{"id":828,"date":"2026-04-22T13:25:57","date_gmt":"2026-04-22T13:25:57","guid":{"rendered":"https:\/\/satoriocs.com\/blogs\/?p=828"},"modified":"2026-04-22T13:37:59","modified_gmt":"2026-04-22T13:37:59","slug":"ai-ml-based-samd-in-2026-what-indian-medical-device-manufacturers-must-know-about-fda-guidance-the-eu-ai-act-and-total-product-lifecycle-compliance","status":"publish","type":"post","link":"https:\/\/satoriocs.com\/blogs\/ai-ml-based-samd-in-2026-what-indian-medical-device-manufacturers-must-know-about-fda-guidance-the-eu-ai-act-and-total-product-lifecycle-compliance\/","title":{"rendered":"AI\/ML-Based SaMD in 2026: What Indian Medical Device Manufacturers Must Know About FDA Guidance, the EU AI Act, and Total Product Lifecycle Compliance"},"content":{"rendered":"\n

Author:<\/strong> Regulatory Affairs Team, Satori One Click Solutions LLP | Reading time:<\/strong> ~14 minutes<\/p>\n\n\n\n

\n\n\n\n

If you are an Indian medical device manufacturer with an AI-powered software product \u2014 a diagnostic imaging tool, a clinical decision support system, a remote patient monitoring application \u2014 2026 is not a year to wait and watch.<\/p>\n\n\n\n

Two of the world’s most consequential regulatory changes are happening right now, simultaneously. The US FDA has fundamentally restructured how it expects manufacturers to develop, validate, and maintain AI-enabled medical devices across their entire lifecycle. And the EU AI Act \u2014 the world’s first comprehensive law governing artificial intelligence \u2014 has begun its full enforcement phase for high-risk AI systems, which includes virtually every AI product intended for medical use.<\/p>\n\n\n\n

At the same time, India’s own CDSCO released its first-ever draft guidance on Medical Device Software in October 2025, including explicit provisions for AI and ML-based SaMD. The regulatory world your AI product must navigate in 2026 looks nothing like it did even two years ago.<\/p>\n\n\n\n

This guide explains what has changed, what it means for Indian manufacturers targeting the US and EU markets, and the specific compliance steps you need to take today.<\/p>\n\n\n\n

\n\n\n\n

What Is SaMD \u2014 and Why Does It Matter for Indian Manufacturers?<\/h2>\n\n\n\n

Software as a Medical Device (SaMD) is standalone software that performs a medical purpose independently \u2014 without being embedded in a physical hardware device. Examples include:<\/p>\n\n\n\n

    \n
  • AI-powered radiology tools that detect abnormalities in CT or MRI scans<\/li>\n\n\n\n
  • Clinical decision support software that recommends treatment protocols<\/li>\n\n\n\n
  • Electrocardiogram (ECG) analysis applications<\/li>\n\n\n\n
  • Wearable-connected patient monitoring systems<\/li>\n\n\n\n
  • Ophthalmology screening tools using computer vision<\/li>\n\n\n\n
  • Predictive algorithms for early sepsis or deterioration detection<\/li>\n<\/ul>\n\n\n\n

    India has a rapidly growing SaMD sector. The government’s Production Linked Incentive (PLI) Scheme for Medical Devices, the National Medical Devices Policy, and active investment in MedTech innovation at IITs have made India a credible originator \u2014 not just an importer \u2014 of medical software. Companies from Bangalore, Hyderabad, Pune, and Mumbai are building AI diagnostic tools that they want to sell in the US, Europe, Canada, and Australia.<\/p>\n\n\n\n

    But here is the challenge most Indian SaMD manufacturers face when they try to go global: the regulatory requirements for AI-based medical devices in the US and EU are more demanding, more nuanced, and more rapidly evolving than for any other product category. Getting them wrong delays your market entry by 12 to 24 months. Getting them right \u2014 early \u2014 gives you a significant competitive advantage over rivals who are still figuring it out.<\/p>\n\n\n\n

    \n\n\n\n

    Part 1: FDA’s New Approach to AI\/ML SaMD \u2014 The Total Product Lifecycle (TPLC) Framework<\/h2>\n\n\n\n

    The Core Problem FDA Was Solving<\/h3>\n\n\n\n

    Traditional medical device regulation was built on a straightforward model: design a device, test it, submit it for clearance, sell it. The product you submitted is the product on the market. Changes require new submissions.<\/p>\n\n\n\n

    AI breaks this model completely. Machine learning models can update. Algorithms can drift. A model trained on one patient population may perform differently on another. An AI that is performing well today may be performing poorly six months from now as the real-world data it processes diverges from its training data. The FDA recognised by 2019 that its “traditional paradigm was not designed for adaptive artificial intelligence and machine learning technologies.”<\/p>\n\n\n\n

