Medical Devices (Including Software-Based Medical Devices)

Medical devices in India are regulated as “drugs” in the Medical Devices Rules 2017 (MDR) under the Drugs and Cosmetics Act 1940 (DCA). As per the MDR, medical devices are substances used – inter alia – for in vitro diagnosis and surgical dressings, ligatures, blood and blood component collection bags with/without anticoagulant, and devices “intended for internal or external use in the diagnosis, treatment, mitigation or prevention of disease or disorder in human beings or animals, as may be specified from time to time by the central government”.

The foregoing definition was expanded in 2020 by the Central Drugs Standard Control Organisation (CDSCO), the relevant national regulatory body, to include software for assistance in:

• the diagnosis, prevention, monitoring, treatment or alleviation of any disease, disorder, injury or disability;
• the investigation, replacement or modification of the anatomy or of a physiological process supporting or sustaining life; and
• the disinfection of medical devices and control of conception.

The DCA read with the MDR empowers the Central Government to notify certain equipment and devices as medical devices and provides for risk-based classification of medical devices based on the level determined and the parameters provided in Schedule I of the MDR, including the intended purpose of the device. Further, the MDR read with the DCA prescribes the registration requirements for medical devices enforced by the CDSCO. In January 2024, the central government launched the National Single Window System portal for medical device management, so as to facilitate approvals, licences, registrations and clearances for medical devices.

Personal Protective Equipment

The Ministry of Health and Family Welfare (MoHFW) has issued guidelines on the rational use of personal protective equipment (PPE) to be worn by healthcare workers and others working in quarantine centres, hospitals, laboratories and primary healthcare/community settings. The CDSCO has notified PPE as medical devices, given its power under the MDR to notify devices as such (on a risk-based classification). During the COVID-19 pandemic, the central government had notified certain surgical masks and N95 masks as an essential commodity under the Essential Commodities Act 1955 (the “EC Act”) in order to regulate their production, quality, distribution and logistics.

Medical Instruments

Indian law does not differentiate between medical devices and medical instruments. Accordingly, medical instruments that have been notified by the CDSCO would be considered as medical devices under the MDR.

Cosmetics

As per the DCA, “cosmetics” include any article intended to be rubbed, poured, sprinkled or sprayed on, introduced into or applied to the human body or any part thereof for – inter alia – cleansing or altering appearance, and includes any article intended for use as a component of cosmetics. The Cosmetics Rules 2020 (the “Cosmetics Rules”) regulate manufacture, labelling, importation, sale and distribution of cosmetics in India and mandate registration before being manufactured, sold, imported and distributed in India. Categories of cosmetics for which a registration certificate is required include skincare and personal care products. Notably, the Cosmetics Rules prohibit importation of cosmetics that have been tested on animals after 12 November 2014.

Biocides

Although the term “biocides” is not used in India, disinfectants and insecticides are regulated under extant Indian laws. The Drugs Rules 1945 (the “Drugs Rules”) stipulate that disinfectants must conform to the Indian Standards specification (IS 1061:1997) laid down from time to time by the Bureau of Indian Standards (BIS). During the COVID-19 pandemic, masks and hand sanitisers had been notified by the government as essential commodities under the EC Act. Separately, biocides – depending on their chemical composition – may also be regulated under the Insecticide Act 1968 and rules made thereunder or may be subject to BIS standards or quality control orders as well.

Food and Nutritional Supplements

Food and nutritional supplements are regulated under the Food Safety and Standards Act 2006 (the “FSS Act”), which is a consolidated legislation for food safety, genetically modified organisms (GMOs) and nutraceuticals and which provides a single line of control with a focus on self-compliance. Subject to the type of food, specific rules under the FSS Act provide the regulatory framework on manufacture, importation and sale/advertising (among other things). In 2022, the Draft Food Safety and Standards (Genetically Modified Foods) Regulations 2022 (the “GMO Regulations”) were proposed and provide guidance on the prior approval and labelling requirements for GMOs. These regulations – if enacted – will apply to GMOs intended for food use, food ingredients produced from GMOs that contain modified DNA, and those that do not contain modified DNA.

Nutraceuticals are further regulated through the Food Safety and Standards (Health Supplements, Nutraceuticals, Food for Special Dietary Use, Food for Special Medical Purpose, and Prebiotic and Probiotic Food) Regulations 2022 (the “Nutraceuticals Regulations”), which cover – inter alia – nutraceuticals, health supplements, and foods containing probiotics and prebiotics. Nutraceuticals can only be manufactured, distributed, sold or imported as per the requirements and procedure provided in the FSS Act read with the Nutraceuticals Regulations.

Pharmaceuticals

The term “pharmaceuticals” is not defined under extant law, as pharmaceuticals are regulated as “drugs” under the DCA read with the Drugs Rules. Drugs as per the DCA include, inter alia:

• medicines for internal or external use on human beings or animals;
• substances intended to be used for or in the diagnosis, treatment, mitigation or prevention of any disease/disorder in human beings or animals, including preparations for repelling insects;
• substances intended to affect the structure or any function of the human body; and
• medical devices.

The DCA read with the Drugs Rules provides the regulatory framework for manufacture, sale, importation and distribution of drugs in India.                                                                                                           

Blood Products

The Drugs Rules define blood products as “a drug manufactured or obtained from pooled plasma of blood by fractionation, drawn from a donor”. These rules further provide guidance on the establishment and operation of blood centres.

Psychedelics

Psychedelics are regulated under the Narcotic Drugs and Psychotropic Substances Act 1985 (the “NDPS Act”), which empowers the government to take measures to prevent/combat abuse of narcotic drugs and psychotropic substances (such as cannabis, opium, and heroin) and their trafficking. The use of such substances is permitted under the NDPS Act for scientific or medical purposes.

