India's Medical Devices Rules, 2017 reference ISO 14971 but don't define what a Risk Management File should look like for a CDSCO submission. That ambiguity is expensive. First-time applicants routinely lose six to ten weeks responding to risk-management queries that could have been avoided in the original filing — not because the engineering was wrong, but because the file didn't match what CDSCO reviewers actually look for.
After working on RMFs that have gone through CDSCO reviews under Forms MD-9 and MD-15, the patterns are consistent enough that you can plan around them. This article walks through where the RMF sits inside a CDSCO submission, what the Medical Devices Rules actually require, what reviewers focus on in practice, and the five deficiency letters that show up again and again. If you're preparing your first Indian filing — or if you've submitted before and want to cut your query response cycle — this is the article I'd hand you on day one.
Where the RMF sits in a CDSCO submission
The first thing that confuses applicants is that CDSCO doesn't ask for the RMF as a standalone document. There is no "Risk Management File" line item in Form MD-9 or Form MD-15. There is no separate upload slot for it on the SUGAM portal.
Instead, the risk management evidence lives inside the Device Master File (DMF), referenced from two distinct sections.
Section 5 is where reviewers expect to see the risk analysis itself — the hazard tables, the risk evaluation matrix, the residual risk evaluation, and the risk-benefit justifications. Section 11 is where they expect to see how the identified risk controls were actually implemented during design and how their effectiveness was verified.
What the Medical Devices Rules, 2017 actually require
A common mistake is to attach the full RMF inside Section 5 and leave Section 11 with a generic design summary. Reviewers reading that flow back from Section 5 to Section 11 expecting to find verification evidence for the controls they just read about, and when it isn't there, the file gets a query. The RMF isn't a document you submit — it's a body of evidence that has to be discoverable from at least two points in the DMF, with consistent cross-references between them.
For Form MD-15 (import licence) submissions, the same logic applies but with the added complication that the DMF may have originally been authored for a different jurisdiction (FDA, EU, ANVISA). The risk management content has to be reworked, not just translated, to align with Indian expectations. More on that below.
How CDSCO reviewers actually approach the risk management evidence
The relevant statutory references are narrower than most consultants imply. Three places in the rules matter for risk management:
- The Third Schedule, Part II sets out the Quality Management System requirements and, by reference to ISO 13485:2016, brings risk management into scope through clause 7.1 of the QMS standard.
- The Fourth Schedule lays out the Essential Principles of Safety and Performance — the Indian counterpart to EU MDR's General Safety and Performance Requirements. Section 4 of the Essential Principles explicitly requires that "manufacturers shall establish, document, implement and maintain a system for risk management." This is the statutory hook.
- ISO 14971 is referenced as the recognized standard for satisfying that risk management requirement. CDSCO accepts ISO 14971:2019 as the operative edition for new submissions.
Notice what the rules don't do. They don't prescribe the format of the risk management file. They don't mandate a specific risk matrix. They don't define acceptable thresholds. That latitude is by design — risk acceptability depends on the device, the patient population, and the clinical context — but it puts the burden of justifying the chosen approach onto the manufacturer. Reviewers don't enforce a template; they evaluate whether your justification is internally consistent and aligned with the Essential Principles.
This is the part that gets thin coverage in most online resources. From the patterns visible in CDSCO query letters and reviewer practice, five things consistently get scrutinized.
- Whether ISO 14971 is followed by name: CDSCO accepts ISO 14971 as the recognized standard, but the file has to explicitly state which edition is being followed and demonstrate alignment. Cite it in the Risk Management Plan and Report, and reference the specific clauses being satisfied (e.g. clause 5, 7, and 9).
- Whether the RMF maps to the Essential Principles of the Fourth Schedule: This is the India-specific addition that catches manufacturers reusing EU MDR submissions. CDSCO reviewers want to see a mapping that specifically references the Fourth Schedule — not the GSPR table copied over. A two-column table that links each identified hazard category to the relevant Essential Principle is usually sufficient.
