CSQ CERTIFICATION
The CSQ Certification Program and applicable standards were built around ISO/IEC 17067
Arizona Medical Marijuana Act (2010) & Smart and Safe Arizona Act (2020) · Arizona Department of Health Services · A.A.C. Title 9, Ch. 17 & 18
Arizona GMP for Marijuana
Arizona licenses and inspects every marijuana establishment, medical dispensary, and testing facility through the Department of Health Services, and an edible maker must hold a state food-establishment license under Arizona's own food code (9 A.A.C. 8) and meet the cleaning-and-sanitation rules (A.A.C. R9-18-315). Arizona does not require a third-party GMP certificate — but CSQ is an accredited, independent way to prove the manufacturing GMP a retail food-establishment license doesn't reach.
Arizona's Marijuana GMP Rules and Why CSQ Certification Is Worth It
Arizona runs a dual market, medical marijuana since 2010 (the Arizona Medical Marijuana Act) and adult-use since 2021 (the Smart and Safe Arizona Act) both regulated by the Arizona Department of Health Services (ADHS). For a marijuana establishment that makes edibles or other products, Arizona makes food-safety practices the law: edible makers must hold a state food-establishment license under Arizona's own food code, meet cleaning-and-sanitation rules, and have every batch tested by an ISO/IEC 17025-accredited laboratory but Arizona requires no third-party GMP certificate, names no private standard, and ties its rules to Arizona's own food code, not federal 21 CFR manufacturing rules. CSQ is an accredited, independent way to prove the manufacturing GMP Arizona's rules don't fully reach. This page explains what Arizona actually requires, which CSQ standard fits your operation, and where certification with Kiwa ASI adds value.
START HERE
Does Arizona Require Marijuana Operators to Be GMP Certified?
No — Arizona requires no accredited third-party GMP certificate. But GMP is far from optional for a marijuana establishment that makes products: ADHS makes cleaning-and-sanitation rules mandatory, and an edible maker must hold a state food-establishment license under Arizona's own food code. Here is the short version, and why CSQ still matters.
WHO REGULATES WHAT
One regulator: the Department of Health Services
Arizona's medical and adult-use programs are both run by the Arizona Department of Health Services (ADHS), through its Bureau of Marijuana Licensing — a health department, not a standalone cannabis commission. Marijuana establishments and dispensaries operate under A.A.C. Title 9, Chapter 17 (medical) and Chapter 18 (adult-use); testing facilities are separately ADHS-licensed.
THE REQUIREMENT
A food-establishment license + sanitation, not a GMP certificate
Edible makers must hold a state food-establishment license under Arizona's own food code (9 A.A.C. 8), meet cleaning-and-sanitation rules (R9-18-315), and have every batch lab-tested (R9-18-311). No accredited third-party GMP certificate is required, Arizona names no private GMP standard, and the tie is to Arizona's food code — not federal 21 CFR.
WHERE CSQ FITS
Voluntary — accredited proof of your manufacturing GMP
CSQ is an accredited (ISO/IEC 17065) cannabis-specific GMP certification. Arizona doesn't require it, but it gives independent, audit-ready proof of manufacturing GMP — the layer a retail food-establishment license doesn't reach — valuable for ADHS inspection readiness, diligence, and multi-state operators.
What Arizona actually requires
Arizona runs a dual market: a medical program under the Arizona Medical Marijuana Act (AMMA) (Proposition 203 of 2010; A.R.S. Title 36, Chapter 28.1, §36-2801 et seq.) and an adult-use program under the Smart and Safe Arizona Act (Proposition 207 of 2020; A.R.S. Title 36, Chapter 28.2, §36-2850 et seq.; adult-use retail began January 2021). Both are administered by the Arizona Department of Health Services (ADHS), through its Bureau of Marijuana Licensing — a health department, not a standalone cannabis commission — under the rules at A.A.C. Title 9, Chapter 17 (medical) and Chapter 18 (adult-use).
For a marijuana establishment — Arizona's adult-use license is vertically integrated, so one license can cover cultivation, manufacturing, and retail — food-safety practices are the law. Products must be made under mandatory cleaning-and-sanitation rules (A.A.C. R9-18-315), and any maker of edible marijuana products must obtain a state food-establishment license under Arizona's own food code (9 A.A.C. 8, Article 1) and prepare product in compliance with it (R9-18-313; medical R9-17-319). Every batch must be tested by an ISO/IEC 17025-accredited, ADHS-licensed marijuana testing facility before sale (R9-18-311). What Arizona does not do is require an accredited third-party GMP certificate — its rules name no private standard (no SQF, BRCGS, FSSC, ISO 22000/22716, or CSQ), and the food-safety tie is to Arizona's own food code, not federal 21 CFR Part 111 or 117. GMP is verified by ADHS licensing and inspection. So in Arizona CSQ is voluntary: accredited, independent proof of the manufacturing GMP a retail food-establishment license doesn't fully reach.
FIND YOUR PATH
Match Your Arizona Operation to the Right CSQ Standard
Arizona issues one vertically integrated marijuana establishment license that can cover cultivation, manufacturing, and retail, so this is about which scope fits the activity you perform — not a license class. CSQ is voluntary in Arizona; match each activity to the CSQ standard that fits, and an integrated or dual licensee can combine scopes into one coordinated audit with Kiwa ASI.