Cannabidiol

Although cannabidiol (CBD) is not specifically covered under prevailing Indian law pertaining to drugs and narcotics, cannabis/hemp is regulated under extant law. Under the NDPS Act, “cannabis” means the separated resin and the flowering or fruiting tops of the cannabis plant (excluding the seeds and leaves when not accompanied by the tops), as well as any mixture – with/without any neutral material – of these forms of cannabis or any drink prepared therefrom. Under the NDPS Act, the cultivation, production, manufacture, possession, sale, purchase, transportation or use of cannabis is punishable with imprisonment and a fine, except when used for medical or scientific purposes. CBD products extracted from hemp are legal in India as long as their THC (tetrahydrocannabinol) content is not higher than 0.3%. Products with higher THC will fall within the category of cannabis and will be covered under the NDPS Act. However, CBD extracted from seeds and leaves of the cannabis plant will likely fall outside the purview of the NDPS Act.

Further, under the Food Safety and Standards (Food Products Standards and Food Additives) Regulations 2011 (the “2011 Additives Regulations”), hemp seed (ie, hulled, non-viable seeds obtained from cannabis sativa/other indigenous cannabis species), and hemp seed oil and flour can be sold as food or used as an ingredient in a food for sale subject to conformity with the 2011 Additives Regulations. Under these regulations, the level of CBD – the non-psychoactive component of the cannabis species – in any food for sale consisting of hemp seed or seed products must not exceed 75 mg/kg.

Medical Apps

Currently, there are no specific laws governing medical apps in India. However, in 2016 the Department of Health and Family Welfare of the MoHFW issued the Electronic Health Records Standards, which provide the standards for maintenance of electronic health records (pertaining to the identification and demographic information of patients, functional specifications of health record systems, data exchange standards, etc) by healthcare providers in India.

Additionally, medical apps would also be subject to the Information Technology Act 2000 (the “IT Act”) and the rules thereunder. Since these apps collect and process sensitive personal information such as medical records and history, the data protection regime currently applicable (ie, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules 2011 (the “SPDI Rules”)) would also apply. However, the SDPI Rules and the compliances therein will be replaced by the Digital Personal Data Protection Act 2023 (the “DPDP Act”), notified in August 2023 – the provisions of which will come into force through a phased implementation.

The DPDP Act governs the processing of “digital personal data” of an individual and would likely apply to medical apps that collect personal data. Moreover, such apps – if they are intermediaries – would be required to comply with the due diligence and additional due diligence obligations mentioned under the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules 2021. Also, the directions under subsection (6) of Section 70B of the IT Act, relating to information security practices and procedures for the prevention of, response to and reporting of cyber-incidents for a safe and trusted internet, mandate body corporates, intermediaries, etc, to report cyber-incidents to the Indian Computer Emergency Response Team within six hours of noticing such incidents or of being made aware of such incidents.

Telemedicine

The Telemedicine Practice Guidelines (the “Telemedicine Guidelines”) issued under the Indian Medical Council (Professional Conduct, Etiquette and Ethics) Regulations 2002 have been framed to enable registered medical practitioners (RMPs) to provide healthcare using telemedicine. These guidelines prescribe protocols for the physician–patient relationship, liability, management, exchange of information, security of records, etc, and are binding on medical practitioners.

The Telemedicine Guidelines specifically address technology platforms that work across a network of RMPs and enable patients to consult through such platforms. Technology platforms (mobile apps, websites, etc) providing telemedicine services have the obligation to ensure that consumers consult RMPs duly registered with national/state medical councils and are required to conduct their due diligence before listing any RMP on their portal (ie, provide the name, qualification, registration number and contact details of every RMP listed thereunder). Platforms based on AI/machine learning are not allowed to counsel patients or prescribe medicines; however, they could assist and support an RMP with patient evaluation, diagnosis or management.

Additionally, the Telecom Commercial Communications Customer Preference Regulations 2018 (TCCCPR) and the Guidelines for the Prevention and Regulation of Unsolicited and Unwarranted Business Communication 2024 (the “UUBC Guidelines”) prohibit unsolicited and unwarranted commercial/business communications. Accordingly, telemedicine-based commercial communications will have to comply with obligations and registration requirements under the TCCCPR and the UUBC Guidelines.

Wearables

Currently, India does not have a specific law governing health-related wearables. However, as noted previously, the definition of medical devices is quite broad, leaving the categorisation of wearables as a medical device open to interpretation. That said, as per a 2022 Parliamentary Standing Committee Report on Medical Devices: Regulation and Control, the expansive definition of medical devices includes digital wearables. While this report does not have the force of the law, it reflects the interpretation of parliament on the subject.

Stem Cells

Stem cell therapy for the treatment of blood cancer and blood disorders (ie, bone marrow transplant or hematopoietic stem cell transplant) are permitted in India. No other form of stem cell therapy is permissible or available in India. The Indian Council of Medical Research (ICMR), jointly with the Department of Biotechnology, issued the National Guidelines for Stem Cell Research 2017 (the “Stem Cell Guidelines”). These guidelines are not applicable to the use of hematopoietic stem cells for treatment of hematological, immunological and metabolic disorders. For hematopoietic stem cell transplantation, the ICMR and the Department of Health Research have issued the National Guidelines for Hematopoietic Cell Transplantation 2021, setting the standards for hematopoietic cell transplantation in India. Further, the government of India enacted the New Drugs and Clinical Trials Rules 2019 for regulation of clinical trials and “new drugs”, which includes within its ambit stem cell-derived products, gene therapeutics products, and xenografts intended to be used as a new drug.

Although India does not have a separate categorisation of borderline products, regulatory bodies/authorities under extant law have been provided with the power to assess the characteristics of products as drugs, medical devices, and cosmetics and to grant registration accordingly on a case-by-case basis.

