Schedule MSchedule M — Good Manufacturing Practices for Pharmaceutical Products (India)

Schedule M is the Good Manufacturing Practices (GMP) schedule of the Drugs and Cosmetics Rules 1945, the operational rulebook that sits under the Drugs and Cosmetics Act 1940. Any facility that manufactures a licensed drug in India — whether the licence is issued by a State Licensing Authority (SLA) or by CDSCO for a Central-scope product — must comply with Schedule M. Non-compliance is grounds for suspension or cancellation of the manufacturing licence and, in serious cases, for prosecution under the Act.

For decades the schedule was often described as broadly aligned with WHO-GMP but with meaningful gaps against modern PIC/S expectations, especially around risk management, computerised systems, and validation lifecycle. The Ministry of Health and Family Welfare closed most of that gap in one step: Gazette notification G.S.R. 922(E) dated 28 December 2023 comprehensively revised Schedule M and set a phased compliance clock. This page covers what the schedule actually requires today, who has to be compliant when, and how it interacts with related Indian rules such as Schedule L-1 and international frameworks such as ICH Q9 and ICH Q10.

Schedule M is a schedule to the Drugs and Cosmetics Rules 1945, made under the Drugs and Cosmetics Act 1940. It applies to the manufacture of drugs as defined by the Act, including allopathic pharmaceuticals, biologicals, vaccines, blood products, radiopharmaceuticals, medical gases and investigational medicinal products used in clinical trials. Ayurveda, Siddha, Unani and Homoeopathy products fall under separate schedules (Schedule T, etc.). Medical devices are covered by the Medical Devices Rules 2017, not by Schedule M.

The revised schedule is organised into a general Part I that applies to every pharmaceutical manufacturer and a set of product-specific annexes / parts covering categories that need additional controls: sterile products, biological products, radiopharmaceuticals, ATMPs, phytopharmaceuticals, medical gases, investigational products, and specific drug classes such as hormonal preparations, cytotoxics and beta-lactams that require dedicated facilities. A manufacturer is expected to comply with Part I plus every applicable annex for the product classes on its licence.

Enforcement is federal-state. State Licensing Authorities issue and inspect manufacturing licences (Forms 25, 28 and their variants) for most products; CDSCO handles imports, new drugs, blood banks, vaccines and other central-scope categories, and increasingly co-inspects on a risk basis with SLAs. Both authorities can and do cite Schedule M non-compliance in inspection observations.

The revised Schedule M does not simply update numbering. It re-scopes GMP for Indian pharma around a formal Pharmaceutical Quality System and imports several concepts that used to live only in guidance documents or in export-market inspections.

• A formal **Pharmaceutical Quality System (PQS)** aligned with ICH Q10 — including management responsibility, quality manual, product quality review, change management and CAPA.
• Explicit **quality risk management** aligned with ICH Q9(R1) applied to premises, processes, computerised systems and supplier controls.
• A full **qualification and validation lifecycle** — URS, DQ, IQ, OQ, PQ, cleaning validation and process validation with a Validation Master Plan, echoing Annex 15 of the EU GMP guide.
• Explicit **data integrity** expectations (ALCOA+), including contemporaneous recording, audit trails and periodic review of electronic records.
• **Computerised system validation** requirements for systems that generate or hold GMP records, with GAMP 5-style risk-based categorisation.
• **Product-specific annexes** for sterile products, biologicals, radiopharmaceuticals, ATMPs, phytopharmaceuticals, medical gases and investigational medicinal products.
• Stronger **supplier and outsourced-activity controls** — qualification, technical agreements and audit programmes for API vendors, contract manufacturers and contract testing laboratories.
• A formal **contamination control strategy** for sterile and multi-product facilities, referencing EU GMP Annex 1-style principles.

The Ministry set a tiered clock so that smaller manufacturers get more time. The applicability tier is based on annual turnover of the manufacturing entity.

The Ministry has issued extensions and clarifications for specific product categories and for MSMEs demonstrating a genuine remediation plan. Manufacturers should treat their SLA's most recent circular as authoritative, and should assume that once their tier date has passed, any Schedule M non-compliance is enforceable.

The PQS chapter is the centre of gravity of the revised schedule. Manufacturers must operate a documented quality system that covers, at minimum: management responsibility and quality policy, a quality manual, product quality review (annual product review), change management, deviations and CAPA, risk management, self-inspection and internal audit, and periodic management review. Roles are explicit — the Head of Production, Head of Quality Control and (for finished pharmaceuticals) the Head of Quality Assurance are each named as independent functions with defined authority.

• **Change management** covers premises, equipment, utilities, processes, materials, methods and computerised systems — with impact assessment before implementation.
• **Deviation and CAPA** requires root-cause analysis, effectiveness checks and trending; investigations must be closed within defined timelines.
• **Product Quality Review (PQR)** is required annually per product and must cover starting materials, in-process controls, finished-product results, stability data, deviations, changes, complaints, recalls and returns.
• **Self-inspection** must be planned, executed by trained staff independent of the area being inspected, and tracked to closure.

The revised schedule requires a documented Validation Master Plan (VMP) that lists premises, utilities, equipment, computerised systems, analytical methods, cleaning procedures and manufacturing processes to be qualified or validated, together with responsibilities and timelines. Each item follows the URS → DQ → IQ → OQ → PQ lifecycle where applicable, backed by risk assessment. Requalification frequency and revalidation triggers (change, adverse trend, periodic review) must be defined.