    The answer FDA developed over several years is the Total Product Lifecycle (TPLC) approach \u2014 a framework that governs not just the moment a device is cleared, but every stage of its existence from design through deployment through ongoing real-world performance.<\/p>\n\n\n\n

    The Key FDA Guidance Documents (2021\u20132026)<\/h3>\n\n\n\n

    The FDA has built its AI\/ML regulatory framework through a series of guidance documents. Indian manufacturers targeting the US market need to understand all of them:<\/p>\n\n\n\n

      \n
    • October 2021 \u2014 Good Machine Learning Practice (GMLP) for Medical Device Development: Guiding Principles<\/strong> This joint guidance from FDA, Health Canada, and the UK’s MHRA established 10 core principles for how AI\/ML medical devices should be designed, developed, and validated. It covers multi-disciplinary teams, appropriate data management, clinical relevance of reference datasets, model performance testing, and the importance of human-AI workflow design.<\/li>\n<\/ul>\n\n\n\n
        \n
      • April 2023 \u2014 Predetermined Change Control Plans (PCCPs): Guiding Principles<\/strong> PCCPs are one of the most important concepts for AI SaMD manufacturers to understand. A PCCP is a plan that you submit to FDA before market authorisation, describing the kinds of changes you expect to make to your AI model after launch \u2014 and the protocol you will follow to implement those changes safely \u2014 without requiring a brand-new submission for each update. This is critical for adaptive AI systems.<\/li>\n<\/ul>\n\n\n\n
          \n
        • June 2024 \u2014 Transparency for Machine Learning-Enabled Medical Devices<\/strong> This guidance addresses how manufacturers should communicate to users, healthcare providers, and patients about how their AI works, what its known limitations are, and how its performance has been validated.<\/li>\n<\/ul>\n\n\n\n
            \n
          • January 2025 \u2014 Artificial Intelligence-Enabled Device Software Functions: Lifecycle Management and Marketing Submission Recommendations (Draft)<\/strong> This is the most comprehensive FDA guidance on AI SaMD to date. Published in January 2025, it applies the TPLC framework and specifies exactly what manufacturers must include in their marketing submissions. Key requirements include:<\/li>\n<\/ul>\n\n\n\n
              \n
            1. A detailed model description (architecture, training methodology, intended function)<\/li>\n\n\n\n
            2. Data lineage and train\/test\/validation splits \u2014 where your data came from and how it was used<\/li>\n\n\n\n
            3. Performance tied to specific clinical claims \u2014 not just technical accuracy but clinical relevance<\/li>\n\n\n\n
            4. Bias analysis and mitigation \u2014 evidence that the model performs equitably across relevant patient subgroups (gender, age, ethnicity, comorbidities)<\/li>\n\n\n\n
            5. Human-AI workflow documentation \u2014 how the device fits into clinical practice, and what the human oversight mechanisms are<\/li>\n\n\n\n
            6. Post-market monitoring plan \u2014 how you will track real-world performance and detect algorithmic drift<\/li>\n\n\n\n
            7. Predetermined Change Control Plan (if you intend to update the model post-approval)<\/li>\n<\/ol>\n\n\n\n
                \n
              • August 2025 \u2014 Final PCCP Guidance<\/strong> FDA finalised its PCCP guidance in August 2025, formalising the mechanism for pre-authorised algorithm modifications. This is now the pathway Indian manufacturers should design their AI development roadmaps around from the start.<\/li>\n<\/ul>\n\n\n\n

                What This Means in Practice for Indian SaMD Manufacturers<\/h3>\n\n\n\n

                As of early 2026, FDA has authorised over 1,350 AI-enabled medical devices \u2014 roughly double the number from 2022. The market is growing fast. But the compliance bar has risen just as rapidly.<\/p>\n\n\n\n

                For an Indian company seeking FDA 510(k) clearance or De Novo authorisation for an AI SaMD product, the January 2025 draft guidance effectively defines the new minimum standard. Your submission must demonstrate TPLC thinking \u2014 not just that your device performs well today, but that you have a disciplined system for monitoring it, updating it responsibly, and maintaining performance over time.<\/p>\n\n\n\n

                Three specific gaps trip up Indian SaMD submissions most frequently:<\/p>\n\n\n\n

                1. Training data diversity.<\/strong> FDA expects bias analysis across patient subgroups. If your model was trained entirely on Indian patient data (or, conversely, entirely on Western patient data), you must document this clearly and address the implications for performance in the intended US patient population. The regulatory scrutiny on algorithmic bias has increased significantly.<\/p>\n\n\n\n

