Medtech Startups Incorporation and Compliance: A Sequenced Guide

India’s medtech sector is among the most compliance-dense environments a founder can choose to build in. You are simultaneously subject to the Companies Act 2013 for corporate governance, the Medical Devices Rules 2017 for your product, the Income Tax Act 2025 for claiming startup benefits, DPIIT’s February 2026 notification for deep tech recognition, and the Digital Personal Data Protection Act 2023 if your device collects patient data. These tracks are not independent. The sequence in which you incorporate, file registrations, structure your IP, and obtain product approvals materially affects what benefits you can access and whether you remain eligible at all. This article is a practitioner’s sequencing guide for the first 18-24 months, written for founders who want to build fast without creating a compliance backlog that closes off future funding or licensing options.

What entity structure should a deep-tech medtech startup incorporate as?

A Private Limited Company under the Companies Act 2013 is the only entity type that works for a deep-tech medtech startup that plans to raise institutional capital, apply for Section 80-IAC tax exemption, and remain DPIIT-recognised under the February 2026 notification. An LLP cannot issue equity shares to venture investors, cannot hold the 80-IAC exemption, and creates complications when converting to a private limited company later because stamp duty applies to asset transfers in most states.

Why the incorporation decision must come before everything else

The compliance calendar for a deep-tech medtech startup is gated by one fact: almost every benefit the Indian government has created for high-R&D-intensity businesses requires a registered company. BIRAC’s Biotechnology Ignition Grant (BIG) scheme requires the applicant to be at minimum a registered startup or LLP. DPIIT recognition requires incorporation as a private limited company, LLP, partnership firm, or cooperative society. Section 80-IAC certification requires a private limited company or LLP. The DSIR recognition process for R&D tax deductions under Section 35(2AB) of the Income Tax Act 2025 requires a company with an in-house R&D facility. You cannot layer these benefits retroactively on work done as an unregistered entity.

For medtech founders who typically spend 12-18 months in academic settings or incubators before formalising their venture, the default behaviour is to delay incorporation until it feels necessary. The cost of that delay is quantifiable: you lose the ability to assign pre-incorporation IP cleanly, you lose BIRAC window eligibility, and you compress your Section 80-IAC clock, which starts running from the date of incorporation regardless of when you become profitable.

The practical trigger for incorporation should be the moment you have a proof of concept worth protecting or a grant application worth submitting, whichever comes first. In most deep-tech medtech contexts, that is earlier than founders expect.

Choosing the right registered office and authorised capital

Two decisions at incorporation that founders frequently underweight are the registered office state and the authorised share capital. The registered office state determines which ROC administers your filings and which state-level stamp duty applies to future SHA and ESOP-related instruments. States like Karnataka and Maharashtra have active medtech ecosystems but different stamp duty structures. Authorised capital does not determine what you pay at incorporation in terms of government fee alone; it also determines the headroom you have for future share issuances without filing Form SH-7 each time. Incorporating with an authorised capital of ₹1 lakh and then immediately raising a round triggers an SH-7 filing and additional stamp duty at that stage. A cleaner approach is to set authorised capital at ₹10 lakh at incorporation if an early raise is anticipated within 12 months.

The seven post-incorporation filings that cannot wait

Once the certificate of incorporation is issued, the Companies Act 2013 and its rules create a series of mandatory filings with hard deadlines. Misses here attract penalties under Section 454 of the Act and, in the case of persistent non-filing, director disqualification under Section 164(2)(a).

Form INC-20A (commencement of business declaration): This must be filed with the ROC within 180 days of incorporation. The company cannot commence business, borrow money, or allot shares before this is filed. Founders frequently forget this because the certificate of incorporation has already been received and the company looks live. It is not. A medtech startup that begins R&D expenditure and BIRAC grant drawdowns before filing INC-20A is technically in default under Section 10A of the Companies Act 2013.