- Whether residual risks are documented with a benefit-risk justification: ISO 14971:2019 requires that any residual risk not falling within the acceptable region of the risk acceptability matrix must be justified on benefit-risk grounds. The justification has to be specific to the patient population and detail alternative options considered.
- Whether post-market data feeds back to the RMF: The Medical Devices Rules require Periodic Safety Update Reports (PSURs) for Class C and Class D devices, which are expected to update the Risk Management File. Even at initial submission, reviewers expect the Risk Management Plan to describe how post-market information will trigger RMF updates.
- Whether the RMF aligns with the device classification claim: CDSCO classifies devices into risk classes (A, B, C, D) under the First Schedule. An RMF whose hazard profile and residual risk pattern look more severe than the claimed classification will be queried, because the classification itself becomes suspect.
These are paraphrased from real query patterns. The cause and fix for each is what matters.
The five most common CDSCO deficiency letters on risk management
Deficiency 1: Missing Risk Management Plan
"Please provide the Risk Management Plan and clarify its alignment with ISO 14971."
Cause: The submission included hazard analysis tables and a risk evaluation matrix but no separately documented Risk Management Plan. Many teams treat the RMP as an internal working document and don't include it in the DMF.
Fix: Include the RMP as a controlled, signed document inside Section 5 of the DMF. It needs to cover scope, criteria for risk acceptability (with specific matrix and rationale), roles, and the PMS update schedule.
Deficiency 2: Missing Risk Control Traceability
"Please provide evidence of risk control verification for the identified hazardous situations."
Cause: The team listed risk controls in the analysis but didn't link them to specific verification evidence. The reviewer reads a control measure description but cannot find the test report verifying it works.
Fix: Build a traceability matrix running hazard → identified risk control → verification report number → result. This spreadsheet or table allows the reviewer to trace verification in two clicks.
Deficiency 3: Vague Residual Risk Acceptability
"Please justify the acceptability of the residual risks identified in the analysis."
Cause: Residual risks were marked "acceptable" in the matrix without any written rationale. The team treated the matrix color as a self-explanatory justification.
Fix: For every residual risk in the acceptable-with-justification band of the matrix, include a written 3-to-5 sentence statement naming the clinical benefit, alternative controls considered, and explicit trade-offs.
Deficiency 4: Generic Risk Acceptability Matrix
"Please align the risk acceptability matrix with the device's intended use and patient population."
Cause: The team applied a generic 5x5 matrix lifted from a template without contextualizing it. Probability and severity bands are defined in generic terms that don't reflect patient physiology (e.g. neonates vs. adults).
Fix: Define the matrix inside the Risk Management Plan with probability and severity bands customized for the specific device and target physiology.
Deficiency 5: Closed-Loop Post-Market Analysis
"Please clarify how post-market information will be fed back to the Risk Management File."
Cause: No procedure exists to document the PMS-to-RMF feedback loop. The pre-market analysis is documented as a one-time closed activity.
Fix: Include a brief procedure cross-referenced from the RMP naming specific triggers (complaints, adverse events, design changes, PSUR review cycles) that initiate RMF updates.
If you're submitting in India for the first time after experience with FDA or EU MDR, three differences matter most.
How CDSCO expectations differ from FDA and EU MDR
| Aspect | CDSCO (India) | US FDA | EU MDR |
|---|---|---|---|
| Standard recognized | ISO 14971:2019 | ISO 14971 (with FDA deviations) | ISO 14971 + Annex I of MDR |
| RMF location | DMF Section 5 and Section 11 | Design History File (DHF) | Technical File (Risk File) |
| Essential Principles mapping | Fourth Schedule of MDR 2017 (required) | Not required | GSPR mapping per Annex I (required) |
| Benefit-risk justification | Required for residual risks above acceptable band | Required | Required |
| Post-market linkage | Required, with PSURs for Class C/D | Required | Required, with PMCF and PSUR |
The biggest practical difference is that CDSCO wants the Fourth Schedule mapping. A submission that arrives with a complete GSPR mapping from a prior EU MDR filing but no Fourth Schedule mapping signals to the reviewer that the team didn't actually prepare an India-specific submission — they just resubmitted the EU file. Even though most of the underlying risk management work transfers across jurisdictions, the evidence package has to be rebuilt for India.
