Revised Schedule M requires Indian pharmaceutical manufacturers to validate every GMP-related computerised system, control access, keep a record of every change to data, check critical manual entries and back up records. For automation, that means PLC, HMI, SCADA and batch systems on GMP equipment must be specified, tested, documented and kept in a validated state, not just made to run.
The new Schedule M came through G.S.R. 922(E) of 28 December 2023, published by CDSCO. It gave large manufacturers (turnover above ₹250 crore) six months and smaller ones twelve months to comply. A later amendment let small and medium firms that applied with an upgrade plan extend the deadline to 31 December 2025, as the Pharmexcil circular of February 2025 explains. For most plants the question is no longer when, but whether the automation on the floor can stand up to an inspector.
What revised Schedule M says about computerised systems
Clause 20 of the revised Schedule M covers computerised systems. In plain terms, the requirements that land on automation engineers are:
- Validation (20.1, 20.2). GMP systems must be validated, with depth set by complexity and criticality, and hardware and software need installation and operational qualification.
- Access and change records (20.4). Controls against unauthorised access or changes, and a record of each change that keeps the previous entry, who changed it and when.
- Second check on manual entries (20.6). Critical data typed in by hand needs independent verification.
- Change control (20.8). System changes must be authorised, documented and tested so the system stays validated.
- Backup (20.9). Records must be protected against permanent loss.
Exporters will recognise the pattern. US 21 CFR Part 11 asks for system validation, limited access and secure, time-stamped audit trails, and the ISPE GAMP 5 Guide, Second Edition (July 2022) is the usual method for scaling validation effort by risk.
What this means on the shop floor
Machine HMIs and PLCs
Many older machines in Indian plants have HMIs with a single shared password, recipe parameters anyone can change, and alarms that vanish when acknowledged. Under revised Schedule M those are findings. Fixes range from a firmware or HMI upgrade with named users and an audit trail, to moving critical parameters into a validated SCADA or batch layer.
SCADA and batch control
A validated SCADA layer can give named logins with password rules, electronic records of parameter changes, alarm and event logs, and reports tied to batch numbers. Structuring batch logic to ISA-88 keeps recipes separate from equipment logic, which makes later change control far easier.
Siemens SIMATIC Batch Overview by Gray Solutions
Siemens Knowledge Hub
This video is hosted on YouTube. Playing it loads content from Google, which may set cookies.
Watch on YouTubeA practical compliance plan for automation
- Inventory. List every computerised system touching GMP: machine PLCs and HMIs, SCADA, data loggers, building management for cleanrooms.
- Classify by risk. Use GAMP 5 categories and product impact to decide validation depth. Not every conveyor PLC needs the same file as a granulator.
- Gap assessment. For each system check access control, audit trail, backup, time sync and change control against Clause 20.
- Remediate. Upgrade, replace or wrap with a validated SCADA layer, starting with the highest-risk gaps.
- Validate. Write user requirements, then IQ, OQ and PQ protocols. Test against the requirements, not against what the system happens to do.
- Keep it validated. Change control, periodic review and backup restore tests on a schedule.
Building new lines right first time
Pharma has been one of the strongest PLI sectors. A PIB explainer from August 2025 reported pharma PLI sales crossing ₹2.66 lakh crore in the first three years, including ₹1.70 lakh crore of exports. New lines are far cheaper to make compliant at design stage. Put Clause 20 and Part 11 requirements into the user requirement specification for every machine, insist on vendor documentation packages, and test the control system against a simulated process before IQ starts.
| Requirement | Design-stage answer |
|---|---|
| Access control | Named users, role levels, central user management |
| Audit trail | Enabled by default, reviewed per batch |
| Backup | Automatic, off-machine, restore tested |
| Change control | Version-controlled PLC and HMI projects |
| Time sync | All PCs and controllers on one time source |
Do not forget utilities and cleanroom systems
Teams often focus on process machines and miss the systems around them. Cleanroom HVAC controls that hold pressure cascades, temperature and humidity monitoring in warehouses, purified water and WFI generation, and compressed air dew-point monitoring all produce GMP data. If an inspector asks for the differential pressure history of a Grade C room during a batch, it must come from a system with the same controls as your batch records.
Older building management systems in Indian plants were often installed as facilities equipment, with no validation and shared logins. Bringing them under the same access, audit trail and backup rules is usually cheaper than it sounds, because the hardware can stay and only the software layer and procedures change. Plan it in the same gap assessment as the process equipment so you do not run two separate projects.
How Wartens supports pharma plants
Pharmaceuticals is one of the industries we serve from our Bengaluru engineering centre. On new and expanding plants we deliver turnkey automation, covering design, PLC and SCADA programming, panel build coordination and commissioning. Your QA team and validation consultant own the validation strategy. We engineer the systems so they can pass it, and we supply the design and test documentation to support it. See our automation engineering services, read about testing lines virtually before equipment arrives, or talk to our team about a gap assessment of your line controls.