Form ADT-1 (auditor appointment): The board must appoint a statutory auditor at the first board meeting and file ADT-1 within 15 days of that meeting. The first auditor serves until the conclusion of the first AGM, after which a CA firm is typically appointed for five years.

Form DIR-3 KYC (director KYC): Every director must complete DIR-3 KYC by 30 September of each financial year. Directors who miss this deadline are placed in deactivated status, which blocks future form filings until the KYC is completed with a late fee.

DPIIT recognition: File through the Startup India portal immediately after incorporating. For a deep-tech medtech company, the February 2026 notification creates the “Deep Tech Startup” sub-category with a 20-year recognition window and a ₹300 crore turnover threshold. The full four-attribute eligibility test, R&D documentation strategy, and IMB composition are covered in Treelife’s detailed guide on DPIIT Deep Tech recognition for startups. Recognition is free and typically processed within 72 hours for a clean application.

GST registration: If your medtech startup will sell, supply goods, provide services across states, or raise invoice-based payments from institutional clients or incubators, GST registration is required. Some early-stage medtech startups operating purely in R&D mode delay this. However, if you are receiving BIRAC grant drawdowns that are invoice-linked or working with hospitals under a development agreement, GST registration becomes necessary earlier than expected. Many medical devices attract nil or 5% GST rates, but the classification varies by device type and you need a GST number to claim input tax credit on purchases of lab equipment and components.

PAN, TAN, and bank account: These are mechanical but sequenced. PAN and TAN are obtained at incorporation or shortly after. The bank account requires the Certificate of Incorporation, MoA, AoA, PAN, and a board resolution. No BIRAC grant or SISFS seed fund payment can be received without a company bank account in the company’s name.

DPIIT recognition timing versus BIRAC application timing: This is a sequencing error that costs medtech founders weeks. BIRAC requires the applicant to be a registered entity. DPIIT recognition should be obtained before submitting a BIRAC BIG application, because DPIIT recognition strengthens the application and some BIRAC call evaluations score it. Do not invert the sequence.

DPIIT recognition versus Section 80-IAC certification: the gap most founders miss

DPIIT recognition and the Section 80-IAC tax holiday are two entirely separate applications with two entirely separate approving bodies.

DPIIT recognition is administered by the Department for Promotion of Industry and Internal Trade through the Startup India portal. It takes 72 hours for a clean application and is free. It unlocks patent rebates, trademark fee discounts, self-certification under six labour laws, and DPIIT-linked government funding schemes including SISFS and BIRAC.

Section 80-IAC tax exemption is administered by the Inter-Ministerial Board of Certification (IMB). The IMB application is filed separately through the Startup India portal using Form-1. The IMB conducts a substantive review examining the novelty of the product or technology, the founder team’s credentials, R&D evidence, and whether the business is genuinely innovative. As of mid-2026, only approximately 3,700 of over 1.97 lakh DPIIT-recognised startups hold an IMB certificate (under 2%), because founders assume DPIIT recognition automatically grants the tax holiday.

Section 80-IAC gives an eligible startup a 100% deduction on profits for any three consecutive years within the first ten years from incorporation. Apply for the IMB certificate well before your first profitable financial year. The review cycle can span several months.

One irrevocable election founders must understand before applying: Sections 115BAA and 115BAB of the Income Tax Act 2025 offer a concessional 22% corporate tax rate, but a startup that elects 115BAA cannot simultaneously claim the 80-IAC deduction. This election is permanent. For most early-stage medtech startups that expect significant profitability from Year 4 onwards, the 100% exemption under 80-IAC for three years is materially more valuable. Run the numbers with your CA before electing.

Treelife assessment: In most deep-tech medtech engagements we review, the IMB application is either filed years late or never filed at all. By the time a founder realises the exemption requires a separate application, they are already in their profitable years and the potential saving has partially or fully elapsed.

Does your device development stage satisfy the DPIIT Deep Tech attribute test?

