ISO 13485 and CDSCO: How Medical Device Licensing and Quality Certification Fit Together

A hospital group's vendor form lands in your inbox with two separate lines: "CDSCO licence number" and "ISO 13485 certificate — attach copy." Your plant already makes devices, so you assume one of the two covers the other. It does not. Manufacturers lose months to exactly this confusion — filing for a certificate when they needed a licence, or waving a certificate at a regulator who asked for the licence. They are two documents, doing two jobs, and the order you get them in matters.

The short answer: The CDSCO licence is the legal permission to make or import a device in India, granted under the Medical Devices Rules, 2017. ISO 13485:2016 certification is an independent audit of the quality management system those Rules already require in their Fifth Schedule. You need the licence by law; buyers and licence files ask for the certificate.

First, the licence — because nothing else substitutes for it

India regulates medical devices under the Medical Devices Rules, 2017, framed under the Drugs and Cosmetics Act, 1940. Every device sits in one of four risk classes, and the class decides who licenses you and which form you file.

Class A is low risk — absorbent cotton, surgical bandages, examination gloves. Class B is low-moderate risk — hypodermic needles, suction pumps. Class C is moderate-high risk — anaesthesia workstations, dialyzers, patient monitors. Class D is high risk — cardiac stents, implantable pacemakers. The class follows the device's intended use and the First Schedule parameters, and CDSCO publishes classification lists that change, so a class copied from an old checklist or another country is a clue, not a decision.

For manufacturing, Class A and B licences come from the State Licensing Authority: you apply in Form MD-3 and the licence issues in Form MD-5. Class C and D licences come from the Central Licensing Authority at CDSCO: application MD-7, licence MD-9. Loan licences follow the same split — MD-4 to MD-6 for A and B, MD-8 to MD-10 for C and D. Importing is different: every class goes to CDSCO, and a foreign manufacturer cannot apply directly — the application runs through an Authorised Indian Agent, in Form MD-14, with the licence issuing in MD-15.

Two details catch people out. First, Class A devices that are both non-sterile and non-measuring follow a registration-based route instead of the MD-3 licence route. Second, unlike a certificate, a licence is not renewed on a fixed cycle — the Rules did away with periodic renewal, and guides report a retention fee every five years instead. Treat that fee timing as reported practice, and confirm it on your own licence, because it is the one figure here that rests on a single guide.

Then the Fifth Schedule — the bridge most guides skip

Here is the piece that explains why the two documents feel tangled. The Fifth Schedule of the Rules sets the quality management system requirements for a device manufacturing site, and that Schedule is modelled on ISO 13485:2016. When you apply for a manufacturing licence, you undertake to comply with those QMS requirements. In plain words: a licensed site that runs its processes honestly has already built much of the skeleton an ISO 13485 audit examines — documented procedures, production controls, traceability, records.

Think of a restaurant's food licence and its hygiene rating. The licence lets you open at all. The rating is what customers check before they sit down. Neither replaces the other, and confusing them is how a good kitchen ends up closed or a bad one ends up trusted. Your CDSCO licence is the permission. The certificate is the inspected proof.

For Class A and B, the QMS is checked by a notified body accredited by the National Accreditation Board for Certification Bodies. Class A carries a timing trap worth knowing: the licence can be granted without a prior site audit, on your self-certification of compliance — and then the notified-body audit must happen within 120 days of grant. A Class A manufacturer who treats "licence granted" as "job done" and lets the system slide for four months walks straight into that audit unprepared.

So where does the certificate actually get asked for?

Three places, and they are not the same ask. First, the licence file itself. Specialist guides describe a current, in-scope, accredited ISO 13485 certificate as a mandatory submission document for MD-5, MD-9 and MD-15 applications, and say reviewers check three things on it: validity, scope, and accreditation. A 2020 CDSCO direction also required uploading an accredited ISO 13485 compliance certificate as part of the registration process. I state this as the guides' position, not as quoted Rules text, because the Rules themselves speak in terms of Fifth Schedule compliance — and the distinction matters when a file gets queried.

Second, buyers. Hospital procurement teams check supplier regulatory credentials as part of vendor qualification, and a valid licence plus an ISO 13485 certificate is the pair they look for. Third, export and OEM buyers, who cannot inspect your plant and use the certificate as their shortcut to trusting it.

