GMP, ISO, FDA, and BIS Compliance in India: What Every Manufacturer Needs to Know

Introduction:

India is considered one of the biggest manufacturers in the world, occupying third place in pharmaceuticals and second place in generic drugs. India is also strong in manufacturing medical equipment, electronics, food processing, and automotive components. All these industries have many complexities that make manufacturers ensure compliance with national standards of Bureau of Indian Standards and Central Drugs Standard Control Organization as well as international standards such as ISO, US FDA, and EU GMP.

The consequences of non-compliance are drastic because there might be an issue like import alert by US FDA, factory closures by BIS based on the provisions of BIS Act 2016, or contract losses because of non-conformity with ISO standards.

Drawing from our experience in IMARC Engineering, we developed a guide to help you deal with GMP, ISO, FDA, and BIS compliance issues in all their diversity.

Who This Guide is For: This manual has been prepared to assist manufacturing executives, quality assurance staff, regulatory affairs staff, project engineers, and investors involved in assessing manufacturing processes in the country for the pharma, medical devices, food and beverages, electronic goods, automotive, and heavy industries sectors. The compliance systems like GMP, ISO, FDA, and BIS, cover more than one industry sector, and the comprehensive compliance approach applies universally irrespective of which system you follow.

Table of Contents:

• Introduction
• Section 1: Understanding the Indian Regulatory Compliance Landscape
• Section 2: GMP Compliance- Standards, Requirements, and Implementation
• Section 3: ISO Certification- Which Standards Apply to Your Manufacturing Operation
• Section 4: FDA Compliance for Indian Manufacturers
• Section 5: BIS Certification- India's Domestic Mandatory Compliance Framework
• Section 6: Integrated Compliance Strategy- Managing Multiple Standards Simultaneously
• Section 7: The Compliance Implementation Process- A Step-by-Step Framework
• Section 8: Latest Trends in Manufacturing Compliance (2025–2026)
• Conclusion

Section 1: Understanding the Indian Regulatory Compliance Landscape

1.1 The Multi-Layered Regulatory Structure

Indian manufacturing compliance operates across three levels: central regulations, state-level requirements, and international standards. These layers are additive, making it essential to understand how they interact when developing a compliance strategy.

At the central level, key authorities include the Bureau of Indian Standards (product certification), Central Drugs Standard Control Organization (pharmaceuticals and medical devices), Food Safety and Standards Authority of India (food), and Ministry of Electronics and Information Technology (electronics compliance). Each has distinct certification processes, timelines, and enforcement mechanisms.

For export markets, manufacturers must also meet international regulatory requirements. In the United States, this includes US FDA compliance across pharmaceuticals, medical devices, and food. In Europe, EU GMP standards and CE marking are required. Additionally, global supply chains increasingly mandate ISO certifications such as ISO 9001, ISO 13485, and ISO 22000.

Together, these overlapping frameworks create a complex compliance environment where domestic and international obligations must be managed simultaneously to ensure market access and operational continuity.

1.2 The Financial Stakes of Compliance- and Non-Compliance

Table 1: Cost of Non-Compliance vs. Cost of Proactive Compliance- India Manufacturing Context

1.3 Compliance as a Competitive Advantage

Most advanced Indian manufacturers have transcended the point of regarding compliance as either cost or as a form of risk to manage. They have redefined compliance in terms of their competitive edge. A pharma unit with existing FDA and WHO-GMP compliance enjoys a significant price advantage over those without FDA and WHO-GMP compliance as its products enjoy quality assurance in the export markets. An Indian food manufacturer, certified under FSSC 22000 enjoys the edge as it can enter into agreements with international chains of retail stores who demand such compliance as a prerequisite for inclusion in their listings. An Indian medical equipment manufacturer with ISO 13485 and CE certification enjoys access to markets in Europe that are closed for all non-certified manufacturers.

In such cases, any expenditure on compliance is not considered an overhead but rather a form of investment to secure market access. In line with this principle, IMARC employs the Total Cost of Ownership approach to assess the compliance challenge.