This is the question the February 2026 DPIIT notification creates for medtech specifically, and it is one that the general coverage of the notification does not answer. The four-attribute Deep Tech test requires: (1) a solution based on a scientific or engineering advancement still being developed, (2) high R&D expenditure relative to total revenue or funding, (3) ownership or active creation of novel IP with concrete commercialisation steps, and (4) extended timelines, high capital needs, and material technical uncertainty. A medtech startup’s position on each attribute shifts as the product matures. The table below maps this to device development stages.

Deep Tech attribute test mapped to medtech development stages:

Development stage	Attribute 1 (novel science still being developed)	Attribute 3 (novel IP, commercialisation steps)	Attribute 4 (technical uncertainty)	Typical device class
Bench research, no prototype	Strong (science unresolved)	Weak (no filed IP, no commercialisation plan)	Strong (outcome unknown)	Any
Prototype, no clinical data	Strong	Moderate (provisional patent filed, early roadmap)	Strong	Class A to C
Pre-clinical validation complete	Moderate (science partly resolved)	Strong (patent filed, pilot site identified)	Moderate (clinical risk remains)	Class B to D
Clinical investigation ongoing	Weakening (science proven, execution risk remains)	Strong	Moderate	Class C, D
Post-CDSCO licence, pre-commercial	Weak (product works, science resolved)	Strong	Low	Class C, D

The implication: a medtech startup is most likely to satisfy all four attributes in the bench-to-pre-clinical window. A company that waits until post-CDSCO licence to apply for Deep Tech recognition will struggle with Attributes 1 and 4. Apply early, with supporting evidence from that stage. Do not wait until the product is proven.

The full documentation strategy for the four-attribute test is covered in Treelife’s guide on DPIIT Deep Tech recognition.

How to sequence CDSCO device classification without losing a year

Medical devices in India are regulated under the Medical Devices Rules 2017, with the Central Drugs Standard Control Organisation (CDSCO) acting as the National Regulatory Authority. Devices are classified into four risk-based classes: Class A (low risk, such as non-sterile bandages and manual instruments), Class B (low-moderate risk, such as hypodermic needles), Class C (moderate-high risk, such as ventilators and digital imaging equipment), and Class D (high risk, such as implantable cardiac devices and reagents used in blood screening).

Since 1 October 2023, all Class C and Class D devices must hold a valid CDSCO licence. In October 2025, CDSCO issued a major directive reaffirming the role of the Central Licensing Authority in classifying Class A, Class B, and IVD devices before State Licensing Authorities can grant manufacturing licences. Class A Non-Sterile, Non-Measuring devices were exempted from mandatory licensing in the same window.

For software-based medical products (Software as a Medical Device, or SaMD), CDSCO released draft guidance in October 2025 providing a formal risk-based classification framework aligned with International Medical Device Regulators Forum (IMDRF) standards. This guidance also introduces an Algorithm Change Protocol (ACP) for AI/ML-based SaMD, allowing iterative software updates without triggering a full re-licensing event.

The CDSCO approval process typically takes 6-9 months regardless of device class. This timeline must be built into the product development roadmap.

Does clinical investigation on human subjects require prior CDSCO approval?

Yes, and this is the compliance cliff most medtech founders miss. R&D on a bench model does not require CDSCO licensing. But the moment your medtech startup moves to a pilot study, feasibility trial, or clinical evaluation involving human subjects (including a small single-centre observational study), Rule 50 of the Medical Devices Rules 2017 requires prior CDSCO approval for the clinical investigation. This applies regardless of whether the device has a CDSCO manufacturing licence. A founder who arranges a “soft pilot” at a hospital partner without this approval is in violation of Rule 50, and the hospital is equally exposed. Build the Rule 50 application timeline into your pre-clinical milestones, not as an afterthought when the hospital asks for regulatory clearance documentation.

