Revised Schedule M: The Complete Compliance Checklist for Pharma Manufacturers

2026-06-14

The revised Schedule M is now in force and MSME extensions have expired. A plain-English guide to what changed (PQS, QRM, PQR, data integrity), a section-by-section compliance checklist, and where inspections actually find gaps.

Revised Schedule M — The Complete Compliance Checklist for Pharma Manufacturers

For two years the revised Schedule M was a deadline somewhere in the future. That future has arrived. The MSME extension expired on 31 December 2025, every licensed manufacturer is now expected to comply, and state drug authorities have moved to risk-based inspections — with non-compliant units facing show-cause notices, suspension, or closure. If your facility isn't fully Schedule-M ready, you are no longer planning for a deadline; you are exposed to an inspection.

This is a practical, plain-English breakdown of what the revised Schedule M actually requires, where most companies fail, and a section-by-section compliance checklist you can work through.

What the revised Schedule M is

Schedule M of the Drugs and Cosmetics Rules sets India's Good Manufacturing Practices (GMP) — the requirements for premises, equipment, and quality systems that a pharma manufacturer must meet to hold a licence. The revised Schedule M, notified by the Union Health Ministry in December 2023, is the biggest overhaul of Indian GMP in years. It pulls Indian standards much closer to WHO-GMP, and it was driven in no small part by quality failures — including fatal diethylene glycol (DEG) contamination incidents — that made the gap between paper compliance and real quality systems impossible to ignore.

The headline shift: Schedule M is no longer mostly about buildings and equipment. It now mandates a functioning quality system — the documented, evidence-backed processes that prove your manufacturing stays in control. That's where the real work is, and where most inspections will find gaps.

Where we are now — the timeline

December 2023 — revised Schedule M notified.
1 January 2025 — came into effect; large manufacturers (annual turnover above ₹250 crore) expected to comply.
Through 2025 — MSMEs (turnover ₹250 crore or less) given until 31 December 2025, conditional on applying to the licensing authority via Form A on the ONDLS portal with a CAPA / upgradation plan.
2026 onward — extension lapsed; risk-based inspections underway. The ministry has signalled it is unlikely to extend further, and industry reporting suggests many units that did not apply or upgrade are now at real risk of action.

The practical reading: the grace period is over. Treat any remaining gap as an open inspection finding.

Who it applies to

Every manufacturer of pharmaceutical products licensed under the Drugs and Cosmetics Rules — regardless of size. Turnover only ever affected the timeline, never the obligation. MSMEs are not exempt; they were simply given longer, and that time has now run out.

What actually changed — the five things inspectors will look for

The revised schedule adds, in formal terms, the elements of a modern quality system. These are the new pillars:

1. Pharmaceutical Quality System (PQS). A structured, documented quality system in the spirit of ICH Q10 — covering change control, deviations, CAPA, management review, supplier management, and continual improvement as connected processes, not isolated forms in a cupboard.

2. Quality Risk Management (QRM). A scientific, documented approach to assessing, controlling, and communicating risks to product quality — with the depth of effort scaled to the level of risk.

3. Product Quality Review (PQR / APQR). A periodic (typically annual) review of all quality data for each product, to confirm the process stayed in control and to drive improvement. (We cover this in depth in our guide to the Annual Product Quality Review.)

4. Computerised systems and data integrity. This is the big one for most MSMEs. The revised schedule expects computerised records with audit trails that capture every change — what was changed, by whom, and when — plus validation of any software used in manufacturing or quality. In short: ALCOA+ data integrity is now a legal expectation, not an aspiration. (See our guide to data integrity and ALCOA+.)

5. Validation, qualification, and self-inspection. Formal process validation, equipment/utility qualification, cleaning validation, and a routine self-inspection / internal audit programme that you can show inspectors.

The Schedule M compliance checklist

Work through these. For each, the inspector's real question is "show me the evidence" — so the test isn't whether you have a policy, it's whether you can produce records on demand.