Drugs and Cosmetics

Under the DCA, the term “manufacture”, in relation to drugs and cosmetics, includes “any process or part of a process for making, altering, ornamenting, finishing, packing, labelling, breaking up or otherwise treating or adopting any drug or cosmetic with a view to its sale or distribution, but does not include the compounding or dispensing of any drug, or the packing of any drug or cosmetic in the ordinary course of retail business” and “to manufacture shall be construed accordingly”.

Additionally, the Drugs Rules provide an inclusive definition of “manufacturer”, which includes “a manufacturer of drugs, who may be a company or a unit or a body corporate or any other establishment in a country other than India, having its drugs manufacturing facilities duly approved by the National Regulatory Authority of that country, and who also has a free sale approval of the drugs approved by said authority in the concerned country, and/or in other major countries”. Generally, drugs are required to comply with the standards laid down in the Second Schedule to the DCA. Depending on the nature of the drugs or cosmetics, the facilities will have different requirements, as noted here.

The DCA prohibits a person from manufacturing (for sale or for distribution), selling, stocking, exhibiting, offering for sale, or distributing any drug or cosmetic without obtaining a licence for this in accordance with the provisions of the DCA. Further, the DCA also stipulates the specific requirements for the packaging and labelling of drugs and cosmetics. The Drugs Rules prohibit importation of goods that have not been packed and labelled in conformity with said rules.

As regards cosmetics, cosmetics factories are required to be located in a sanitary place and cannot be used for residence or be interconnected with residential areas. Such manufacturing sites are required to be well ventilated and clean, so as to ensure that the consumer receives products of specified quality. Further, effective measures are required to be taken at the factory premises to avoid any contamination from the surrounding environment, in addition to keeping it free of insects, rodents, flies, etc. By way of example, under the Cosmetics Rules, walls and floors in the premises must be smooth, washable and covered, and should permit easy and effective cleaning and disinfection. Details specific to different products covered under the DCA are provided under schedules of the Drugs Rules – for instance, Good Manufacturing Practices (GMPs) and requirements of premises, plant and equipment for pharmaceutical products are provided under Schedule M, whereas Schedule M-III deals with quality control systems in medical devices and in vitro products. By way of a 2023 amendment, Pharmaceutical Quality System (PQS), Quality Risk Management (QRM), Product Quality Review (PQR), qualification and validation of equipment, change control management, and specific requirements for manufacturing of hazardous products, biological products, radiopharmaceutical and phytopharmaceuticals have also been introduced in Schedule M.

Blood Products

Under the Drugs Rules, a licence is required for operating a blood centre, the processing of human blood for components, manufacture of blood products, or the collection, processing, testing, storage, banking and release of umbilical cord blood stem cells. Anyone applying for such licence must comply with the conditions laid down in the Drugs Rules, including:

• providing adequate space, plants and equipment for any or all of the operations of blood collection or blood processing;
• maintaining adequate technical staff; and
• providing adequate arrangements for storage of whole human blood, human blood components and blood products.

Medical Devices

As noted previously, medical devices are required to be in conformity with the provisions of the MDR, including with regard to:

• registration requirements;
• licensing requirements;
• labelling requirements; and
• essential principles of safety and performance of medical devices as specified in the guidelines issued by the MoHFW and standards laid down by the BIS, etc.

These requirements/standards differ based on the risk classification of these medical devices. Specifically, Schedule M-III of the Drugs Rules specifies requirements for a quality management system (QMS) to be used by the manufacturer for the design and development, manufacture, packaging, labelling, testing, installation and servicing of medical devices.

Food

The Food Safety and Standards (Licensing and Registration of Food Businesses) Regulations 2011 (the “Food Licensing Regulations”) detail general requirements pertaining to hygienic and sanitary practices to be followed at manufacturing locations/establishments by all food business operators applying for a licence. Specifically with regard to manufacturing sites/food establishments, the Food Licensing Regulations ideally require such establishments to be located away from environmental pollution and industrial activities that – inter alia – produce obnoxious odours, fumes, excessive soot, dust, smoke, chemical/biological emissions and pollutants, and which pose a threat of contaminating establishments prone to infestations of pests or where wastes cannot be removed effectively. Compliance with these conditions is necessary under the licence, as the FSS Act penalises the manufacture or processing of any article of food for human consumption in unhygienic or unsanitary conditions. The Food Licensing Regulations also specify requirements pertaining to procurement of raw materials, processing, packaging and distribution, and waste disposal.

Biocides

Biocides such as hand sanitisers are regulated under the DCA and the Drug Rules. The standards prescribed under the Second Schedule of the DCA, as noted previously, apply to such products and would require a manufacturing licence.

Stem Cells and Pharmaceuticals

The Stem Cell Guidelines make it mandatory for stem cells or their products/derivatives to be processed in CDSCO-licensed GMP-compliant facilities. Further, facility requirements prescribed for aseptic manufacturing as per Schedule M of the Drugs Rules must be followed for the manufacturer of stem cells or their products/derivatives. Schedule M (which also applies to pharmaceutical products) specifies requirements for, inter alia:

• sanitation and hygiene;
• ancillary areas;
• storage areas;
• production areas;
• weighing areas; and        
• quality control areas.

The Companies Act 2013 (the “Companies Act”) provides for a statutory mandate for corporate social responsibility (CSR) in India. Under the Companies Act, a company with the net worth of INR5 billion (approximately USD61,053,050) or turnover of INR10 billion (approximately USD122,088,400) or net profit of INR5 million or more during a financial year is required to comply with CSR provisions and spend at least 2% of the average net profits made during the three immediately preceding financial years in every financial year.

The Companies Act also provides a list of activities that may be included in a company’s CSR policy, including activities relating to combating Human Immunodeficiency Virus (HIV), Acquired Immune Deficiency Syndrome (AIDS), malaria and other diseases, or any other activity as may be prescribed.