Classification and clinical investigation sequence for a medtech startup:

Stage	Action	Dependency
Pre-prototype	Identify provisional device class based on IMDRF-aligned criteria	No regulatory filing required
Post-prototype, pre-clinical	Confirm classification via CDSCO Sugam portal (from November 2025)	Registered company required
Before any human subject study	Apply for CDSCO clinical investigation approval under Rule 50, MDR 2017	Device class confirmed, ethics committee clearance required
Pre-market (Class A, B)	Apply to State Licensing Authority for manufacturing licence	Central Licensing Authority classification confirmation needed
Pre-market (Class C, D)	Apply to CDSCO Central Licensing Authority for manufacturing/import licence	QMS (ISO 13485) certification required
Pre-market (SaMD, AI/ML)	Follow CDSCO October 2025 MDS guidance, file ACP if applicable	Product specification document, cybersecurity plan

A common error is beginning the Class C or D licensing process before a Quality Management System conforming to ISO 13485 is in place. CDSCO expects the QMS to be operational at the facility before the licence is granted, not after.

IP assignment: the university spinout problem and what to do at incorporation

Investors doing due diligence in a medtech funding round examine IP ownership documents first. The single most common problem in early-stage medtech investor due diligence is that the company does not legally own the IP it operates on.

This happens in three patterns. First, founders build prototypes, algorithms, and device architectures before incorporation, with the work product sitting in personal names or at a university department. Without a written IP assignment agreement executed after incorporation, the company cannot demonstrate ownership. Second, co-founders split before the company formally assigns pre-incorporation IP, and the departing co-founder retains a claim. Third, a key technical consultant or contract engineer develops critical components under a verbal arrangement with no invention assignment clause.

Under the Patents Act 1970 and the Copyright Act 1957, IP created by an individual belongs to that individual unless assigned in writing. A salary receipt or a payment invoice is not an assignment agreement.

What happens when the IP originated at a university or research institute?

This is the pattern that most commonly surfaces in medtech due diligence and is the least understood at incorporation. Most Indian academic and government-funded research institutions have published IP policies that assert institutional ownership, partial ownership, or revenue-sharing rights over inventions made by faculty, students, and staff using institutional resources. The specifics vary.

Most centrally-funded technical institutions and government research bodies in India have published IP policies that assert institutional ownership, partial ownership, or revenue-sharing rights over inventions made by faculty, students, and research staff using institutional resources. The specific terms vary by institution, are updated periodically, and must be verified directly with each institution’s technology transfer office or equivalent body. Do not assume any institution’s policy based on published summaries from third parties, including this article.

The consequences of ignoring institutional claims are severe. If a founder assigns pre-incorporation IP to the company without first resolving the institution’s position, the company has an assignment deed that is potentially unenforceable against a third party with a prior claim. A BIRAC grant agreement, which requires the company to own its core IP, and a term sheet from a healthcare investor, which includes the same representation, will both expose this gap.

The correct sequence for an academic spinout is: before executing an IP assignment deed, contact the institution’s technology transfer office to confirm whether a technology transfer agreement, exclusive licence, or revenue-share arrangement is required. Institutions typically offer some form of structured commercialisation pathway for spinouts, but the specific structure, royalty rate, equity position, and governance terms differ. Get this agreement in writing before the company raises any external capital. Build the technology transfer negotiation timeline into your incorporation plan, not your Series A preparation.

IP assignment actions at incorporation:

• Execute a formal IP assignment deed assigning all pre-incorporation work product from founders to the company. This deed should reference a schedule listing each asset specifically.
• If the IP originated at a university or research institution, resolve the institution’s claim first, then execute the assignment or licence agreement before any investor due diligence.
• Include invention assignment clauses in all employment and contractor agreements signed after incorporation, covering current and future work product.
• File a provisional patent application in India before filing any international application. Under Section 39 of the Patents Act 1970, an Indian resident must obtain permission from the Controller of Patents before filing a patent application outside India, unless a domestic application has first been filed and six weeks have elapsed without a secrecy direction. Filing internationally without this permission creates severe legal risk for both the company and the founder.