Cleaning validation must cover worst-case product/equipment combinations and use scientifically justified acceptance criteria (health-based exposure limits where relevant). Process validation follows a lifecycle model — traditional, continuous or hybrid — and must include continued process verification once commercial. Analytical method validation follows ICH Q2 principles; for compendial methods, verification under actual conditions of use is expected.

Data integrity is treated as a core GMP requirement, not a bolt-on. Records — paper or electronic — must be Attributable, Legible, Contemporaneous, Original and Accurate, plus Complete, Consistent, Enduring and Available (ALCOA+). Corrections must preserve the original entry and record the reason for change. For electronic records, secure audit trails, unique user accounts, role-based access, time-source control and periodic audit-trail review are explicit expectations.

Computerised systems used in GMP activities must be validated for intended use, with a risk-based lifecycle covering user requirements, functional and design specifications, installation and operational qualification, performance qualification, change control and periodic review. Systems must be inventoried and categorised. Where a system supplier holds validation documentation, the manufacturer remains responsible for demonstrating fitness for use in its own environment.

Part I sets out expectations for site layout, warehousing, production and QC areas, HVAC, water systems and utilities. Dedicated and self-contained facilities are required for specific classes: beta-lactams, sex hormones, cytotoxics and certain biologicals must not share air-handling or equipment trains with other products unless a validated campaign strategy is in place. Water for pharmaceutical use — Purified Water and Water for Injection — must be produced, distributed and monitored per IP / Ph. Eur. standards with defined alert/action limits.

Sterile-product annexes require a contamination control strategy that documents how the site controls microbial, particulate and endotoxin risks across facility design, personnel flow, gowning, environmental monitoring, aseptic process simulation (media fill) and product release. Isolator or RABS technology is preferred for aseptic processing of new lines; grade A / B / C / D area classification and monitoring frequencies are specified.

The revised schedule places explicit obligations on the marketing authorisation holder and the licensed manufacturer to qualify suppliers of active pharmaceutical ingredients (APIs), excipients, primary packaging and outsourced services (contract manufacturing, contract testing, sterilisation, calibration). Qualification must be risk-based, evidence-based and periodically reviewed. Technical agreements are required for outsourced GMP activities and must define responsibilities for release, deviation handling, change control and regulatory reporting.

API suppliers should meet ICH Q7 GMP; where an API is not manufactured under Q7 or an equivalent, the finished-product manufacturer must justify the risk and document additional controls. Contract testing laboratories must comply with the laboratory-side requirements of Schedule L-1.

CDSCO and SLA inspections are increasingly risk-based and structured around WHO / PIC/S classification of findings (critical, major, other). Joint CDSCO–SLA inspections are used for higher-risk sites and for the ongoing risk-based inspection drive that began in 2023. Inspection outcomes range from advisory letters, through show-cause notices under the Drugs and Cosmetics Act, to suspension or cancellation of manufacturing licence and stop-production orders. Serious data-integrity findings can trigger prosecution.

Common findings under the revised schedule cluster around a predictable set of areas:

• Incomplete or missing PQS elements — no PQR, weak self-inspection, absent management review.
• Validation gaps — no VMP, incomplete cleaning validation, unverified compendial methods.
• Data integrity — shared logins, disabled audit trails, back-dated entries, uncontrolled spreadsheets.
• Computerised systems used in GMP without documented validation or without audit-trail review.
• Weak supplier qualification — no risk classification, no periodic requalification, missing technical agreements.
• Sterile-facility findings — inadequate environmental monitoring, gowning, media-fill acceptance criteria.
• OOS / OOT investigations that do not meet the depth expected by CDSCO or by export inspectors.

Schedule M governs manufacture; Schedule L-1 governs the pharmaceutical testing laboratory (in-house QC and Rule 150-A third-party labs). A batch is not compliantly released unless both the manufacturing operation and the laboratory that tested it meet their respective schedule. Together they form India's GMP + GLP pair for pharmaceuticals.

Other Indian instruments interact at specific boundaries: the New Drugs and Clinical Trials Rules 2019 govern investigational medicinal products at the sponsor / trial level; the Medical Devices Rules 2017 replace Schedule M for devices; the Drugs (Prices Control) Order affects commercial release but not GMP. Internationally, the revised Schedule M is substantively close to WHO-GMP and to much of PIC/S GMP, but India is not (as of 2026) a PIC/S participating authority — a Schedule M / WHO-GMP certificate issued by an SLA is accepted by many procurement bodies and non-PIC/S authorities but is not equivalent to a PIC/S GMP certificate for high-regulation markets, which require their own inspection.

1. Confirm your tier (large vs MSME) and the applicable compliance date; obtain your SLA's most recent circular in writing.
2. Run a gap assessment of the current QMS against the revised Part I plus every annex on your licence; classify gaps by risk.
3. Stand up a formal PQS: quality manual, PQR schedule, management review cadence, integrated CAPA / deviation / change process.
4. Rebuild the validation lifecycle around a VMP; prioritise re-qualification of sterile-critical equipment, cleaning validation and computerised systems.
5. Perform a data-integrity self-inspection covering audit trails, shared accounts, hybrid records and paper trails; remediate before an inspector finds it.
6. Refresh supplier qualification: API/excipient risk classification, technical agreements, on-site audits for high-risk vendors.
7. For sterile lines, document a contamination control strategy referencing EU GMP Annex 1 principles.
8. Train the entire GMP workforce on the revised schedule and record the training against role.
9. Run a mock CDSCO / SLA inspection using WHO / PIC/S finding classification before the mandatory date bites.