Critically evaluate India's dual-track strategy of device-level regulation and ethical frameworks (SAHI) in governing AI in healthcare.

India governs health AI on two parallel tracks: a statutory product-safety route, where AI-enabled medical devices are approved by the CDSCO under the Medical Devices Rules, 2017 [1], and a policy route built on SAHI (Strategy for AI in Healthcare in India) and the benchmarking platform BODH, launched on 17 February 2026 [2]. The design is sound in principle, but its ethical arm remains largely non-binding.

Merits of the dual-track design

• No regulatory vacuum: AI tools enter through an existing licensing pathway rather than awaiting a dedicated AI law; high-risk devices must file an Essential Principles checklist and software verification and validation records [1].
• Ethics beyond the device: SAHI supplies a common Union–State framework covering governance, data stewardship, validation, deployment and monitoring — dimensions a device licence cannot capture [2].
• Evidence-based validation: BODH, built with IIT Kanpur and the National Health Authority, allows privacy-preserving testing of models on diverse real-world data before scale-up, addressing bias and generalisability [2].
• Alignment with global norms: it mirrors WHO's six principles — autonomy, safety, transparency, accountability, equity and sustainability [3].

Limitations

• Enforceability gap: SAHI is guidance, not statute; unlike the Medical Devices Rules it carries no penalty for breach.
• Static approval, learning software: rules framed for fixed devices sit awkwardly with continuously updating algorithms needing post-market surveillance.
• Coverage blind spot: hospital administrative tools and general-purpose large multi-modal models often escape the device definition, though WHO flags them as higher-risk [4].
• Capacity and equity: regulatory expertise for algorithm audits is thin, and unequal digital infrastructure risks concentrating benefits in urban centres [3].

The two tracks are complementary rather than duplicative — hard law for safety, soft law for ethics — and India is among the first countries with a national health-AI strategy [2]. Converting SAHI's core safeguards, especially human accountability and mandatory post-deployment audit, into enforceable rules would make the framework genuinely trustworthy and advance the right to health under Article 21.