For deep tech medtech companies, CDSCO licensing applications may require disclosure of the core innovation. A pending patent application provides far stronger protection than a confidential disclosure alone. Build the patent filing timeline into the product roadmap alongside the CDSCO classification review.

BIRAC BIG grant: eligibility, sequence, and the AoA conflict most founders miss

The BIRAC Biotechnology Ignition Grant (BIG) is the largest early-stage biotech funding programme in India. It provides up to ₹50 lakh as grant-in-aid for 18 months to support translation of innovative ideas into proof of concept in the life sciences and medtech space. The call for proposals opens twice annually, on 1 January and 1 July.

A registered company or LLP is required to apply as an entity. Delaying incorporation means you cannot receive the grant even if selected. A DPIIT-recognised startup with a filed provisional patent application, a clean company structure (IP assigned, board constituted, bank account operational), and a well-drafted innovation description is materially better positioned than an unregistered team with only a research paper.

Why your AoA must preserve founder autonomy over grant-funded R&D

BIRAC’s grant terms require the grantee to operate with full autonomy over the project. This creates a conflict that most founders and their lawyers do not spot at incorporation. If an early angel investor or a strategic partner negotiates reserved-matter rights in the Shareholders Agreement that cover IP licensing, change of business scope, or key hiring decisions, and those rights are reflected in the Articles of Association, the company’s AoA now gives a third party the power to block decisions that BIRAC expects the founder to make independently as the grant project leader.

BIRAC’s monitoring officer, during a routine compliance visit, will review the AoA as part of the governance package. An AoA that shows investor reserved-matter rights over grant-funded R&D activities is a representation conflict. The solution is to draft the AoA at incorporation with a specific carve-out preserving founder operational authority over grant-funded project activities, explicitly separate from investor governance rights over commercial decisions. This is a two-clause drafting difference. The full AoA architecture for deep-tech startups, including SHA compatibility and investor rights accommodation, is covered in Treelife’s guide on incorporation retainers for AI and deep-tech startups.

Post-award, BIG grantees must maintain quarterly compliance reports, submit annual R&D returns to BIRAC, and keep grant-funded expenditure in a separate dedicated bank account. The grant account mechanics, no-lien requirements, and milestone documentation are covered in detail in the same guide.

DPDP Act 2023 obligations for a medtech startup collecting patient data

The Digital Personal Data Protection Act 2023 (DPDP Act) came into force in stages from 2024 and creates obligations that apply to any entity processing “digital personal data” of Indian residents. For a medtech startup, this is not a future-state compliance obligation. It applies from the first patient data point your device collects.

Health data (including diagnostic outputs, physiological readings, imaging data, and any data linkable to a specific patient) is classified as sensitive personal data under the DPDP Act. This classification triggers stricter obligations than ordinary personal data processing.

Core DPDP Act obligations for a medtech startup:

Consent must be obtained before collecting any patient-identifiable data. The consent mechanism must be granular, purpose-specific, and revocable. A pre-checked box in a hospital onboarding form does not meet the standard. For devices deployed in hospitals or clinical settings, the hospital cannot provide blanket consent on behalf of patients; individual patient consent must be obtained for each distinct processing purpose.

Purpose limitation applies strictly. If a device is deployed for diagnosis, the data cannot be used for commercial research or model training without additional consent specifically for that purpose. A medtech startup that uses clinical pilot data to train or improve its AI model without separate consent for that purpose is in breach of the Act, even if the hospital partner was aware.

Data breach reporting requires notification to the Data Protection Board of India within a timeframe to be specified in rules (draft rules suggest 72 hours for significant breaches). A breach involving patient health data will be treated as high-severity by the Board.

Children’s data carries the most stringent obligations. A device or software that could be used to process data of individuals below 18 years must have verifiable parental or guardian consent before any processing. Medtech startups building paediatric diagnostic tools must build consent architecture from Day 1, not as a retrofit before their hospital partnership agreements are signed.

Penalties under the DPDP Act can reach ₹250 crore per breach for violations related to processing children’s data without consent, and up to ₹200 crore for other significant violations.