                2. Algorithm Change Protocol (ACP).<\/strong> Many Indian manufacturers still treat their AI model as a static product. FDA now expects a documented plan for how changes will be managed. Companies without an ACP or PCCP in place will find post-approval model updates require completely new submissions \u2014 causing costly delays.<\/p>\n\n\n\n

                3. Post-market surveillance design.<\/strong> FDA expects you to specify your monitoring metrics before market authorisation. What is your baseline false-positive rate? How will you detect distribution shift? What will trigger a safety review? These must be pre-specified in your submission, not figured out after your product is on the market.<\/p>\n\n\n\n

                \n\n\n\n

                Part 2: The EU AI Act \u2014 What Indian Exporters Must Comply With From August 2026<\/h2>\n\n\n\n

                The World’s First Comprehensive AI Law<\/h3>\n\n\n\n

                The EU Artificial Intelligence Act (Regulation (EU) 2024\/1689) entered into force on 1 August 2024 and is being phased in progressively. For medical device manufacturers, the most important deadline is August 2026<\/strong>, when the high-risk AI obligations become fully applicable to new AI-powered SaMD placed on the EU market.<\/p>\n\n\n\n

                This is not a distant horizon. If you are planning to launch an AI medical device in Europe, or if you already have CE-marked medical software in the EU, you need to be assessing and building compliance now.<\/p>\n\n\n\n

                How the EU AI Act Overlaps with MDR and IVDR<\/h3>\n\n\n\n

                Before the EU AI Act, Indian manufacturers entering the European market for medical software needed to comply with the EU Medical Device Regulation (MDR 2017\/745) or the In Vitro Diagnostic Regulation (IVDR 2017\/746). Those requirements remain fully in force.<\/p>\n\n\n\n

                The EU AI Act does not replace MDR or IVDR. It adds a second, overlapping regulatory layer on top of them. Any AI system that is part of a CE-marked medical device, or that functions as a standalone SaMD, is classified as high-risk AI<\/strong> under the AI Act’s Article 6(1). This applies automatically and cannot be avoided by product design.<\/p>\n\n\n\n

                The result is dual compliance<\/strong>: your AI SaMD must satisfy both MDR\/IVDR technical documentation requirements and the new AI Act Annex IV requirements. In practical terms, this means your Notified Body will audit your technical file twice \u2014 once against MDR standards, and once against AI Act standards.<\/p>\n\n\n\n

                The Medical Device Coordination Group (MDCG) released MDCG 2025-6 in June 2025 \u2014 its first FAQ formally clarifying how the AI Act overlaps with MDR and IVDR. If you have a Notified Body relationship for EU market access, this document is essential reading.<\/p>\n\n\n\n

                The Core EU AI Act Requirements for High-Risk SaMD<\/h3>\n\n\n\n

                Under the EU AI Act, high-risk AI systems \u2014 including all medical AI \u2014 must meet the following requirements:<\/p>\n\n\n\n

                  \n
                • Data governance and data quality.<\/strong> Your training, validation, and testing datasets must be subject to appropriate data governance practices. You must demonstrate that datasets are relevant, representative, free of errors, and complete. For Indian manufacturers training on Indian patient data, you must address how this data represents the intended EU patient population.<\/li>\n\n\n\n
                • Transparency and explainability.<\/strong> Users and healthcare providers must be able to understand how your AI reaches its outputs. “Black box” AI that cannot provide interpretable reasoning is significantly harder to approve in the EU than in other markets.<\/li>\n\n\n\n
                • Human oversight.<\/strong> The AI Act requires that high-risk AI systems be designed to allow effective oversight by humans. Your device must include mechanisms for clinical staff to override, correct, or reject AI outputs. This must be built into the product design and documented in your technical file.<\/li>\n\n\n\n
                • Robustness, accuracy, and cybersecurity.<\/strong> Your AI must be resilient to errors, faults, and adversarial inputs, and must maintain consistent performance throughout its lifecycle.<\/li>\n\n\n\n
                • Quality Management System aligned with AI Act requirements.<\/strong> Your QMS (typically aligned with ISO 13485 for medical devices) must now also demonstrate data governance, bias mitigation, transparency, and cybersecurity controls \u2014 requirements that go beyond what ISO 13485 alone covers.<\/li>\n\n\n\n
                • Post-market monitoring for AI-specific drift.<\/strong> Similar to FDA’s approach, the EU AI Act requires real-world performance monitoring and bias-drift assessment as part of your ongoing PMS obligations. Annual PDF reports are not sufficient \u2014 you need live monitoring processes.<\/li>\n\n\n\n
                • Registration in the EU AI database.<\/strong> High-risk AI systems must be registered in a new EU AI database (currently being built). This will become a standard part of market access alongside EUDAMED registration for medical devices.<\/li>\n<\/ul>\n\n\n\n

                  Timeline for Indian Manufacturers<\/h3>\n\n\n\n