Section 2: GMP Compliance- Standards, Requirements, and Implementation

2.1 What is GMP and Why Does It Matter for Indian Manufacturers?

Good Manufacturing Practice (GMP) is a regulatory standard that prescribes the standards that should be met by facilities where manufacturing of pharmaceutical drugs, medical devices, food products, cosmetics, and other regulated products take place. GMP regulations have several variations, such as WHO-GMP, EU GMP, US cGMP, Schedule M (the national GMP regulation in India), and others, each of which includes special rules for the layout of production facilities, equipment qualification, staff training, documentation, and quality assurance systems.

As far as Indian manufacturers go, there are two distinct contexts when GMP is applicable. Domestically, GMP standards can be found in Schedule M of the Drugs and Cosmetics Act, which applies to all licensed pharmaceutical drug manufacturers. The Schedule has been amended recently (in 2023), and the new version brings Indian requirements close to WHO-GMP in many ways (layout of production facilities, HVAC, cleanroom classes, water systems, and documentation). As far as exports are concerned, GMP regulation applicable will depend on the requirements of the country's regulators, such as WHO-GMP for the developing world, EU GMP for Europe, and US cGMP for the USA.

2.2 GMP Standards Comparison- What Each Requires

Table 2: GMP Standards Comparison- Key Requirements Across Major Frameworks

2.3 The Revised Schedule M: What Changed in 2023 and What It Means for Manufacturers

The 2023 revision of Schedule M under the Drugs and Cosmetics Act, 1940 is the most significant upgrade to India’s GMP framework in two decades, with direct implications for facility design and compliance systems. Cleanroom classifications are now aligned with EU GMP Annex 1 and ISO 14644-1, introducing stricter controls on particulate and microbial limits. HVAC requirements have been strengthened with tighter specifications for air change rates, pressure differentials, and environmental control, while water systems for Purified Water and WFI must meet updated pharmacopeial and loop design standards. Data integrity requirements now formally adopt ALCOA and ALCOA+ principles, making retrospective data entry and paper-based gaps non-compliant. As a result, electronic systems such as LIMS and electronic batch records are increasingly essential. For manufacturers already aligned with WHO or EU GMP, the transition is incremental, while others face substantial upgrades in systems, documentation, and facility design to meet the revised standards.

2.4 GMP Implementation Roadmap

The process of implementing GMP has a systematic approach where each phase begins with a gap analysis based on the appropriate GMP standard, followed by designing or modifying facilities to comply with physical requirements, equipment qualification (IQ/OQ/PQ), system validation (Cleaning Validation, Process Validation, Computer System Validation), SOP creation, documentation system development, staff training, and internal audit before regulatory inspection. IMARC Engineering provides support in all stages of GMP implementation, from conducting gap analysis and designing facilities to qualifying and validating systems and preparing for inspections.

Section 3: ISO Certification- Which Standards Apply to Your Manufacturing Operation

3.1 The ISO Standards Landscape for Indian Manufacturers

ISO has set up over 24,000 standards, among which only those pertaining to management system standards become relevant for the manufacturing industry. An ISO certification process does not become a legal requirement in India; however, it becomes practically necessary for all manufacturers who export products to multinational companies, participate in tendering processes conducted by the government, or supply to markets where an ISO certification process becomes a procurement criterion. Knowing the applicable standards for an organization and their relationships forms the basis of ISO compliance.

Table 3: Key ISO Standards for Indian Manufacturers: Applicability by Sector

3.2 ISO 9001:2015- The Foundation Standard

ISO 9001:2015 is the world’s most widely adopted quality management standard, used by over one million organizations globally. For Indian manufacturers, it provides a structured framework for process improvement and defect reduction, signals quality credibility to customers, supports eligibility for government and PSU tenders, and forms the foundation for sector-specific standards such as ISO 13485 and IATF 16949. The 2015 revision introduced a risk-based thinking approach, replacing prescriptive documentation requirements with a focus on identifying risks and opportunities, planning mitigation actions, and demonstrating effectiveness. This allows greater flexibility in implementation, but requires manufacturers to adopt a more strategic, outcome-oriented approach to quality system design and performance management.