Drugs and Medical Devices

The advertising of all drugs, including medical devices, is governed by the Drugs and Magic Remedies (Objectionable Advertisement) Act 1954 (the “DMRA”). The DMRA prohibits, inter alia, the publication of misleading advertisements relating to drugs – ie, advertisements containing any matters that directly or indirectly give a false impression regarding the true character of the drug or that make a false claim for the drug or that are otherwise false or misleading in any material. Further, the Drugs Rules state that advertisements for prescription drugs specified under Schedule H, H1 and X cannot be made without prior sanction of the central government. Drugs, including medical devices, cannot be advertised for prevention/treatment of diseases (such as AIDS and diabetes) as listed in Schedule J of the Drugs Rules. In 2024, the Uniform Code for Pharmaceutical Marketing Practices 2024 (UPCMP) have been issued by the Department of Pharmaceuticals to all pharmaceutical associations requiring them to constitute an Ethics Committee for Pharmaceutical Marketing Practices (ECPMP), set up a dedicated UCPMP portal on their website, and implement the new code.

Telemedicine

Under the Telemedicine Guidelines, RMPs are not permitted to solicit patients for telemedicine through any advertisements or inducements. Similar requirements have also been highlighted under the Indian Medical Council (Professional Conduct, Etiquette and Ethics) Regulations 2002 that consider the soliciting of patients, directly or indirectly, by a physician/group of physicians or institutions/organisations as unethical.

Stem Cells

In addition to the foregoing, advertising and publicity pertaining to stem cells is governed by the DCA and rules therein. The advertisements pertaining to prevention/treatment of diseases (such as AIDS and diabetes) listed in Schedule J of the Drugs Rules are not permissible. As per the Stem Cell Guidelines, publicly claiming an available cure for such specified conditions using stem cells or their derivatives is prohibited and may lead to potential action by regulatory authorities such as the CDSCO and relevant state authorities.

Food and Nutritional Supplements

The FSS Act prohibits making misleading/deceiving advertisements. Further, the Food Safety and Standards (Advertising and Claims) Regulations 2018 provide the broad requirements pertaining to advertisements on/relating to food products.

As for nutraceuticals, under the Nutraceuticals Regulations, the labelling, presentation and advertising of nutraceuticals cannot claim properties or refer to properties of preventing, treating or curing any specific disease/disorder/condition. However, statements relating to the general well-being of the body may be allowed by authorities if supported by generally accepted scientific data.

Similarly, under the FSS Act, labels pertaining to GMOs cannot – inter alia – contain claims that are false or misleading concerning the food products or the quantity, nutritive value (implying medicinal or therapeutic claims) and place of origin of said food products.

Consumer Law on Advertisements

The Consumer Protection Act 2019 (CPA), which was enacted to protect the interests of consumers, defines a misleading advertisement as “an advertisement [that] falsely describes products or services, or gives a false guarantee to or is likely to mislead the consumers as to the nature, substance, quantity or quality, or conveys an express or implied representation [that] would constitute an unfair trade practice or deliberate concealment of important information”.

The CPA also establishes the Central Consumer Protection Authority (CCPA) as the central authority for regulating matters relating to unfair trade practices, false or misleading advertisements, and the violation of rights of consumers. The CCPA has issued the Guidelines for Prevention of Misleading Advertisements and Endorsements for Misleading Advertisements 2022 (the “Misleading Advertisements Guidelines”) to curb misleading advertisements and protect consumers. The Misleading Advertisements Guidelines apply to all types of advertisements, irrespective of the form, format or medium of the advertisement. Notably, the CCPA can impose a penalty on advertisers for any misleading advertisements.

Moreover, the Advertising Standards Council of India (ASCI), a self-regulatory body for advertisements, has specific guidelines for the advertising of food and beverages, cosmetics, and skin-lightening or fairness-improvement products. As per the ASCI Code of Self-Regulation, advertisements must be truthful, and descriptions, claims and comparisons that relate to matters of objectively ascertainable fact must be capable of substantiation. Non-compliance with the ASCI’s code and guidelines could result in a complaint to ASCI’s Consumer Complaints Council and subsequently to the CCPA for appropriate action.

Additionally, following the Supreme Court of India’s order, the Ministry of Information and Broadcasting (MIB) has issued an advisory to advertisers and advertising agencies to annually submit a “Self-Declaration Certificate” on its portals for products and services related to the “food and health” sectors, attesting that the advertisement does not contain misleading claims and complies with applicable regulatory guidelines. However, as of July 2024, there is an industry-led pushback to liberalise this requirement due to associated ease of doing business-related challenges.

Drugs

As noted in 2.1 Design and Manufacture (Drugs and Cosmetics), drugs are subject to extensive registration and licensing statutory requirements. The Drugs Rules, under the Second Schedule, specify the standards of quality that must be complied with for various drugs imported and manufactured for sale.

Further, to import a bulk drug/formulation/special product into India, information under Schedule D(II) is required to be submitted for the purposes of registration by the manufacturer/authorised agent with the application form. This information includes:

• a list of countries where marketing authorisation/importation permission for said drug has been granted;
• a list of countries where marketing authorisation/importation permission for said drug has been cancelled/withdrawn; and
• a list of countries where marketing authorisation/importation permission for said drug may be pending.

Additionally, upon being satisfied that a new drug is effective and safe for use in the country, the licensing authority may issue importation permission for such drug to be imported as a raw material (bulk drug substance) or as a finished formulation.

Medical Devices

The CDSCO issued the Essential Principles for Safety and Performance of Medical Devices (the “Medical Devices Principles”). Under the Medical Devices Principles, medical devices should be designed and manufactured to perform the intended purpose and not compromise the safety/health of patients/users. Further, medical devices should achieve the intended performance and all known and foreseeable risks/undesirable effects should be minimised. Additionally, every medical device should be accompanied by clinical evidence demonstrating that the device is compliant with the Medical Devices Principles.