And the line CDSCO itself drew, in a July 2022 clarification from the Drugs Controller General (India): quality certificates issued by other entities are not a replacement for licensure under the Rules. A manufacturing licence, the clarification said, indicates conformance to the Fifth Schedule, and no separate GMP or QMS certificate is prescribed for issuance by the licensing authorities. Read that twice. The certificate supports the licence. It never stands in for it — and a licence, on its own, never answers a buyer who asked for the certificate.

Three mistakes that stall manufacturers

1. Buying the certificate instead of the licence. This is the expensive one. A certificate from a certification body gives you no legal right to manufacture or import. If you have no licence, you have no business yet, whatever frame hangs on the wall.

2. A certificate whose scope misses the mark. Reviewers check that the certificate covers the declared manufacturing site and the specific device categories applied for. A certificate for your head office when the plant is elsewhere, or for one device family when you applied for three, stalls the file until it is fixed. Check the scope line before you file, not after.

3. Offering ISO 9001 instead. If your plant already holds ISO 9001, the architecture feels familiar, but specialist guides are blunt: CDSCO will not accept an ISO 9001 certificate in place of ISO 13485 for a device licence application. The device standard adds design controls, risk management aligned to ISO 14971, sterility and traceability requirements that the general standard does not carry. You need the device certificate, with device scope, separately.

The order that wastes the least time

For most manufacturers, the sequence that wastes the least time runs: classify the device first, then build the quality system to the Fifth Schedule, then certify it, then file the licence with the certificate in the file. Building the system before the audit is what keeps the audit short — auditors expect real records, not a manual written the week before.

Class A is the exception that proves the sequence: because the licence can issue on self-certification, a Class A maker can file first — but the 120-day audit clock starts at grant, so the system still has to be real within four months. Either way, the system comes before the audit that tests it.

On time, published guides disagree, and I will not smooth that over. One specialist guide puts certification at four to nine months; our cost guide found published timelines ranging from 20 weeks to 12 months for small manufacturers. The drivers are the same in every version: device class, whether you design the product yourself, sterility, and how much of the system already exists. A single-site maker of a simple Class A device moves faster than a Class D implant maker. Anyone quoting you one fixed timeline before asking your class has not done this before.

What do the licence and the certificate cost together?

The licence application carries its own government fee, which varies with the licence type and the devices on it — check the current schedule on the CDSCO SUGAM portal before you budget, because fee tables are the first thing to go stale in a guide. The certificate is the second bill, and it is the one buyers actually shop around on. Our ISO 13485 certification consultancy is ₹14,999 for units up to 25 employees and ₹29,999 for 26 to 100, with the certification body's audit fees extra at actuals. The full cost split — consultancy against body fees, surveillance years included — is worked through in our ISO 13485 certification cost guide, so this post does not repeat it.

The same licence-versus-certificate logic shows up in food businesses, where an FSSAI licence is mandatory and ISO 22000 is the voluntary proof buyers ask for — our ISO 22000 vs FSSAI licence guide walks through that parallel. If you are weighing the spend, run the numbers on our compliance fee calculator first, then talk to us with your device class in hand. Class is the first question we will ask, and it should be the first question anyone asks you.

FAQs

Is ISO 13485 mandatory for a CDSCO licence? The Rules require your quality system to conform to the Fifth Schedule, which is modelled on ISO 13485:2016. Specialist guides describe a current, accredited ISO 13485 certificate as an expected document in the licence file. What is not in doubt: the certificate never replaces the licence — CDSCO clarified that in July 2022.

Which licence form covers my device? Manufacturing Class A or B: apply in MD-3, licence in MD-5, from the State Licensing Authority. Manufacturing Class C or D: apply in MD-7, licence in MD-9, from CDSCO centrally. Importing any class: apply in MD-14 through an Authorised Indian Agent, licence in MD-15.

I already have ISO 9001. Does that cover it? No. Guides report that CDSCO does not accept ISO 9001 in place of ISO 13485 for a device licence application. You need the device standard, with scope covering your site and device categories.

My device is Class A, non-sterile and non-measuring. Do I need a licence at all? That combination follows a registration-based route rather than the MD-3 licence route. Confirm your device's entry on CDSCO's classification list before relying on the exception — classes change.

How long does the certificate take? Published guides put it between four and nine months for a typical small manufacturer, with the wider published spread running from 20 weeks to 12 months depending on class, design responsibility and sterility. Build the system first; the audit goes faster when records already exist.