What to do at incorporation: Appoint a Data Protection Point of Contact (not yet a mandatory DPO appointment for all companies, but a named internal owner is essential). Draft a patient data privacy notice. Map your data flows from device to backend server and confirm which territories the data transits through, because cross-border data transfers are only permitted to countries notified by the Central Government. Build consent capture into your clinical pilot protocol before the first patient interaction.

The annual MCA compliance calendar a medtech private limited company must maintain

Post-incorporation compliance under the Companies Act 2013 is non-negotiable and non-discretionary. Directors of companies that miss three consecutive years of annual filings are automatically disqualified under Section 164(2)(a). The full compliance master table with penalty amounts for every form is covered in Treelife’s annual compliance checklist for startups. The table below captures the deadlines most relevant to a medtech private limited company in FY 2026-27.

Annual compliance calendar (FY 2026-27):

Form	Purpose	Deadline
DIR-3 KYC	Director KYC verification	30 September 2026
ADT-1	Auditor appointment (if changed)	Within 15 days of AGM
AOC-4	Filing of financial statements	Within 30 days of AGM
MGT-7A	Annual return (for small companies)	Within 60 days of AGM
DPT-3	Return of deposits / outstanding loans	30 June 2026
MSME-1	MSME payment compliance return	30 April and 30 October
BEN-2	Beneficial ownership return	Within 30 days of receiving BEN-1

AGM must be held within six months of the close of the financial year, which for FY 2025-26 means by 30 September 2026.

The Income Tax Act 2025 replaces the Income Tax Act 1961 from Tax Year 2026-27. Terminology changes but substantive rates and deadlines for startup-related provisions remain materially the same. Advance tax payments, TDS, and ITR-6 filing remain as applicable.

For medtech startups receiving BIRAC grants, the grant agreement requires annual audit compliance on the use of grant funds, submitted to BIRAC alongside the statutory audit. Structure your accounts from Day 1 to segregate grant-funded expenditure from operating expenditure. Co-mingling creates an audit problem and can trigger grant revocation.

Common mistakes that cost medtech founders time and money

Incorporating too late and losing BIRAC cycles. BIRAC BIG calls open twice a year. A team that delays incorporation by six months misses at least one call window and possibly two. Given that BIG funds proof-of-concept work, incorporating after proof of concept is achieved means you are raising equity to fund work that a ₹50 lakh non-dilutive grant could have covered.

Conflating DPIIT recognition with the 80-IAC tax exemption. These are two separate applications. DPIIT recognition takes 72 hours. IMB certification for 80-IAC requires a substantive application, several months of review time, and strong documentation of innovation. Founders who never apply for the IMB certificate surrender a benefit that can be worth several crore rupees in saved taxes during profitable years.

Beginning a human subject study without CDSCO clinical investigation approval. Rule 50 of the Medical Devices Rules 2017 requires prior CDSCO approval before any clinical investigation involving human subjects. A hospital pilot or feasibility study arranged informally, even with the hospital’s internal ethics committee clearance, does not substitute for this approval. The hospital partner is equally at risk. This is the most dangerous compliance gap specific to medtech that no general startup compliance guide covers.

Starting CDSCO licensing without an ISO 13485-compliant QMS. CDSCO expects the Quality Management System to be operational before granting a manufacturing licence for Class C or Class D devices. Founders who begin the CDSCO filing before implementing their QMS lose months when the licensing authority asks for QMS evidence during review. Build the QMS in parallel with product development, not after CDSCO asks for it.

Filing a patent internationally before filing in India. Under Section 39 of the Patents Act 1970, an Indian resident must file domestically first or obtain explicit foreign filing permission from the Controller of Patents. Filing a PCT application or a US provisional without having filed in India first, and without that permission, is a violation that can invalidate the patent internationally in certain jurisdictions and carries penalties in India.