Moreover, the manufacturer must retain and be able to provide documentation demonstrating that the medical device conforms to the standards of the Medical Devices Principles. Further, under the Drugs Rules, medical devices are required to conform to the Indian Standards specifications laid down by the BIS or – in their absence – to international standards. As of February 2022, the BIS has prescribed standards for 1,485 medical devices/equipment.

Cosmetics

Cosmetics cannot be imported into India without due registration in line with Form 42, accompanied by relevant information and undertakings as specified in Schedule D(III) under the Drugs Rules. Schedule D(III) specifically requires the submission of copies of the licences or marketing authorisation/registration issued by the regulatory authority of various countries, as well as the submission of a list of countries where marketing authorisation or importation permission for said cosmetics has been granted. Additionally, from a quality and standards perspective, cosmetics in finished form are required to conform to the Indian Standards specifications laid down by the BIS for each specific category of cosmetics.

Food

The FSS Act requires every food business operator to ensure that their food articles comply with safety and other regulatory requirements throughout all stages of production, processing, importation, distribution and sale within the businesses under their control. In light of these requirements, food business operators or any person on their behalf are prohibited from manufacturing, storing, selling or distributing any article of food that, inter alia:

• is unsafe;
• is misbranded;
• is sub-standard; or
• contains extraneous matter.

The FSS Act also places a restriction on the employment of any person suffering from “infectious, contagious or loathsome” diseases. Notably, the FSS Act contains several safeguards from a safety perspective. By way of example, in situations where any unsafe food is part of a batch, it is to be presumed that all the food in that batch, lot or consignment is also unsafe – provided that, post-assessment within a specified timeframe, no evidence contrary to this effect is found. The FSS Act also details similar obligations for wholesalers, distributors and sellers from a hygiene, storage and misbranding standpoint.

Blood Products

Under the Drugs Rules, blood products are to be manufactured in premises separate from those meant for blood banking. The rules mandate certain requirements for granting/renewal of a licence to manufacture blood products. By way of example, under the Drugs Rules, separate facilities are to be provided for quality control for the manufacture of blood products and for instrumental and safety testing. A quality control department should, inter alia, be responsible for:

• evaluating adequacy pertaining to storage of raw materials;
• evaluating quality of finished products; and
• approval/rejection procedures.

Additionally, blood products are required to conform with the standards specified in the Indian Pharmacopoeia and – where such standards are not specified for a product – with the standards specified in the United States Pharmacopoeia or the British Pharmacopoeia.        

Stem Cells

The Stem Cell Guidelines specify that any stem cell-based product already approved and marketed outside India (or for concurrent clinical trial in India) will require approval of the CDSCO after clearance from the relevant regulatory authorities before enrolling participants for trial.

Similarly, any clinical trial of a product intended to be licensed and marketed is also required to have prior approval of the CDSCO after clearance from the relevant authorities before enrolling participants. Additionally, the quality control and quality assurance (QC/QA) for stem cell product development (including the cell processing and manufacturing stages) should be compliant with requirements under Schedule M of the DCA and the Drugs Rules.

As pointed out by the Press Note of the MoHFW, India has entered into memorandums of understanding (MoUs) and agreements with 53 countries in the healthtech sector. Some of the publicly available MoUs with countries such as Cuba, Israel and Italy indicate that India aims to advance co-operation regarding regulation of medical devices, the exchange of information pertaining to medical devices, etc.

Further, the ICMR Guidelines on International Collaboration/Research Projects in Health Research also specify that India presently has several bilateral science and technology co-operation agreements with other countries for facilitating co-operation in the areas of biomedical research between India and foreign countries. So far, the purpose of such agreements has included:

• the exchange of scientific information;
• technology transfer and development; and
• the procurement of scientific equipment.

Drugs

Post-market surveillance study forms a part of the conditions for granting of permission to import/manufacture a new drug/medical device. A post-market surveillance study will have to be conducted during the initial period of two years for marketing of the new drug formulation, following the protocol and names of the investigator being duly approved by the licensing authority.

The Drugs Rules specify the requirements for having a QMS in place for medical devices used by the manufacturer for, inter alia, their design and development, manufacture, packaging, labelling, testing, installation and servicing. One documentation requirement under the QMS is the preparation of a device master file, containing specific information such as post-marketing surveillance data. The guidance on the QMS also provides information pertaining to corrective action (such as reviewing non-conformities and recording the results of any action taken) as well as preventative action (which includes determining potential non-conformities and their causes and recording any action taken – specifically in the case of a customer complaint).

The manufacturer is also required to notify the regulatory authority of any adverse event or in the case of any market withdrawal. Further, the means employed for standardising and testing the manufacture of drugs may be subject to authorised inspections. The requirement to report adverse events also applies to medical devices. Medical devices may be recalled by manufacturers if they consider or have reasons to believe that a medical device is likely to pose risk to the health of a user or patient and may be unsafe. Details of such recall will have to be communicated to the regulatory authority.

Cosmetics

The Cosmetics Rules place an obligation on the manufacturer/its approved agent to voluntarily recall/withdraw cosmetics from the market if there is reason to believe that such cosmetics are likely to affect the health of consumers or would negatively affect consumers and to inform the regulatory authority. Additionally, manufacturers are required to retain records of the details of each batch of cosmetics for a period of three years after the date of expiry. Additionally, the CCPA also has the authority to order the recall of goods that are dangerous, hazardous or unsafe. Records pertaining to the manufacture of cosmetics must be maintained in line with the Eighth Schedule of the Cosmetics Rules.

Food and Nutritional Supplements

A food business operator is required to:

• immediately recall food (such as GMOs and nutraceuticals) from the market and from consumers if the manufactured or distributed food is not in compliance with regulations;
• indicate reasons for the withdrawal; and
• inform the competent authorities and co-operate with them.

