AI’s Indian API suppliers, checked against the regulators

01 / 08Summary

A buyer who needs an active pharmaceutical ingredient (API) from India can now ask an AI answer engine for suppliers and get a shortlist with certifications attached. We asked ChatGPT, Perplexity, Gemini and Google AI Mode 50 sourcing questions about 25 widely traded APIs, from India and from the United States, and then checked what came back: 352 named companies and 1,483 certification claims, against the FDA, India’s drug regulator CDSCO, the EU’s GMP database and the companies’ own websites.

Most claims checked out. The ones that did not were concentrated in one certificate, and the sources behind the answers were mostly directories rather than the suppliers themselves.

02 / 08Why this matters

India supplies a large share of the world’s generic APIs, and finding a qualified supplier has always meant work: directories, trade fairs, audits, regulatory filings. An answer engine compresses the first step into one paragraph. If that paragraph says a supplier is “WHO-GMP certified” or “USFDA approved”, a buyer may treat it as a starting fact.

Certification claims are checkable. Regulators publish who holds what. We wanted to know how often the claims in AI answers match those records, and where the engines get their supplier lists.¹

When an AI answer called an Indian supplier WHO-GMP certified, it matched the regulator’s list about half the time.

Study 006, Finding 2

03 / 08Method

We wrote two questions for each of 25 APIs. One asked plainly for a manufacturer to contact. The other asked for certified suppliers: WHO-GMP for odd-numbered APIs on our list, USFDA for even-numbered ones.² Each question went to four engines, once from India and once from the United States, in a fresh session.³

Questions

5025 APIs × 2 phrasings

Answers

40050 questions × 4 engines × 2 markets, 1 run

Companies checked

3522,877 mentions in 399 answers

Claims checked

1,483WHO-GMP, USFDA and EU-GMP, in 306 answers

Engines

ChatGPT (search on), Perplexity, Gemini, Google AI Mode

Fieldwork

5 October 2026; India and the United States, set at the network level

What we counted

A mention is a company named in the answer text, counted once per answer, matched against a hand-curated dictionary of 354 companies and their aliases. A citation is a URL the engine presented as a source, counted once per answer. A claim is an answer attributing WHO-GMP, USFDA (approval, inspection, registration or a US DMF) or EU-GMP (EU inspection, EDQM or a CEP) to one named company in the same list item, table row or sentence. Hedged wording (“verify whether …”) and statements about many firms at once were not counted.⁴

How we checked

Every company was looked up on its own website and in five regulator sources, downloaded on 5 October 2026: the FDA’s Drug Master File list, FDA Import Alert 66-40, CDSCO’s two most recent lists of WHO-GMP certified units, the EDQM certificate database and all 1,056 EudraGMDP records for sites in India.⁵ Each claim was then coded as supported by a regulator record, supported only by the company’s own website, contradicted by a regulator record, or not found.⁶ A blind second coding of a random 53 companies (15%) agreed with the first on whether a website existed for 51 (96.2%), on whether the company makes APIs for 49 (92.5%), on API listings in 96 of 98 cases (98.0%) and on certification statements in 149 of 159 (93.7%).

Disclosure: some brands that appear in this study are clients of Citation Research. Their results were produced by the same questions, engines and rules as every other brand’s.

04 / 08Findings

1. Most claims hold up; nearly a quarter rest on less

The engines made 1,483 certification claims, and 306 of the 400 answers (76.5%) contained at least one. Of those claims, 1,151 (77.6%) matched a current regulator record. Another 199 (13.4%) were supported only by the company’s own website. The remaining 133 (9.0%) found no support in any source we checked, and 10 of those conflicted with a regulator record. In all, 95 answers (23.8% of 400) carried at least one claim we could not support.

USFDA support was checked at company level. Of the 583 USFDA claims that matched an active DMF, 434 (74.4%) matched a DMF for the very API the buyer asked about.⁷

2. WHO-GMP is where claims thin out

The three certificates did not behave alike. Nine in ten USFDA claims matched an active Drug Master File. Only 263 of 484 WHO-GMP claims (54.3%) matched a company on CDSCO’s published lists; 156 (32.2%) rested on the company’s own website alone and 65 (13.4%) had no support we could find.

3. Directories, not suppliers, supplied the sources

The 400 answers cited 6,873 sources. Supplier directories and B2B marketplaces accounted for 2,938 of them (42.7%), more than the 2,632 (38.3%) that pointed to pharmaceutical companies’ own sites. A single directory, PharmaCompass, provided 1,495 citations (21.8%), and Pharmaoffer another 680 (9.9%). Directories appeared in 367 of the 400 answers (91.8%). Regulator and reference pages made up 11.9%; 801 of those 816 citations were in ChatGPT’s answers.

