India is one of the world's largest suppliers of medicines by volume — a dominant force in generics, a major source of active pharmaceutical ingredients, and home to one of the largest concentrations of US FDA-inspected manufacturing sites outside the United States. The main clusters sit around Hyderabad, Ahmedabad and the wider Gujarat corridor, Mumbai and Pune, Bengaluru for biotech, and Visakhapatnam.
That combination creates an unusual compliance position. Many Indian manufacturers answer to their national regulator, to the US FDA, to European inspectors and to WHO prequalification at once. This guide covers the revised Schedule M, how Indian oversight is structured, the themes that recur in FDA findings, and what is changing in validation practice. For the underlying principles see what GxP means.
How Indian oversight is structured
Regulation is split. The Central Drugs Standard Control Organisation (CDSCO) handles national matters such as new drug approvals, clinical trials and import registration, while state licensing authorities license and inspect manufacturing sites in their state. Many sites deal with both, and joint inspections are increasingly common.
For exporters, the national regime is only part of the picture. A site supplying the US is inspected by the FDA against US requirements, including 21 CFR Part 11 for electronic records. A site supplying Europe is inspected against EU GMP and Annex 11. In practice, the export market sets the bar.
The revised Schedule M
Schedule M sets out GMP requirements under India's Drugs and Cosmetics Rules. The revised version, notified at the end of 2023, is the biggest change in decades. It moves the national standard much closer to WHO GMP and to the systems other major regulators expect.
The revision brings in concepts that were thin or absent before: a pharmaceutical quality system, quality risk management, product quality reviews, stronger change control and deviation handling, supplier qualification, and explicit attention to computerised systems and data integrity. Compliance deadlines were staggered — larger manufacturers first, with smaller firms given extensions. Check the current status for your category, because timelines have moved.
For manufacturers that already export to regulated markets, much of this formalises what they already do. For those that have served mainly the domestic market, it is a real step change — and computerised system validation is often where the gap is widest.
What FDA findings keep returning to
Public FDA warning letters to Indian sites over the past decade show a consistent set of data integrity themes. Most are not about sophisticated fraud. They are about systems and habits that make records unreliable:
- Shared logins and weak access control on instruments and lab systems, so no action can be tied to one person.
- Audit trails switched off or never reviewed on chromatography and other lab systems.
- Trial or "test" injections run and discarded before the reportable run, so the result that gets reported has been selected.
- Uncontrolled spreadsheets and paper worksheets used for GxP calculations, with no record of what changed.
- Investigations that close without a real root cause, especially for out-of-specification results.
All five are fixable, and all five are fixed mainly through system configuration, clear procedures and a culture where reporting a problem is safe — not through buying new software alone. See data integrity (ALCOA+) and preparing for a GxP audit.
Where validation practice is heading
From paper packages to risk-based assurance. Many Indian sites still produce very large paper-based validation packages. Regulators increasingly favour the risk-based approach behind Computer Software Assurance: less effort on low-risk functions, more rigour on the ones that matter. Done properly, this cuts cost and improves quality at the same time.
Lab systems first. The chromatography data system, LIMS and standalone instruments are where findings concentrate, so they are where validation and access-control work pays back fastest. See LIMS validation.
One standard across markets. Running different practice for domestic and export lines is expensive and risky — inspectors notice. Converging on the strictest applicable standard is simpler to operate and defend.
Tooling to handle volume. With large product portfolios and many systems, documentation effort is a real bottleneck. Teams are adopting GxP software and, increasingly, GxP AI to draft and trace validation documents for human review — with the approval always staying with a qualified person.
Where to go next
Explore GxP Copilot for AI-native validation, TraceDraft for source-traceable clinical documentation, or book a demo to see either on your own data.