Further, the food business operator must inform the competent authorities of the action taken to prevent risks to the consumer. As stated earlier, the CCPA can also pass orders to recall food that is dangerous, hazardous or unsafe.

Telemedicine

The Telemedicine Guidelines mandate record-retention obligations for RMPs. Specifically, records such as logs of interaction, patient records and prescriptions must be maintained to establish a digital trail of consultation.

Stem Cells and Pharmaceuticals

As noted in 2.1 Design and Manufacture (Stem Cells and Pharmaceuticals), quality assurance for stem cell manufacturing stages must be compliant with requirements as per GMPs under Schedule M of the Drugs Rules (which also pertains to pharmaceuticals). GMP practices under Schedule M recommend the setting up of a self-inspection team with a quality audit procedure for assessment purposes. As a part of this, written instructions for self-inspection are to be drawn up, which should include recall procedures.

Further, a prompt and effective product recall system for defective products must be devised for the timely informing of all concerned stockists, wholesalers and suppliers up to the retail level within the shortest period possible. A written standard operating procedure and associated records of actions taken must also be maintained for, inter alia:

• environmental monitoring;
• pest control;
• complaints;
• recalls made; and
• returns received.

This is in addition to the distribution records that must be maintained to facilitate prompt and complete recall, if and when necessary.

Blood Products

The quality control department, as required to be set up under the Drugs Rules Part XII-C, also has the duty to review complaints, recalls, returned or salvaged products and investigations conducted thereunder for each blood product. Part XII-C also specifies records-maintenance requirements pertaining to blood products.

CDSCO

The CDSCO is the central drug authority tasked with discharging the functions assigned to it under the DCA.

FSSAI

The Food Safety and Standards Authority of India (FSSAI) is a statutory body established under the FSS Act. The FSSAI is responsible for:

• regulating and monitoring the manufacture, processing, distribution, sale and importation of food;
• specifying the standards and guidelines in relation to food;
• specifying the limits for use of food additives and crop contaminants; and
• specifying the procedure and enforcement of quality control.

NCB

The Narcotics Control Bureau (NCB) is the central authority established under the NDPS Act. The NCB is responsible for co-ordinating with various offices and authorities in enforcing the provisions of the NDPS Act.

BIS

The BIS is the national standards body of India. It is responsible for:

• standardisation;
• marking and quality certification of goods; and
• conformity assessment.

CCPA

The CCPA was established under the CPA in order to regulate matters relating to:

• the violation of consumers’ rights;
• unfair trade practices; and
• false or misleading advertisements that are prejudicial to the interests of consumers.

The regulatory enforcement bodies discussed in 3.1 Regulatory Authorities exercise their powers to ensure compliance with the extant laws. These bodies are responsible for granting, revoking and suspending approval/registration and allowing importation of the products under their control and jurisdiction.

The CDSCO enables investigations and inspections, conducts searches and seizures, and commences prosecutions through its officers in order to ensure compliance with the provisions of the DCA and the Drugs Rules.

As per the FSS Act, investigations and inquiries into food establishments and seizure of adulterated/unsafe food are undertaken by food safety officers to ensure compliance with legal requirements.

The NCB has investigative powers such as conducting searches and seizures, as well as the power to make arrests for violating the provisions of the NDPS Act, pursuant to a warrant.

Additionally, the CCPA has the power to, inter alia:

• inquire or commence an inquiry/investigation;
• file complaints before the consumer forum; and
• issue guidelines to prevent unfair trade practice and protect consumers’ interests.

Drugs and Cosmetics

The DCA imposes a penalty on importers and manufacturers for failure to comply with provisions of the DCA and rules made thereunder. By way of example, it penalises manufacturers for importation of spurious/adulterated drugs and cosmetics, sub-standard drugs or cosmetics, drugs likely to involve risk to life, or drugs that misrepresent the therapeutic value with imprisonment up to a term of three years or with a fine (or both).

The DCA also imposes a penalty of imprisonment extending up to a lifetime and a fine of not less than INR1 million (approximately USD12,104) on any person who manufactures for sale/distribution or who sells/stocks any adulterated/spurious drug that is utilised by a person for diagnosis, treatment, mitigation or prevention of any disease or disorder and that is likely to cause their death or bodily harm amounting to grievous hurt as per the Indian Penal Code (IPC). The DCA also penalises, inter alia, the manufacturing for sale/distribution, selling or stocking of spurious or adulterated cosmetics.

Food

The FSS Act imposes fines for the sale, storage, distribution or importation of food of sub-standard quality, misbranded food, and food containing extraneous matter, as well as for the unhygienic/unsanitary processing or manufacturing of food.

Consumer Protection

The CPA imposes penalties of imprisonment and a fine for the manufacturing for sale, storing, selling, distribution or importation of products containing adulterant or spurious products, especially if they cause injury or death.

In some cases, penalties have been imposed under the above-mentioned legislation in the form of fines, depending on the nature and severity of the offence committed. By way of example, in 2018, the CDSCO ordered Johnson & Johnson Private Limited to pay compensation between INR3 million (approximately USD36,116) and INR12.3 million (approximately USD148,061) on a case-by-case basis for faulty ASR (articular surface replacement) hip implants manufactured and imported by them.

The CPA allows consumers to raise claims for product liability action against the product manufacturer, seller or service provider. Under the CPA, “product liability” pertains to the responsibility of a manufacturer/seller to compensate for any “harm” caused to a consumer by a defective product manufactured or sold or by deficiency in services. The scope of harm envisaged in respect of product liability is broad and includes:

• damage to property;
• personal injury;
• mental agony or emotional distress attendant to personal injury;
• illness; or
• damage to property.

A product manufacturer can be held liable for:

• a manufacturing defect;
• a design defect;
• deviation from manufacturing specifications;
• non-conformity with express warranty; or
• providing inadequate instructions/warnings for use of the products.

