The Schedule M Grace Period Is Over. Is Your Lab Actually Ready for an Inspection?

For over a year, “we’re working on it” was an acceptable answer. It isn’t anymore.

The one-year grace period given to India’s MSME pharmaceutical manufacturers to comply with the revised Schedule M GMP norms ended on December 31, 2025. CDSCO has since directed state drug regulators to begin inspections — and to take action against units that haven’t complied, whether or not they applied for the extension.

Of the roughly 8,500 MSME pharma units covered by the revised norms, only around 1,600–1,700 are reported to have formally applied for the extension in the first place. That means a large share of small and mid-size manufacturers, CROs, and QC labs across India are currently sitting in a regulatory blind spot — technically inspectable, and not necessarily ready.

If you run quality at one of these labs, the question isn’t “when will inspections start.” They’ve started. The real question is: if an inspector walked in tomorrow, what would they actually find?

What inspectors are actually checking for

Revised Schedule M isn’t just about facilities and equipment. A large share of it comes down to whether your quality management system can prove itself — on paper or on screen. In practice, inspectors are focused on:

• Data integrity (ALCOA+) — is every record Attributable, Legible, Contemporaneous, Original, and Accurate, with a real audit trail behind it?
• Calibration status — can you show, instantly, which instruments are current, which are overdue, and what happened the last time one drifted out of tolerance?
• CAPA effectiveness — not just that a corrective action was logged, but that someone verified it actually worked.
• Validation documentation — IQ/OQ/PQ records that are complete, signed, and traceable, not scattered across binders.
• Change control and deviation history — a clear, timestamped chain from incident to resolution.

None of this is new information. What’s changed is that “we’ll clean it up before the audit” no longer works, because inspections are no longer scheduled around your convenience.

The three ways MSME labs usually fail this — quietly

1. 1Spreadsheets pretending to be systems. Excel trackers for calibration and QC don’t generate the kind of audit trail 21 CFR Part 11 or Schedule M actually expects. They can be edited without a trace, which is precisely the finding auditors are trained to look for.
2. 2CAPA that closes but was never verified. A logged corrective action isn’t the same as a proven one. If there’s no documented effectiveness check, an inspector will treat it as incomplete — because it is.
3. 3Calibration records that live in someone’s memory. “We know which instruments are due” isn’t a system. It’s a liability the moment that person is on leave during an inspection.

A 5-question gut check

Before your next audit — internal or regulatory — ask your QA team these, out loud, right now:

1. 1Can you produce a complete, tamper-evident audit trail for the last 90 days, in under five minutes?
2. 2Do you know which instruments are overdue for calibration right now, without checking three different sheets?
3. 3For your last five CAPAs, can you show documented proof they actually worked — not just that they were closed?
4. 4If a regulator asked for your IQ/OQ/PQ protocols for a specific piece of equipment today, how long would it take to find them?
5. 5Could someone outside your QA team reconstruct exactly what happened on any given day, from your records alone?

Where ValiCore fits

This is exactly the gap ValiCore was built to close — not by replacing your team’s judgment, but by making the paper trail as solid as the work itself. Digital calibration tracking with e-signed history, CAPA workflows that require an effectiveness check before closure, and an immutable, timestamped audit log across every module, so “can you prove it” has a fast, honest answer.

It’s 35 working modules across calibration, QC, deviations, validation, batch records, and audit trails — built specifically around 21 CFR Part 11, Schedule M, ISO 15189, and WHO-GMP requirements, with a 14-day go-live guarantee: setup, training, and support included, not billed separately.

Enforcement isn’t a future risk anymore. It’s the current one.