3.3 ISO 13485:2016- Medical Device Quality Management

ISO 13485:2016 is the primary global QMS standard for medical device manufacturers and is required for CE marking, MDSAP participation, and recognized by regulators such as the US FDA. In India, under the Medical Devices Rules 2017 of the Drugs and Cosmetics Act, 1940, Class B, C, and D devices require a full QMS, with ISO 13485 as the accepted framework. ISO 13485 is more prescriptive than ISO 9001, with detailed documentation requirements, robust design and development controls, post-market surveillance obligations, and integrated risk management aligned with ISO 14971. For contract manufacturers, certain design controls may be excluded, but such exclusions must be formally justified and documented within the QMS scope.

3.4 Managing Multiple ISO Certifications Efficiently

Many Indian manufacturers maintain multiple ISO certifications, commonly combining ISO 9001:2015 with ISO 14001 and ISO 45001 as an Integrated Management System (IMS), or pairing ISO 13485 with ISO 9001 for mixed product portfolios. The introduction of the High-Level Structure (HLS) in recent ISO revisions enables alignment across standards, simplifying implementation. An IMS integrates quality, environmental, and health & safety requirements under a single framework with unified procedures, audits, and management reviews. This reduces compliance effort while improving system consistency, efficiency, and overall governance across manufacturing operations.

Section 4: FDA Compliance for Indian Manufacturers

4.1 Why US FDA Compliance Matters for Indian Manufacturers

The United States is the world’s largest pharmaceutical market and a key destination for Indian exports across pharmaceuticals, medical devices, and food products. India supplies nearly 40% of generic drugs in the US, making compliance with the U.S. Food and Drug Administration a fundamental business requirement. FDA enforcement has been consistently rigorous, with Warning Letters, Import Alerts, and Consent Decrees issued to major Indian manufacturers, leading to significant revenue loss and operational restructuring. For companies targeting the US market, a clear understanding of FDA expectations and common compliance gaps is essential to ensure sustained market access and regulatory success.

4.2 US FDA Requirements by Product Category

Table 4: US FDA Regulatory Requirements- Key Frameworks for Indian Manufacturers

4.3 Data Integrity- The Most Critical FDA Compliance Requirement

Data integrity is the most frequent observation in inspections by the U.S. Food and Drug Administration, particularly for Indian pharmaceutical manufacturers. Under 21 CFR Part 11 and cGMP, all data must meet ALCOA+ principles, attributable, legible, contemporaneous, original, and accurate, making any alteration, backdating, or selective reporting a violation. Common issues include repeated testing until passing results, unofficial record-keeping, disabled audit trails, and shared system access. While often driven by weak quality culture or poor system design, the FDA treats all such lapses seriously. Effective remediation requires more than technology upgrades; it demands cultural and procedural change across workflows, training, oversight, and audit systems. IMARC Engineering supports data integrity gap assessments, remediation planning, and implementation of compliant electronic record systems.

4.4 Navigating FDA Import Alerts and Warning Letters

An FDA Import Alert places a facility under detention without physical examination (DWPE), effectively blocking exports to the US until compliance issues are resolved. Resolution timelines typically range from 18 months to over five years, depending on the severity of violations and remediation effectiveness. A Warning Letter signals serious compliance concerns and can escalate to Import Alerts, Consent Decrees, or enforcement actions if not addressed. Manufacturers must submit a detailed response within 15 business days and implement a sustained remediation programme, requiring strong regulatory expertise to ensure successful resolution.

Critical Action Point: If your facility has received an FDA 483 Observation, Warning Letter, or Import Alert, the most important first step is to engage experienced regulatory affairs support immediately. The response timeline is short, the consequences of an inadequate response are severe, and the complexity of the FDA's expectations for remediation documentation is significant. IMARC Engineering's regulatory affairs team has experience supporting Indian manufacturers through FDA inspection response and remediation programmes.