Assigning IP to the company without first resolving the institution’s claim. An academic spinout that executes an IP assignment deed without engaging the university’s technology transfer office first creates a defective assignment. BIRAC and institutional investors will both identify this during due diligence. Resolve the institution’s IP policy position first; then execute the assignment or licence agreement in the correct sequence.

Collecting patient data without a DPDP Act-compliant consent mechanism. A medtech startup that begins a clinical pilot with a generic hospital consent form, or processes patient data without a DPDP-aligned privacy notice, is exposed to regulatory action from the Data Protection Board even if it has no revenue yet. The Act applies from the first data collection, not from commercial launch.

FAQs

Q: Can a deep-tech medtech startup incorporate as an LLP instead of a private limited company?
A: An LLP qualifies for DPIIT recognition and can receive BIRAC grants. However, it cannot issue equity shares to venture investors, making it unsuitable if institutional funding is planned. Section 80-IAC applies to both LLPs and private limited companies, but the practical inability to issue ESOP or equity to investors makes the LLP a poor choice for a high-growth medtech venture. Incorporate as a private limited company from the start.

Q: How long does DPIIT recognition take for a deep tech medtech startup in 2026?
A: Standard DPIIT recognition is typically processed within 72 hours for clean applications submitted through the Startup India portal. Deep tech applications require additional R&D documentation, which can extend processing time if the documentation is incomplete. A well-prepared application with clear IP ownership evidence, R&D expenditure details, and an innovation write-up that maps to DPIIT’s deep tech definition should receive recognition within a week.

Q: Is CDSCO registration required before a medtech startup can begin R&D?
A: No. R&D activities on a bench model or prototype do not require CDSCO licensing. However, once you move to any study involving human subjects, Rule 50 of the Medical Devices Rules 2017 requires prior CDSCO clinical investigation approval, regardless of whether you have a manufacturing licence. A startup can run bench-level R&D on a Class C device without a CDSCO licence, but must have clinical investigation approval before the first human subject study and a manufacturing licence before the first commercial unit leaves the facility.

Q: What documentation does the IMB require for Section 80-IAC certification?
A: The IMB reviews: the certificate of incorporation, DPIIT recognition certificate, audited financial statements for available years, a detailed product/technology description demonstrating novelty, evidence of IP (filed patents, research publications), R&D expenditure records, and a business plan. The IMB assesses whether the startup’s innovation is genuine and whether the business qualifies as eligible business under Section 80-IAC. Applications without substantive R&D evidence are typically rejected.

Q: Can a medtech startup claim both Section 80-IAC and the 22% concessional tax rate under Section 115BAA?
A: No. Sections 115BAA and 80-IAC cannot run in parallel. The election of 115BAA is irrevocable. A startup that elects the 22% rate permanently forecloses the 80-IAC three-year 100% exemption. For most deep-tech medtech startups that expect significant profitability to begin only after regulatory clearance and commercial launch, the 80-IAC exemption is typically more valuable. Model the scenarios before electing.

Q: What is the turnover threshold for Section 80-IAC eligibility?
A: The turnover must not exceed ₹100 crore in any year during which the Section 80-IAC deduction is claimed. This is separate from the DPIIT recognition turnover threshold (₹300 crore for deep tech startups). A startup that exceeds ₹100 crore in a particular year loses the 80-IAC deduction for that year but may claim it in other qualifying years within the ten-year window.

Q: Do foreign founders or NRI co-founders affect DPIIT recognition or BIRAC eligibility?
A: DPIIT recognition has no citizenship or residency requirement for founders. However, BIRAC BIG grants are available only to Indian passport holders. NRI founders or OCI cardholders are not eligible to apply for BIG as individuals. If the entity itself is incorporated in India and the applying founder holds an Indian passport, the application can proceed. Foreign Direct Investment into a medtech private limited company is subject to FEMA 2000 and the current FDI policy, and Form FC-GPR must be filed with the RBI through an Authorised Dealer bank within 30 days of share allotment.