The product manufacturer will be held liable despite proving that it was not negligent or fraudulent in making the express warranty for the product. However, a product manufacturer will not be held liable – inter alia – for failing to instruct or warn about an obvious or commonly known danger or about a danger that a consumer ought to have known, given the characteristics of the product.

Product sellers who are not the manufacturer of the product can be held liable, inter alia:

• if substantial control over the designing, testing, manufacturing, packaging or labelling of a product that caused harm was exercised by them;
• if the product was altered/modified by them and such alteration/modification resulted in harm; or
• for failure in exercising reasonable care in assembling, inspecting or maintaining the product.

As regards drugs and cosmetics, the DCA also provides for criminal liability for manufacturers and producers that do not comply with the standards provided therein. Accordingly, a consumer or recognised consumer association can either:

• send a drug/cosmetic for testing/analysis to a government analyst appointed under the DCA and institute prosecution for an offence related to the manufacture, sale, importation of drugs/cosmetics before a criminal court; or
• approach a consumer forum to institute a consumer complaint under the CPA for a claim of product liability.

Given that food is considered a good under the CPA, any product liability claim can be brought before a consumer forum with appropriate jurisdiction.

At present, there are no legislative deliberations or jurisprudence on the impact of technological advancements for product liability claims regarding medical devices and consumer health products.

India has an integrated judicial system for the entire country – ie, there is one hierarchy of courts, with the Supreme Court of India being the highest court with original, appellate and advisory jurisdiction. Each state in India has a High Court followed by various district courts. The High Courts have original and appellate jurisdiction and the power of superintendence over all district courts within their jurisdiction.

The district courts adjudicate upon civil and criminal matters. A civil suit under the CPC can be instituted before a civil court that has the pecuniary, territorial and subject matter jurisdiction. As per the CPC, a suit must be instituted at the court of the lowest grade competent to try the suit – within the local limits of its jurisdiction – and:

• where the property is situated;
• where the defendant actually and voluntarily resides, or carries on business, or personally works for gain; or
• where the cause of action, wholly or in part, arises.

Additionally, the following acts are listed as offences under the IPC, and criminal suits can be instituted thereon:

• adulterating a drug/medical preparation, reducing its efficacy, or causing a change in the operation of such drug/medical preparation;
• sale of adulterated drugs, or sale of drugs as a different drug/medical preparation; and
• adulteration of food/drink intended for sale, or sale of noxious food.

For consumer law matters, the CPA provides for the setting up of consumer forums at the district, state and central levels, with jurisdictions based on the value of the goods and services paid for. Further, consumer complaints can only be instituted with the consumer forum – within the local limits of its jurisdiction – and, inter alia:

• where the opposite party ordinarily resides, carries on business, has a branch office, or personally works for gain;
• where the cause of action arises; or
• where the complainant resides or personally works for gain.

State and central commissions are also empowered to exercise appellate jurisdiction.

Given the broad definition of the term “consumer”, a consumer complaint can be filed by a person not of Indian origin upon fulfilment of certain conditions – namely, that at the time of instituting the complaint, the opposite party resides or carries on business, or the cause of action wholly or in part arises, within the jurisdiction of the consumer court.

In India, costs are imposed at the discretion of the court, and the court has the power to determine the extent of costs to be paid by the parties to the case. Costs must follow the event and courts must provide reasons for imposing costs otherwise. Courts can also impose costs for seeking excessive adjournments that cause delay in proceedings.

Similar power vests with the consumer forum under the CPA. The CPA allows the consumer courts to impose adequate costs on parties upon satisfaction that the goods complained about are defective and the claims for compensation under product liability are proved. Further, as a measure of deterrence, the consumer commissions can impose costs on parties for more than two requests for adjournment of proceedings.

Drugs and Cosmetics

If an entity is aggrieved by an order (cancellation or suspension of a licence or registration certificate), an appeal can be filed by such entity to the central/state government (this depends on a case-by-case basis). The central/state government – after providing the appellant with an opportunity to represent their views – may pass an order, or reverse or modify the impugned order, as it deems fit. Indian law also allows judicial review of decisions passed by regulatory bodies. By way of example, under the DCA, appeals and revisions may be made to the High Court.

Food

Under the FSS Act, any person aggrieved by an improvement notice, a refusal to issue a certificate as to improvement, or cancellation, suspension or revocation of a licence can appeal to the Commissioner of Food Safety, whose decision is final.

Consumers

The appeal for a CCPA order lies before the National Commission. For a District Commission order, the appeal lies before the State Commission, and for a State Commission order, the appeal lies before the National Commission. Appeals against an order of the National Commission lie before the Supreme Court of India. An appeal may be made between 30 to 45 days, depending on the specific forum whose order is being appealed against.

Additionally, it is possible to approach civil courts for matters pertaining to breach of contract (the commercial courts at district and state level) and tortious claims, beyond the consumer forum as well. In the event of a criminal offence under penal provisions (such as criminal negligence), a judicial magistrate may be approached.

Class action suits can be filed under the Civil Procedure Code 1908 (CPC) as well as the CPA. Under the CPC, one or more persons can institute a class action lawsuit on behalf of other persons with the same interests, with the permission of the court. It is not necessary for such persons to have the same cause of action, but they must have the same interests.

Under the CPA, one or more consumers can file a complaint in relation to any products on behalf of or for the benefit of all consumers if they have the same interests and have been so permitted by the District Commission. In fact, the Supreme Court of India also allows individuals to bring “public interest litigations” to support the concerns of society. This type of litigation is initiated for the enforcement of the general interest that the public or a class of the community has and by which their legal rights or liabilities are affected.

Indian courts regularly encourage parties to opt for ADR mechanisms, such as arbitration and mediation. Courts can refer a dispute to arbitration, conciliation, mediation, etc, if there is the possibility of a settlement that may be acceptable to the parties.