Quality system

[ ] A documented Pharmaceutical Quality System with a quality manual and current, version-controlled SOPs
] Deviation management — every deviation logged, investigated, risk-assessed, and closed with timelines ([how to manage deviations)
] CAPA — corrective and preventive actions with root-cause analysis, owners, due dates, and effectiveness checks ([building a CAPA workflow)
] Change control — no change to process, equipment, or supplier without an assessed, approved record ([change control in practice)
] OOS / OOT investigations with a defined flow ([OOS investigation workflow)
[ ] Quality Risk Management documented and applied to real decisions
[ ] Self-inspection / internal audit schedule with findings tracked to closure

Documentation & data integrity

] Batch Manufacturing / Packing Records complete, contemporaneous, and reviewed ([digital batch records)
[ ] Audit trails on computerised records — who changed what, when
[ ] ALCOA+ principles enforced — attributable, legible, contemporaneous, original, accurate
[ ] Validation of any software/automated system used in manufacturing or QC
[ ] Logbooks, registers, and equipment usage logs maintained and retrievable

Product & process

[ ] Product Quality Review (APQR) completed for each product
[ ] Process validation, equipment qualification, and cleaning validation records
[ ] Stability programme — ongoing and protocol-driven
] Equipment calibration current and never lapsed ([calibration scheduling)
] Supplier / vendor qualification for raw and packaging materials ([vendor performance tracking)

Market & premises

] Market complaint handling with investigation and trending ([complaint handling)
] Product recall procedure, tested ([recall management)
[ ] Premises, HVAC, water systems, and equipment meeting the upgraded physical standards

The two kinds of gaps — and which one you can fix fast

Schedule M gaps fall into two very different buckets, and confusing them is why companies panic.

Capital gaps — HVAC upgrades, water systems, cleanroom classifications, new equipment. These cost money and take time; there's no shortcut, and if you need them, the upgradation plan you filed matters.

System and documentation gaps — PQS, deviations, CAPA, change control, audit trails, APQR, self-inspection. This is where the majority of inspection findings actually land, and it's the half you can close quickly and cheaply — because it's about process discipline and evidence, not concrete and steel. A facility can be physically excellent and still fail because its deviations live in a WhatsApp group and its "audit trail" is a hand-written register that anyone could backdate.

The good news: the documentation half is exactly what a workflow system fixes — and it's the difference between hoping you pass and being able to show you comply.

How Flobri helps you close the system gaps

Flobri runs your Schedule M quality processes as connected, no-code digital workflows — so the evidence an inspector asks for is always there, current, and tamper-evident:

Deviations, CAPA, change control, OOS, complaints, and recalls run as structured workflows with owners, due dates, and escalation — nothing falls through the cracks, and everything is closed with a record.
Built-in audit trail — every entry and change is captured with who, what, and when, supporting ALCOA+ data integrity by design rather than by discipline alone.
APQR and trends are compiled from data already captured, not reconstructed from scratch once a year.
One dashboard shows open deviations, overdue CAPAs, pending change controls, and upcoming calibrations — so audit readiness is a permanent state, not a fire-drill before an inspection.
Live in days, not months — you describe your process and it becomes a working workflow (from description to live workflow), which matters when inspections are already happening.

Frequently asked questions

Is the revised Schedule M deadline still open for MSMEs?

No. The MSME extension expired on 31 December 2025. Manufacturers are now expected to be compliant, and risk-based inspections are underway. Always verify the latest position with CDSCO and your state drug authority, as enforcement details evolve.

Does revised Schedule M apply to small manufacturers?

Yes. It applies to all licensed pharmaceutical manufacturers regardless of turnover. Size only affected the implementation timeline, not the obligation.

What is the single biggest change?

The shift from a buildings-and-equipment focus to a mandated, documented quality system — including Pharmaceutical Quality System, Quality Risk Management, Product Quality Review, and computerised records with audit trails and data integrity.

What gets companies failed in an inspection?

Most findings are not physical — they're system and documentation gaps: deviations not investigated, CAPAs left open, no audit trail on records, missing APQR, and changes made without change control.

Can software make us Schedule M compliant?

Software won't pour concrete, but it closes the system and documentation half of Schedule M — which is where most inspection findings occur. Running deviations, CAPA, change control, APQR and records on a workflow platform with built-in audit trails gives you the evidence inspectors ask for.

This article is general guidance, not legal or regulatory advice — confirm current requirements with CDSCO and your state drug authority. Flobri helps pharma manufacturers run the Schedule M quality system — deviations, CAPA, change control, APQR, complaints and recalls — as connected digital workflows with built-in audit trails, so you're always inspection-ready. See how Flobri turns a process description into a live workflow.