The engines differed sharply. Perplexity drew 76.7% of its citations from directories; Gemini drew 70.6% from company sites. ChatGPT cited far more sources per answer than the others (45.5 against 3.9 to 10.0) and was the only engine that regularly cited the FDA and CDSCO.

4. Not every named “manufacturer” makes the API

We asked for manufacturers. Of the 352 companies named, 199 (56.5%) describe API manufacturing on their own website. The rest describe themselves as traders or exporters (64), makers of finished medicines only (49), service firms or directories (5), or no longer operate under the name (5); for 30 we could not tell. Weighted by how often they were named, 607 of 2,877 mentions (21.1%) went to companies whose own sites do not say they make APIs.

The product match was looser still. Across 956 company–API pairs, the company’s own site or a regulator filing confirmed it offers that API in 502 cases (52.5%). In 322 (33.7%) its site did not list the API and it held no DMF or CEP for it. The rest could not be settled (82) or concerned a company with no website (50).

Most companies were traceable. Of 352, 309 had a website of their own and another 31 appeared in a regulator record or a business directory. 43 (12.2%) had no website we could find, and 12 (3.4%) left no trace in any source we checked.⁸

The engines leaned on supplier directories more than on the suppliers.

Study 006, Finding 3

5. Where you ask from changes who you hear about

Every question named India, yet the location of the request still mattered. For each question and engine we compared the companies named from India with those named from the United States.⁹ On average the two lists shared 53.3% of their companies; 86 of 200 pairs (43.0%) shared fewer than half, and only 18 (9.0%) were identical. Across all answers, 71 companies appeared only in US-located answers and 48 only in Indian ones.

By engine

Google AI Mode made the most claims (602) and Perplexity the fewest (66), but almost half of Perplexity’s claims (47.0%) had no regulator record behind them. Gemini most often told the buyer to verify certificates (70 of 100 answers); across all engines 189 of 400 answers (47.2%) did.

05 / 08What it means

For buyers, an AI shortlist is a starting point that still needs the usual checks. For suppliers, the findings point to where the engines look.

1. Your directory profiles are your AI profile.Directories supplied more citations than company sites. A stale or thin PharmaCompass or Pharmaoffer listing is likely to be what an engine reads.
2. Put certificates where they can be checked.Claims that matched a public register held up. Publishing certificate numbers, DMF numbers and site addresses lets a buyer, and an engine, match them.
3. Say plainly what you make and where.In a third of company–API pairings, the company’s own site did not list the API. Clear product pages for each API, separate from finished dosage forms, reduce mismatches.
4. Buyers should check WHO-GMP claims first.They were the least often matched to a regulator list. The CDSCO list and the state certificate are the place to start.
5. Ask from your buyers’ market.Shortlists changed with location. A supplier tracking its visibility from India alone sees only part of what overseas buyers are shown.

06 / 08Limitations

• Absence from a list is not proof of absence. CDSCO’s lists cover certificates for export documents issued in a set period; a firm can hold a valid WHO-GMP certificate and not appear. We report “no regulator record found”, not “false”.
• Matching is by name. Regulator records were matched to companies by legal name and known group names. Unusual spellings in the records could hide a match; we corrected three by hand.
• Company-level evidence. A DMF or GMP certificate held by a company may cover a different site or product from the one in the answer. Only 74.4% of supported USFDA claims had a DMF for the API asked about.
• Uneven website search. 209 companies were checked with web search; a search limit meant the other 143 were checked through cited links, name-based domains and directory profiles. The “no website” rate was 9.6% in the first group and 16.1% in the second.
• One run, one day. Each question was asked once per engine and market on 5 October 2026. Answers vary between runs, and engines change without notice.
• Twenty-five APIs. We chose widely traded molecules. Rarer or newer APIs may show more directory reliance and fewer regulator matches.

07 / 08Data and reproducibility

The files below are published under CC BY 4.0. Following our rule for this study, they report verification outcomes in aggregate and do not pair any company with a result. The files hold the 50 prompts; per-answer counts of companies, claims and citations; claim outcomes by engine, market, phrasing and type; every cited domain with its source type; company outcomes in aggregate; and the regulator sources with the editions and dates we checked. Version 1.0 corresponds to this publication; corrections will be issued as new versions.

• questions.csv50 rowsCSV · prompts
• answers.csv400 rowsCSV · per answer
• claims-summary.csv161 rowsCSV · claims
• citations-by-domain.csv549 rowsCSV · sources
• companies-summary.csv14 rowsCSV · aggregate
• primary-sources.csv6 rowsCSV · sources used

For questions about the data, or a reanalysis you would like us to check, write to research@citationresearch.com.

@techreport{citationresearch2026study006,
  author      = {{Citation Research}},
  title       = {AI’s Indian API suppliers, checked against the regulators},
  institution = {Citation Research},
  number      = {Study 006},
  year        = {2026},
  url         = {https://citationresearch.com/research/ai-pharma-api-suppliers-regulator-check}
}