Revised Schedule M is live: what inspectors now expect from your computerised systems

Most of the conversation about Revised Schedule M has been about buildings. Air handling, flooring, segregation, change rooms — the civil works that cost money and take months. That is the visible part of the upgrade, and it is why roughly 8,500 MSME units spent 2025 asking for more time.

The part that will actually generate inspection observations is quieter and cheaper to fix: computerised systems and data integrity. A site can pass on premises and still collect findings on how it records a temperature.

The dates, settled

The revised schedule was notified at the end of December 2023. Manufacturers with turnover above ₹250 crore had six months, putting their deadline in late June 2024. Smaller manufacturers had twelve months, and then a conditional extension — units that formally applied under G.S.R. 127(E) of 11 February 2025, via Form A to the Central Licence Approving Authority, were given until 31 December 2025.

That extension has expired. The Drugs Controller General of India has stated that compliance from 1 January 2026 is expected strictly and that no further extension will follow, and state and UT drug controllers have been directed to file monthly reports on inspection observations and the action taken on them.

Two consequences follow, and the second is the uncomfortable one:

1. Units that applied for the extension are now inside the enforcement window.
2. Units that did not apply were never covered by the extension at all. Estimates put the application rate at little more than one in ten. If you did not file Form A, you have been inspectable under the revised requirements for longer than you may think, without any grace period.

Schedule M is now a quality-systems document

The revised Part I reads differently from the old one. Alongside the GMP requirements for premises and equipment, it introduces the structures that a modern inspectorate looks for:

• a Pharmaceutical Quality System with defined responsibilities, not just a set of SOPs
• Quality Risk Management as a documented input to decisions
• Product Quality Review on a defined periodicity
• computerised systems requirements
• data integrity expectations, in the language of ALCOA+

The last two are where monitoring systems live. A temperature record is a computerised record supporting product quality; it is therefore in scope for exactly the same controls as a batch record held in software.

ALCOA+, applied to a temperature record

ALCOA+ is easy to recite and harder to satisfy. Applied to a warehouse or cold-room temperature record, each letter becomes a concrete test:

Attributable. Every reading traces to an identified instrument and channel, and every human action traces to a named user. A shared login on the monitoring dashboard breaks this immediately — "QA" is not a person.

Legible. The record is readable for its full retention period without depending on an obsolete application. A proprietary binary file that only one vendor's discontinued software can open is a finding waiting to happen.

Contemporaneous. The reading is timestamped when it is taken, by a clock that is controlled and synchronised. This is where paper rounds fail — a logbook filled in at the end of a shift for readings taken over eight hours is not contemporaneous, and inspectors test for it by comparing handwriting, ink and CCTV against the entry times.

Original. The first capture is preserved. If the original is a device buffer and you transcribe it into a spreadsheet, the spreadsheet is a copy, and you must either retain the original or make a verified true copy under a documented process.

Accurate. The measurement is traceable to a national standard, within calibration, and in specification. An expired calibration certificate does not just fail an audit item — it puts every record made under it in question.

Then the plus:

Complete. Nothing is deleted or omitted, including the failures. A record with a 40-minute gap during a power cut is incomplete; a record that shows a 40-minute gap, labelled as a data-gap event with the reason attached, is complete.

Consistent. Events are in sequence, with a coherent timebase across instruments. Four single-channel loggers whose clocks have drifted apart by minutes will not tell a consistent story about a single excursion.

Enduring. The record survives on durable media for its retention period. Thermal paper from a chart recorder does not qualify — it fades.

Available. It can be produced on request, during the inspection, without a support ticket to a vendor.

Seven questions to ask of your own monitoring

Walk these yourself before someone else does. Each one maps to a real observation category.

1. Can any user edit or delete a recorded reading? If the answer is yes for anyone at all — including an administrator — you have a data-integrity gap. The correct answer is that readings are immutable and any annotation is an addition with its own attribution, not a replacement.

2. Is there a computer-generated, time-stamped audit trail, and has anyone ever reviewed it? Having an audit trail is the easy half. Schedule M and Part 11 both assume the trail is reviewed as part of your routine quality process. An unreviewed audit trail is often treated as no audit trail.

3. Who holds administrative rights, and does that person also produce the records? Segregation of duties is the control that stops the ability to configure a system from becoming the ability to shape its output. An engineer who can both change an alarm limit and approve the record has too much authority in one pair of hands.

4. What happens to the record during a network or power failure? The right answer is that the instrument keeps logging locally and reconciles afterwards, with the outage visible in the record. "We lose that period" is an incomplete record; "we fill it in from the chart" is worse.

5. Is the system clock controlled? Time synchronisation, and the inability of a normal user to change the clock, is what makes every timestamp defensible. Ask who can change it and whether the change would be logged.

6. Are your alarm limits, set points and delays under change control? A limit that was widened last March to stop nuisance alerts, with no change record, is one of the fastest ways to turn a monitoring system into an inspection finding.

7. Do you have validation evidence for the system as you actually configured it? A vendor's generic validation package is an input, not a conclusion. The qualified state belongs to your site, on your configuration.

Where this leaves a monitoring programme

The gap between a compliant monitoring system and a non-compliant one is rarely the sensor. Accuracy is a solved problem at this point; ±0.2 °C class instruments are commodity. The gap is in everything around the reading — attribution, immutability, audit trail, clock control, calibration lifecycle, and whether the outage that happened last Diwali is visible in the record or simply absent from it.

That is a deliberate design position for us. Abhilekh chains every reading and every user action into a SHA-256 checksum chain on the server; each logger keeps a CRC-checked ring of up to 409,600 readings plus a separate, never-erased audit region so records survive connectivity loss and reconcile afterwards; e-signatures capture identity, timestamp and meaning of signature; and calibration certificates, due dates and reminders are tracked per probe with calibration status carried into every report.

What we will not tell you is that buying software makes a site compliant. It does not. In regulated use, the operating company owns the validation conclusion for its computerised systems — the vendor's job is to make that conclusion defensible with protocols, testable controls and documented behaviour.

If you are behind, start here

Ninety days of focused work covers most of the distance:

1. Inventory your GxP computerised systems. Everything that generates, holds or transforms a record supporting product quality. Most sites are surprised by the length of the list once spreadsheets and standalone loggers are included.
2. Risk-assess them. Which ones, if wrong, could let bad product reach a patient? Those are the ones to fix first, and the documented assessment is itself an expectation.
3. Close the attribution gaps. Individual logins, no shared accounts, MFA on anything administrative. This is cheap and highly visible to an inspector.
4. Turn on and start reviewing audit trails. Put the review in an SOP with a periodicity and a signature.
5. Reconcile your calibration register. Any instrument generating GMP data needs a current, traceable certificate. Find the expired ones now.
6. Bring set points and limits under change control. Retrospectively document the ones you can justify; correct the ones you cannot.
7. Write the validation summary you are missing. For each critical system, the protocol, the executed tests and the conclusion — on your configuration.

None of that requires civil works. All of it will be asked about.

---

This is practical engineering guidance, not legal or regulatory advice. Confirm the current requirements and timelines applicable to your licence with CDSCO and your state licensing authority.

If you want to walk through how a monitoring record stands up to these seven questions, talk to our engineers — or see how the controls are structured on the Abhilekh compliance page and the validation support page.