Section 5: BIS Certification- India's Domestic Mandatory Compliance Framework

5.1 What Is BIS and Why Does It Matter?

The Bureau of Indian Standards (BIS) is India's national standards body, established under the BIS Act 2016, and is the primary domestic product certification agency for consumer and industrial products in India. BIS operates several schemes that are relevant to manufacturers: the Product Certification Scheme (IS Mark), under which manufacturers certify that their products conform to Indian Standards; the Compulsory Registration Scheme (CRS), under which electronic and IT products must self-certify conformity to safety standards; the Foreign Manufacturer Certification Scheme (FMCS), under which overseas manufacturers obtain BIS certification for products imported into India; and the Management System Certification Scheme, under which BIS certifies quality management systems.

The critical point for Indian manufacturers is that BIS certification is not always optional. Under the Quality Control Orders (QCOs) issued by the central government, a rapidly expanding list of products, spanning electronics, electricals, chemicals, construction materials, textiles, toys, and food contact materials are mandatorily required to carry the BIS ISI Mark. Selling, importing, or distributing products covered by a QCO without valid BIS certification is a criminal offence under the BIS Act 2016, carrying penalties of up to two years imprisonment and fines of up to INR 2 lakh for individuals, and INR 10 lakh for companies. The enforcement of these provisions has intensified significantly since 2020, with market surveillance operations, test purchases, and facility raids becoming more frequent.

5.2 Products Currently Under Mandatory BIS Certification (QCO Coverage)

Table 5: Key Product Categories Under Mandatory BIS QCO- Current Coverage (2026)

5.3 The BIS Certification Process- Step by Step

The BIS certification process under the IS Mark scheme begins with identifying the applicable standard and conducting a gap assessment, followed by application through the BIS portal with product samples and documentation. The Bureau of Indian Standards then conducts factory inspection and product testing via approved laboratories. If compliant, a licence is granted, subject to periodic surveillance and renewal. Timelines typically range from 3–6 months for straightforward cases to 9–18 months for complex or non-compliant facilities. A common challenge is inadequate quality documentation during inspection. Facilities must demonstrate robust systems for material inspection, process control, testing, and corrective actions. Those aligned with ISO 9001:2015 are better positioned, while weaker systems often face delays due to non-conformities.

5.4 BIS and the Foreign Manufacturer Certification Scheme (FMCS)

Overseas manufacturers exporting products to India under mandatory BIS QCOs must obtain certification through the Foreign Manufacturer Certification Scheme. The process mirrors the domestic IS Mark scheme but includes factory inspection by Bureau of Indian Standards officials at the overseas facility, increasing cost and timelines. Indian importers are legally responsible for ensuring suppliers hold valid BIS certification, extending compliance obligations to procurement and supply chain management, not just manufacturing.

Section 6: Integrated Compliance Strategy- Managing Multiple Standards Simultaneously

6.1 The Integration Imperative

Most Indian manufacturers serving multiple markets must comply with overlapping frameworks, including Schedule M, WHO-GMP, US FDA cGMP, EU GMP, ISO 9001, and state-level regulations. Managing these separately creates inefficiencies, inconsistent documentation, and increased risk of cross-framework non-compliance. An integrated compliance strategy aligns all requirements into a single system, implementing common elements to the highest applicable standard and structuring documentation to satisfy multiple regulators such as Central Drugs Standard Control Organization and U.S. Food and Drug Administration. This approach reduces complexity, lowers compliance costs, and strengthens overall regulatory robustness.

6.2 Compliance Framework Overlap Analysis

Table 6: Common Requirements Across GMP, ISO, FDA, and BIS Frameworks

The overlap analysis in the Table reveals that a well-designed quality management system can simultaneously satisfy the documentation, training, non-conformance management, internal audit, supplier control, product testing, and complaint handling requirements of all four frameworks. The differentiating requirements such as US FDA data integrity requirements under 21 CFR Part 11, or the specific IS Standard technical requirements under BIS, can be layered as extensions on top of this common foundation rather than built as separate systems.

