vitrivis All writing
Policy

India's Strategy for Artificial Intelligence in Healthcare: What SAHI Changes

7 min read

For most of the last decade, writing about AI in healthcare in India meant writing about pilots. A screening tool in one district. A radiology model at one chain of hospitals. Impressive individually, unconnected as a system, and governed by nobody in particular.

That changed on 17 February 2026.

At the India AI Impact Summit in New Delhi, the Union Health Minister launched SAHI, the Strategy for Artificial Intelligence in Healthcare for India. The Ministry described it not as a technology roadmap but as a governance framework and national policy compass. WHO’s South-East Asia Regional Office noted that India is the first country in the region to adopt a comprehensive national AI strategy for health.

If you build, buy, deploy or explain health AI in India, this is the document your work now sits under.

SAHI arrived with its own machinery, which is unusual

The more interesting detail is what launched beside it.

BODH, the Benchmarking Open Data Platform for Health AI, was announced the same day. Developed by IIT Kanpur with the National Health Authority, it allows AI models to be evaluated against anonymised real-world Indian health data before deployment at scale, testing performance, robustness, bias and generalisability.

National AI strategies usually arrive alone. The implementation tooling follows years later, if it arrives at all. Launching the policy and the validation platform together is a deliberate attempt to close that gap on day one, and it tells you something about how the Health Ministry expects the strategy to be used. SAHI sets the expectation that AI tools be validated. BODH is where the validating happens.

The pairing did not come out of nowhere. The National Health Authority signed an MoU with IIT Kanpur in October 2024 to build exactly this kind of open benchmarking platform using data from Ayushman Bharat Digital Mission ecosystem partners. BODH is that work, named and launched.

The strategy followed the deployment, not the other way round

It would be easy to read SAHI as the starting gun. It is closer to the opposite.

By the time it launched, AI was already running inside several national health programmes, and the numbers are not small. The eSanjeevani telemedicine platform recorded 282 million consultations between April 2023 and November 2025, with around 12 million of those supported by AI-generated differential diagnosis. Predictive analytics flagging patients at risk of TB treatment failure was associated with a reported 27% decline in adverse outcomes after nationwide deployment. DeepCXR, an automated chest X-ray reader for presumptive TB, went into eight states and union territories. India’s media-based disease surveillance system has published over 4,500 outbreak alerts since April 2022.

In December 2025, MadhuNetrAI launched as India’s first AI-based community screening programme for diabetic retinopathy, with roughly 7,100 patients screened across 38 facilities in its early phase. Non-specialists capture the retinal image; the model grades it and prioritises who needs a specialist.

None of this works without the layer beneath it. The Ayushman Bharat Digital Mission had issued around 799 million health IDs by August 2025, with over 410,000 facilities and 670,000 professionals registered, and more than 671 million health records linked. Alongside it sits the IndiaAI Mission, approved in March 2024 with an outlay of ₹10,371.92 crore, whose application development track has shortlisted a set of health solutions spanning lung screening, retinal imaging and cancer staging.

NITI Aayog anticipated the shape of this back in 2018, describing AI and connected medical devices as the “new nervous system for healthcare”. Eight years on, the nervous system exists. SAHI is the attempt to govern it.

The regulator moved five months later, and this is the part with teeth

Strategy documents set direction. Regulations set obligations, and in July 2026 the Central Drugs Standard Control Organisation issued its final Guidance Document on Medical Device Software under the Medical Devices Rules, 2017.

This is the development most medical device and health tech companies should be reading first. It brings software as a medical device, software in a medical device and AI-enabled medical software into a structured, risk-based, lifecycle framework rather than leaving them in the ambiguous space they occupied before.

For AI products specifically, the expectations are concrete. Applicants are asked to describe the composition of the datasets used for training, validation and testing, including demographic distribution, geographic origin and clinical diversity. They are asked to disclose model bias, generalisability and robustness across sub-populations relevant to the Indian market. A software bill of materials is expected, as is usability validation reflecting Indian clinical workflows rather than the workflows of the market the product was originally built for.

Read those requirements next to BODH and the logic becomes obvious. A regulator now asks whether your model generalises across Indian sub-populations. A national platform now exists to test exactly that. The two were designed to meet.

Separately, CDSCO has classified AI-based cancer detection and diagnostic software as Class C, placing moderate-to-high-risk oversight on a category that until recently sat outside formal control.

The data layer has a deadline

The third piece is privacy, and it carries the hardest date.

The Digital Personal Data Protection Act was passed in 2023, but it only became operational when the DPDP Rules were notified on 13 November 2025. Full compliance with core obligations falls due on 13 May 2027.

Hospitals, diagnostic centres and health platforms are among the organisations most exposed, partly because of the sensitivity of the data and partly because of breach duties. The Rules require notification to the Data Protection Board and to affected individuals without undue delay, with a detailed report to the Board within a short window. Health data is also the category most likely to attract Significant Data Fiduciary designation, which brings annual audits and data protection impact assessments with it.

Anyone building health AI in India is therefore working against three clocks at once. SAHI setting governance expectations now. CDSCO guidance applying to submissions now. DPDP obligations landing in May 2027.

Where this is likely to be hard

WHO’s own comment at the launch was that the real test is implementation, and that turning the strategy into health gains needs regulatory clarity, institutional capacity and continuous evaluation. That is diplomatic phrasing for a set of genuine problems.

Data quality, not data volume. India has an enormous number of health records. It has fewer records that are structured, complete and consistently formatted enough to train or validate a model on. The gap between a digitised health ID and usable clinical data is wide, and it is widest exactly where AI is meant to help most.

Validation on Indian populations. The CDSCO guidance asks about sub-population performance because imported models frequently underperform on patient populations they were not trained on. Answering that question requires representative Indian datasets, which for several disease areas do not yet exist at sufficient scale. NITI Aayog’s cancer imaging biobank, building a library of over 20,000 patient profiles, is one attempt to fix this for one domain.

Liability. SAHI is among the first Indian instruments to engage seriously with what happens when an AI tool contributes to a wrong diagnosis. Engaging with a question is not the same as settling it, and the answer will most likely be worked out through practice and litigation rather than in the framework itself.

Workforce. A clinician who does not understand what a model is doing will either over-trust it or ignore it. Both failure modes are worse than not deploying at all. Explaining these systems to the people expected to use them is a real piece of work, and it is consistently the piece that gets funded last.

What to do about it

If you make health AI for the Indian market, the CDSCO software guidance is the immediate priority. Run a gap analysis against it before your next submission rather than after a query. Get your dataset documentation into a state where the demographic and geographic composition can be described without a scramble.

If you run a hospital or diagnostic chain, the May 2027 DPDP deadline is nearer than it looks once consent workflows, vendor contracts and breach procedures all have to change together.

And if you are communicating any of this to clinicians, note what the framework itself keeps returning to. Safety, validation, transparency and trust. A product that cannot explain how it was trained, on whom, and where it has been shown to work is now failing a stated national expectation, not just a marketing one.

The strategy has a name. The benchmarking platform is live. The regulator has published. The interesting question is no longer whether India will govern health AI. It is who can show their work.

Sources

Regulatory positions change. Verify current requirements with CDSCO and qualified counsel before acting on any of the above.