Q: What are the DPIIT fund utilisation restrictions that apply during the recognition period?
A: Under the 2026 DPIIT notification, recognised startups cannot invest in immovable property beyond business use, transport vehicles above ₹10 lakh, loans and advances outside ordinary course of business, or capital contributions to other entities outside ordinary business. These restrictions apply for the full recognition period (10 years for regular startups, 20 years for deep tech startups). Violations can trigger recognition revocation and retrospective denial of all benefits.

Q: When should a medtech startup apply for DSIR recognition?
A: DSIR recognition is relevant if you are claiming the weighted deduction under Section 35(2AB) of the Income Tax Act 2025 for in-house R&D expenditure. This deduction allows a company to deduct 150% of qualifying R&D expenditure. DSIR recognition requires a formal R&D facility with dedicated R&D personnel, separate R&D accounts, and an application through the dsir.gov.in portal using Form A. Apply once you have a defined R&D team and facility, typically by the end of your first full financial year.

Q: What happens to CDSCO compliance if a medtech startup’s device classification changes after the initial filing?
A: If a device’s risk profile changes during development (for example, a Class B diagnostic device is modified to include a treatment function that places it in Class C), a fresh classification application must be filed through the Sugam portal. Class upgrades require a new licence application and compliance with all requirements for the higher class, including QMS conformance to ISO 13485. Build classification review checkpoints into your product development milestones.

Q: What consent mechanism does the DPDP Act 2023 require for collecting patient data?
A: Consent under the DPDP Act must be free, specific, informed, unconditional, and unambiguous: a clear affirmative act. For health data, which is treated as sensitive personal data, the standard is stricter than for general personal data. Consent must be purpose-specific: a patient consenting to diagnosis cannot have their data used for model training or commercial research without separate consent for that purpose. Consent must also be revocable, and the mechanism for revocation must be as easy as the mechanism for giving it. A single checkbox in a hospital admission form does not meet these requirements.

Q: What happens if the IP originated at a government-funded research institution and is assigned to the company without engaging the institution?
A: The assignment deed is potentially unenforceable against a third party with a prior institutional claim. Most centrally-funded research institutions assert ownership or a revenue share in inventions made using their resources, under policies that vary by institution and are not standardised across the sector. A company that assigns IP to itself without resolving the institution’s claim first holds a defective title. BIRAC’s grant terms require clean IP ownership, and investors will identify this in due diligence. Engage the institution’s technology transfer office before executing any assignment deed, and structure the licence or assignment agreement with the institution as the first documented step.

Q: Is there a compliance obligation related to clinical data under CDSCO for AI/ML medical devices?
A: Yes. CDSCO’s October 2025 draft guidance on Medical Device Software specifically addresses AI/ML-based SaMD. The guidance requires an Algorithm Change Protocol documenting how algorithm updates will be evaluated for clinical impact before deployment. For devices where an algorithm update could change clinical outcomes, post-market surveillance obligations apply. Build ACP documentation into your regulatory strategy from the product specification stage.

Regulatory references:

• Companies Act 2013, Sections 10A (commencement of business), 164(2)(a) (director disqualification), Section 454 (penalties)
• Income Tax Act 2025 (replacing Income Tax Act 1961 from Tax Year 2026-27), Section 80-IAC (startup tax holiday), Section 35(2AB) (weighted R&D deduction), Sections 115BAA and 115BAB (concessional corporate tax)
• DPIIT Notification G.S.R. 108(E), 4 February 2026 (superseding G.S.R. 127(E) of 2019): Deep Tech Startup recognition framework
• Medical Devices Rules 2017 (as amended through 2025), under the Drugs and Cosmetics Act 1940: Rule 50 (clinical investigation approval)
• CDSCO Directive on Central Licensing Authority classification role, October 2025
• CDSCO Draft Guidance on Medical Device Software (SaMD), October 2025
• Digital Personal Data Protection Act 2023, Sections 4, 6, 9 (consent, children’s data), Section 33 (penalties)