6.3 Building an Integrated Compliance Management System

The practical steps to building an integrated compliance management system begin with a cross-framework gap assessment: identifying which requirements of each applicable standard are currently met, which are partially met, and which are absent. The gap assessment output is a prioritized remediation plan that addresses the highest-risk gaps first and sequences investments to achieve the highest-priority compliance milestones (typically the standards required for imminent regulatory inspection or customer audit) before addressing lower-priority gaps. The architecture of the integrated system should be built on the ISO high level structure (HLS), which provides a common framework for all ISO management system standards, supplemented with the additional requirements of GMP, FDA, and BIS frameworks as defined modules. This creates a compliance management system that is both internally coherent and externally defensible to multiple auditors because it is built to a recognized international framework with clearly documented adaptations for each specific regulatory requirement.

Section 7: The Compliance Implementation Process- A Step-by-Step Framework

7.1 IMARC's Five-Phase Compliance Implementation Methodology

Phase 1: Regulatory Mapping and Gap Assessment

The starting point of any compliance programme is a clear identification of which regulatory frameworks apply to the specific products, markets, and manufacturing processes involved. This is not always as straightforward as it appears: product classification can be contested (is a product a drug, a medical device, or a combination product?), market-specific requirements can vary from the headline standard (US FDA requirements for API manufacturers differ from those for finished dose manufacturers), and the intersection of domestic and international requirements creates compliance obligations that are not always obvious from reading either standard in isolation. Phase 1 produces a regulatory map and a prioritized gap assessment that becomes the master reference for the entire compliance programme.

Phase 2: Facility Design and Infrastructure Remediation

GMP, BIS, and FDA compliance all have facility design implications, and the cost of remediation is substantially higher if facility non-conformities are addressed after construction than if they are designed correctly from the outset. Phase 2 addresses the physical infrastructure requirements of compliance: cleanroom design and classification, HVAC system specification, utility systems (purified water, WFI, clean steam, compressed gases), laboratory design and equipment specification, material and personnel flow layout, and building materials and surface finish requirements. For new facilities, IMARC integrates compliance requirements into the detailed engineering design. For existing facilities, IMARC conducts a facility compliance audit and develops a remediation specification.

Phase 3: Quality System Design and Documentation

The quality management system, the documented policies, procedures, instructions, and records that define how the manufacturing operation achieves and maintains compliance, is the backbone of regulatory compliance. Phase 3 develops or remediates the quality system to the required standard, covering: the quality manual and policy framework; standard operating procedures for all critical processes; batch manufacturing records and batch testing records; change control, deviation, CAPA, and complaint handling systems; validation master plan and validation protocols; and training management system. For clients implementing electronic quality management systems, IMARC supports system selection, configuration, and validation.

Phase 4: Qualification, Validation, and Testing

Equipment and process validation is a regulatory requirement under GMP, FDA, and for certain product types, BIS frameworks. Phase 4 executes the qualification and validation activities defined in the validation master plan: Installation Qualification (IQ), Operational Qualification (OQ), and Performance Qualification (PQ) for critical equipment and utilities; cleaning validation; process validation for manufacturing processes; analytical method validation for QC laboratory methods; and computer system validation for LIMS, ERP, and electronic batch record systems. Qualification and validation activities generate the documentary evidence that regulators review to confirm that the manufacturing process reliably produces product of the required quality.

Phase 5: Audit Readiness and Regulatory Submission Support

The final phase of compliance implementation prepares the facility and its people for regulatory inspection. This includes: pre-inspection mock audits conducted by external experts who apply the inspection methodology of the target regulator (US FDA QSIT for device inspections, WHO-GMP audit protocols for prequalification inspections); training for all staff in inspection management, how to respond to inspector questions, how to retrieve documentation, how to handle a 483 observation during an ongoing inspection; and regulatory submission support for approvals, registrations, or certifications that must be obtained before market access is granted. IMARC provides inspection readiness support including mock inspections conducted by former regulatory inspectors with direct experience of the target regulatory body's approach.

