO is now conducting systematic reviews of licence records against audit compliance. Manufacturers who have never had a Notified Body audit — despite holding licences that require one — are vulnerable to licence suspension pending audit completion.
Distributor risk: Ask your manufacturer for documentary evidence of their most recent Notified Body audit report. If they cannot produce one dated within the last three years, escalate this immediately.
CATEGORY 5 — COMPANIES THAT HAVE NOT SUBMITTED MATERIOVIGILANCE REPORTS
Rule 26(ii) of MDR 2017 requires manufacturers and importers to report adverse events — including device malfunctions and serious injuries — to CDSCO within 15 days of becoming aware. Rule 76 governs the broader Materiovigilance Programme of India.
Seven years of MDR 2017 have produced seven years of adverse events. Most manufacturers have complaint handling procedures. Most have not filed materiovigilance reports with CDSCO — either because the events were assessed as not meeting the reporting threshold or because the reporting culture has not been established.
CDSCO's Materiovigilance Programme of India — MvPI — is building a complaint database. As this database grows, the absence of reports from manufacturers of widely distributed devices will become visible. Silence is not safety. Silence is a red flag.
Distributor risk: If you collect complaints from end users — hospitals, clinics, patients — you have an obligation to pass them to your manufacturer for materiovigilance assessment. Failure to do so creates shared liability that CDSCO will not distinguish from the manufacturer's liability.
CATEGORY 6 — DISTRIBUTORS OF DEVICES FROM MANUFACTURERS UNDER FDA OR EU MDR ACTION
CDSCO has begun monitoring international regulatory actions against manufacturers whose devices are licensed in India. FDA warning letters, EU MDR certificate withdrawals, and voluntary recalls in reference countries are increasingly triggering CDSCO enquiries to Indian importers and distributors.
Rule 76 of MDR 2017 requires importers to inform CDSCO within 15 days of any administrative action — including market withdrawal, regulatory restrictions, or cancellation of authorization — taken against a device by any regulatory authority in any country where it is marketed.
Most Indian importers are not monitoring international regulatory actions against their principals systematically. When a foreign regulatory action occurs — and they do, regularly — Indian importers are the last to know and the first to be asked by CDSCO what they knew and when.
Distributor risk: Establish a systematic process for monitoring FDA warning letters, EU MDR certificate status, and voluntary recalls for every overseas manufacturer whose products you distribute. The 15-day reporting clock under Rule 76 cannot be met if you are not monitoring.
CATEGORY 7 — COMPANIES RELYING ON DEEMED APPROVAL WITHOUT DOCUMENTATION
Rule 26(iii) of MDR 2017 provides that if CDSCO does not respond to a major change application within 45 days, the change is deemed approved by operation of law. Rule 36(1) provides a similar deemed approval for import licence applications after 9 months.
Some manufacturers and importers have invoked deemed approval — correctly, under the law — to implement changes or begin imports without formal CDSCO approval. What many have not done is document the deemed approval invocation — the date the application was filed, the date the 45 or 9-month period expired, and the formal notice sent to CDSCO invoking the deemed approval.
CDSCO does not acknowledge deemed approval invocations in writing. This creates a documentation gap. A manufacturer who invoked deemed approval without a paper trail faces the risk that CDSCO will treat the change as unapproved — and the manufacturer will have no documentary evidence to the contrary.
Distributor risk: If your manufacturer or principal has ever invoked deemed approval, ask for the documentation trail — the application receipt, the timeline calculation, and the written notice to CDSCO. If it does not exist, the deemed approval may not be defensible when CDSCO comes asking.
WHAT DISTRIBUTORS SHOULD DO NOW
The common thread across all seven categories is documentation and disclosure. CDSCO enforcement in 2027 will target companies whose compliance posture is invisible — not because they are necessarily non-compliant but because they have no evidence of compliance.
Three actions for every distributor before December 2026:
One — conduct a written compliance audit of every manufacturer and importer in your supply chain. Ask for Sixth Schedule notification records, Notified Body audit reports, ISO 13485 certificates, and materiovigilance filing records. In writing. With a response deadline.
Two — review your distribution agreements for regulatory liability clauses. Most Indian distribution agreements are silent on what happens when a manufacturer's licence is suspended or cancelled. This silence becomes expensive when enforcement arrives.
Three — establish a monitoring process for international regulatory actions against your overseas principals. FDA warning letters and EU MDR certificate withdrawals are public information. Not knowing is not a defence.
THE ONE-SENTENCE SUMMARY
CDSCO enforcement in 2027 will not find new non-compliance — it will find seven years of accumulated non-compliance that has never been disclosed, documented, or remediated.
The window to remediate is now. Not after the show cause notice arrives.
This analysis is based on MDR 2017 statutory review. For original CDSCO enforcement data — RTI-extracted behavioral patterns, court case signals, and dated predictions with accuracy tracking — see The India Device Forecast.
Issue 2 of The India Device Forecast publishes September 7, 2026. Free subscription at medregintel.com
Ankur Khare is a Biomedical Engineer and Regulatory Intelligence Analyst and the Founder of MedReg Intel. This article is for informational purposes and does not constitute formal regulatory or legal advice.
Comments
Post a Comment