The second practical difference is location. EU and US reviewers expect the RMF as a self-contained file (Technical File or DHF). Indian reviewers expect to navigate to it through the DMF. The actual content can be the same; the indexing and cross-referencing has to change.
A practical CDSCO-aligned RMF structure
Here's the structure I'd recommend for a CDSCO-aligned RMF. It satisfies the rules and the reviewer expectations without overbuilding.
- Risk Management Plan: Four to six pages defining scope, acceptability criteria (matrix & rationale), roles, and post-market review triggers.
- Risk Analysis Table: Hazard, sequence of events, hazardous situation, P1, P2, severity, initial risk, and controls.
- Risk Control Mapping: Description, type (safety by design / protective / info), and references to verification records.
- Residual Risk Evaluation Matrix: Color-coded grid showing all residual risks.
- Benefit-Risk Justification: Three to five sentences per residual risk in the acceptable-with-justification band.
- Fourth Schedule Mapping: A two-column table linking hazard categories directly to Essential Principles of the Fourth Schedule.
- Post-Market Surveillance Linkage: One-page procedure describing feedback triggers to the RMF.
How MedMI handles CDSCO-aligned RMFs
Seven documents. Some teams build all seven as separate files; others consolidate them into a single bound RMF document with seven sections. CDSCO doesn't care which approach you choose, as long as each element is discoverable and the cross-references work.
If you've been operating without the Fourth Schedule mapping or without an explicit post-market procedure, adding those two elements alone will close out the majority of the queries described above.
Frequently asked questions
MedMI's RMF templates include the Fourth Schedule mapping and the post-market linkage procedure as default sections, alongside the standard ISO 14971 structure. The export bundles the seven elements above into a consolidated file with consistent cross-references, so the package that arrives in the reviewer's hands is internally aligned by default. Indian medical device startups and consultants use it specifically because it produces a CDSCO-ready file without requiring the user to rebuild the EU or FDA structure manually.
If you'd like to try it on your own device, you can generate a CDSCO-aligned RMF free — no credit card needed.
Frequently asked questions
For new submissions, 2019. The 2007 edition is technically still cited in some legacy documentation, but submissions following it invite a query asking why the current edition isn't being used. Use 2019.
You can leverage the underlying analysis — the hazards, sequences of events, and controls usually transfer. But the Fourth Schedule mapping is mandatory for CDSCO and won't exist in the FDA submission. You also need to confirm that the risk matrix and the residual risk justifications are appropriate for the Indian patient population and clinical context.
At minimum during PSUR cycles (annually or biennially depending on device class), and after any design change that affects risk. Most manufacturers also conduct an annual review even when no design changes have occurred, documenting the review even if no updates result.
Either is acceptable, as long as the choice is justified in the Risk Management Plan. Reviewers care about the justification, not the shape. A 3x3 with clearly defined bands is preferable to a 5x5 with vague bands.
For Form MD-9, expect two to four weeks from query receipt to response submission, and another four to eight weeks for the reviewer to evaluate the response. Two query cycles is common for first-time submissions; three or more usually signals a structural problem in the file rather than detail-level issues.
For the formal definitions, the source is the Medical Devices Rules, 2017 on the CDSCO portal, with the Fourth Schedule available in the same document.
The underlying standard is ISO 14971:2019, with practical guidance in ISO/TR 24971:2020.
Further reading
For the conceptual foundations that underpin the risk analysis itself, Hazard vs. hazardous situation vs. harm: a worked ISO 14971 example walks through the three terms most teams confuse, with a worked example from a neonatal device.
For the probability values that sit between hazard and harm, How to write a P1 and P2 probability in ISO 14971 covers how to estimate and defend the two probability components.
And if you'd like the seven-element structure described above as a fillable PDF checklist to work alongside your own DMF, download the CDSCO RMF Checklist — paste it inside your file room and tick off elements as you build the submission.