Section 8: Latest Trends in Manufacturing Compliance (2025–2026)

Revised Schedule M: Full Implementation Deadline Pressure

India's revised Schedule M, notified in late 2023, has placed all licensed pharmaceutical manufacturers on a defined compliance timeline. Large manufacturers were expected to achieve compliance within one year of notification; small and medium manufacturers within two years. As the compliance deadlines pass, CDSCO enforcement activity has intensified, with increased frequency of state Drug Authority inspections and a rising number of show-cause notices and licence suspension actions. Manufacturers who have not yet completed their revised Schedule M compliance programme face significant regulatory risk.

BIS QCO Expansion Continuing at Pace

The Government of India's Quality Control Order programme has continued to expand rapidly, with new QCOs issued or expanded for agricultural machinery, chemical products, construction materials, and consumer goods in 2024–2025. The trend reflects a deliberate industrial policy objective to raise product quality standards across the domestic market and reduce competition from low-quality imports. Manufacturers in any sector should proactively monitor QCO notifications applicable to their product categories, as the time available between QCO notification and mandatory compliance is typically 6–18 months, often insufficient for manufacturers who begin preparation only after the notification.

US FDA Intensifying Focus on Indian API and Sterile Manufacturers

The US FDA has maintained an intensive inspection programme for Indian pharmaceutical manufacturers, with particular focus on active pharmaceutical ingredient (API) facilities and sterile manufacturing sites. The FDA's enforcement actions have increasingly targeted systemic quality culture issues, not just procedural non-conformities, reflecting the agency's view that Warning Letters and Import Alerts alone are insufficient to drive lasting compliance improvement. Manufacturers should expect continued rigour in FDA inspections and should invest in quality culture development, not just quality system documentation.

EU MDR and IVDR Full Enforcement Creating Device Compliance Pressure

The EU Medical Device Regulation (MDR) and In-Vitro Diagnostic Regulation (IVDR) have created significant compliance pressure for Indian medical device exporters. The transition from legacy CE certificates under the EU MDD to full EU MDR conformity assessment has required substantial investment in Technical Documentation, Post-Market Surveillance systems, and Notified Body engagement. Indian manufacturers who did not proactively complete this transition have found themselves without valid CE marking and therefore unable to supply the EU market, a market access gap that has benefited competitors who moved earlier.

Digital Compliance Tools Gaining Adoption

Electronic Quality Management Systems (eQMS), Laboratory Information Management Systems (LIMS), and cloud-based compliance management platforms are seeing accelerating adoption among Indian manufacturers, driven in part by regulatory requirements for electronic audit trails and data integrity, and in part by the operational efficiency gains that digital quality management delivers over paper-based systems. Key capabilities now available in cloud-based platforms include automated deviation and CAPA management, electronic batch records with real-time production monitoring integration, supplier qualification portals, and regulatory intelligence feeds that alert manufacturers to relevant standard revisions and QCO notifications.

Sustainability Compliance Emerging as New Dimension

Environmental compliance is emerging as a significant new dimension of manufacturing compliance in India, driven by both domestic regulatory tightening (through Environment Protection Act amendments and state-level enforcement intensification) and international supply chain requirements. The EU's Corporate Sustainability Due Diligence Directive (CSDDD), which places obligations on European companies to ensure environmental compliance throughout their supply chains, will increasingly translate into audit and documentation requirements imposed by European customers on their Indian suppliers.

Conclusion

GMP, ISO, FDA, and BIS compliance in India is a multi-dimensional challenge spanning facility design, quality systems, documentation, and organisational culture. Successful manufacturers adopt a strategic approach, aligning applicable standards, integrating compliance systems, and investing proactively to build long-term capability rather than reacting to audits. The cost of non-compliance, including lost market access, recalls, and regulatory actions from bodies like U.S. Food and Drug Administration and Bureau of Indian Standards, far exceeds proactive investment. Compliance delivers measurable business value through successful inspections, certifications, and expanded market access.

As regulatory expectations rise across India and global markets, manufacturers with strong, integrated compliance frameworks will gain competitive advantage, while others face increasing risk and commercial pressure.