In addition to specific statutes that regulate and govern arbitration and mediation in India, mediation has been statutorily recognised in the CPA as an ADR mechanism. As per the CPA, if there is a possibility of settlement – and if acceptable to the parties – the District Commission can refer an issue for mediation. All cases can be referred for mediation under the CPA except matters relating to proceedings in respect of medical negligence resulting in grievous injury or death.

A mediator is required to take into consideration, inter alia, usages of trade and circumstances of the dispute and is guided by the principles of natural justice. In the event the mediation fails, the District Commission will proceed with the complaint.

A spurious or defective product may be subject to civil and criminal proceedings before courts. Civil and criminal proceedings can also proceed simultaneously; however, whether either proceeding will be stayed is dependent on the facts and circumstances of each case. Accordingly, depending on the case, any product safety compliance-related breach could be used to bolster a product liability litigation.

The Ministry of Chemicals and Fertilisers, Department of Pharmaceuticals has launched a Product-Linked Incentive (PLI) Scheme incentivising the domestic production of, and attracting large investments in, the medical devices sector. The PLI Scheme focuses on areas such as cancer care/radiotherapy medical devices, anaesthetics and cardio-respiratory medical devices, and implantable electronic devices for the manufacture of medical devices, with financial incentives to the tune of USD456 million.

The National Medical Device Policy 2023 (“the Policy”) aims to ensure access to patent-centric, innovative and affordable healthcare products of superior quality for better healthcare outcomes. The Policy entails several missions for achieving accelerated growth of the medical devices sector, including:

• access to and universality of good quality medical devices and healthcare for all ages;
• affordability and quality of products manufactured in the country to enhance global positioning;
• acceptability and competitiveness;
• patient-centric and quality care;
• ensuring medical devices security through development of strong local manufacturing capabilities and a resilient supply chain for inputs or raw materials; and
• encouraging innovation and research to enable technology-driven medical devices with IoT, AI, nanotechnology, etc.

Further, the Policy also provides a set of strategies covering six areas identified based on the respective challenges and opportunities – namely:

• regulatory streamlining through, inter alia, the setting up of a Single Window Clearance System for the licensing of medical devices;
• gradual expansion of the standards developed by the BIS, etc;
• enabling infrastructure, facilitating R&D and innovation;
• attracting investments through private route and public procurement policies;
• brand positioning and awareness creation, so as to manage issues pertaining to market access; and
• building global competitiveness.

The Ministry of Electronics and Information Technology (MeitY) has released a policy paper pertaining to the circular economy in the electronics and electrical sector. The policy paper briefly addresses the role of sustainable product packages and a policy wherein material sourcing can address reducing GHG emissions, footprint and pollution.

Additionally, the Ministry of Environment, Forest and Climate Change has introduced target-based extended producer responsibility regimes aimed at – inter alia – setting off e-waste and plastic waste generated by different entities.

The MoHFW had proposed a Digital Information Security in Healthcare Act (the “DISHA Act”) for ensuring data privacy and confidentiality, as well as the reliability and security of digital health data. It was later suggested that this be subsumed under a broader national legislation enacted by the MeitY governing the privacy, security and confidentiality of digital information.

Further, recognising the fact that the DCA is a pre-independence legislation, the MoHFW proposed the Draft New Drugs, Medical Devices and Cosmetics Bill 2022 (the “Draft NDMDC Bill”). This bill seeks to replace the DCA for regulating drugs, medical devices and cosmetics. The Draft NDMDC Bill seeks to introduce various definitions such as for clinical trial, new drugs and OTC drugs. The bill also seeks to introduce provisions for regulating sale, stocking exhibition, offer for sale, and distribution of drugs through e-pharmacies or any other online mode.

As noted in 1.4 Technologies and Digital Health (Medical Apps), the DPDP Act has now become the law. However, the DPDP Act has not yet come into force and will likely have a phased implementation through separate notification(s) issued by the central government. Also, several obligations under the DPDP Act would be operationalised via delegated legislation, which will be introduced in due course.

The DPDP Act regulates the “processing” of personal data, which is collected in digital form or in non-digital form and is digitised subsequently within the Indian territory, and applies to the processing of personal data outside the jurisdiction of India if such processing is in connection with any activity of offering, goods or services to data principals within the territory of India.

Further, in 2023, the Minister of State for the MeitY held pre-introduction stage consultations with stakeholders on the Proposed Digital India Act (the “Proposed DIA”) and published a presentation that highlighted the broad guiding principles of the proposed legislation. The Proposed DIA seeks to replace the IT Act in order to provide a new legal framework for internet governance. It will apply to different types of intermediaries, including:

• e-commerce;
• digital media;
• AI;
• OTT platforms;
• telecommunications service providers; and
• adtech.

The Proposed DIA would likely govern aspects of the healthcare industry, as it seeks to include:

• the right to be forgotten;
• regulation of AI-based ad-targeting;
• algorithmic accountability;
• content moderation;
• vulnerability assessment;
• provisions on algorithmic transparency; and
• periodic risk assessments by digital entities.

Although AI is currently not specifically regulated in India, in March 2023, the ICMR released the Ethical Guidelines for Application of Artificial Intelligence in Biomedical Research and Healthcare (the “AI Guidelines”) to provide guidance and a framework on – inter alia – the ethical principles to be followed, governance of AI use, and seeking informed consent while deploying AI-based solutions in biomedical research and healthcare.

The AI Guidelines include ethical principles on autonomy, safety and risk minimisation, data privacy, accountability and liability, and consent requirements. Further, the AI Guidelines also provide elaborate guiding principles for the development phase and validation phase, as well as for clinical and other health-related deployment of AI technologies. As per the ICMR, the AI Guidelines are a living document and will be updated from time to time, taking into consideration the evolution of AI and the ethical principles governing it.