Cultivation activity
A.A.C. 9 Ch. 18 · ADHSSTANDARD
CSQ Cultivation v2.0.0
MINIMUM LEVEL
Level 1
PREP TIME
6–9 months
AUDIT LENGTH
~1 day onsite + 1 day offsite doc review (initial)
The growing side of a marijuana establishment or medical dispensary. Foundation: cGACP (good agricultural and collection practices) plus cGMP, with the cleaning-and-sanitation rules of A.A.C. R9-18-315 (medical R9-17-320) and mandatory batch testing by an ISO/IEC 17025 lab (R9-18-311).
Manufacturing / edibles / extraction activity
9 A.A.C. 8 + R9-18-313 · ADHSSTANDARD
CSQ Extraction / Manufacturing v2.0.0
MINIMUM LEVEL
Level 1
PREP TIME
6–9 months
AUDIT LENGTH
~1 day onsite + 1 day offsite doc review (initial)
Making edibles, concentrates, and infused products. This is where Arizona's rules bite hardest — edible makers must hold a state food-establishment license under Arizona's own food code (9 A.A.C. 8, Article 1) and meet cleaning-and-sanitation rules — and where CSQ maps most directly, because a retail food-establishment license is not a manufacturing GMP program. CSQ items to watch: beverage-grade CO₂ (99.5%) and food-grade non-denatured ethanol for extraction, inhalation-grade ingredients, and (for adult-use edibles) the 10 mg-per-serving / 100 mg-per-package homogeneity requirement (A.R.S. §36-2854(A)(7)).
Retail activity
A.A.C. 9 Ch. 18 · ADHSSTANDARD
CSQ Retail v1.0.0
MINIMUM LEVEL
Level 1
PREP TIME
4–6 months
AUDIT LENGTH
~1 day onsite + 1 day offsite doc review (initial)
Dispensing to consumers or medical cardholders. Built on cGHP (good handling practices) — storage, handling, inventory control (R9-18-314), and product-complaint and remediation handling. Arizona leaves recall and seed-to-sale tracking largely to the operator, which is exactly what a CSQ program documents.
Marijuana Testing Facility
R9-18-101 · ISO/IEC 17025STANDARD
ISO/IEC 17025
MINIMUM LEVEL
N/A
PREP TIME
Varies
AUDIT LENGTH
Per accreditation body
Arizona requires batch testing by an ADHS-licensed marijuana testing facility accredited to ISO/IEC 17025 (A.A.C. R9-18-101). CSQ does not certify testing labs; it requires them to be ISO/IEC 17025 accredited — which is lab-competence accreditation, not the same as CSQ's ISO/IEC 17065.
ARIZONA REQUIRES VS. CSQ GOES FURTHER
What's a State Rule, and What's a CSQ Best Practice?
Arizona's regulations are the legal floor, enforced by ADHS licensing and inspection and mandatory lab testing. CSQ is a voluntary published standard that documents GMP beyond that floor — and gives independent proof of the manufacturing practices a retail food-establishment license doesn't reach. Knowing which is which keeps you from over-buying or under-preparing.
What Arizona requires (the legal floor)
- An ADHS license for each operator — medical AMMA (A.R.S. §36-2801 et seq.); adult-use Smart and Safe Arizona Act (A.R.S. §36-2850 et seq.); rules at A.A.C. Title 9, Ch. 17 & 18
- A state food-establishment license under Arizona's own food code for edible makers — 9 A.A.C. 8, Article 1 (via R9-18-313; medical R9-17-319)
- Cleaning-and-sanitation practices — A.A.C. R9-18-315 (medical R9-17-320)
- Batch testing by an ISO/IEC 17025-accredited, ADHS-licensed marijuana testing facility — R9-18-311; A.R.S. §36-2803
- Adult-use edible THC limits: 10 mg per serving, 100 mg per package, homogeneous and delineated — A.R.S. §36-2854(A)(7); R9-18-313 (medical has no THC cap)
- Child-resistant packaging on exit, a text ADHS warning, and a scannable product QR code — R9-18-310; A.R.S. §36-2854.01
- No products resembling a human, animal, insect, fruit, toy, or cartoon — A.R.S. §36-2860
- Licensee-maintained inventory control — R9-18-314 (Arizona names no statewide seed-to-sale vendor)
- No accredited third-party GMP certificate is required — Arizona names no private GMP standard, and its tie is to Arizona's food code, not 21 CFR
What CSQ adds (voluntary best practice)
- An accredited (ISO/IEC 17065) cannabis GMP certification — independent, audit-ready proof beyond ADHS inspection
- A manufacturing GMP program — the layer Arizona's retail food-establishment license (9 A.A.C. 8) does not reach
- Built to meet the cleaning-and-sanitation rules Arizona requires (A.A.C. R9-18-315)
- A documented internal audit program (Section 1.5) and CAPA system (Section 1.6)
- An annual mock recall (Section 1.8) and verified traceability test — the recall and seed-to-sale discipline Arizona leaves to the operator
- Cannabinoid and non-cannabinoid waste streams kept completely separated (Section 2A.4 / 2B.4)
- Beverage-grade CO₂ (99.5%) for extraction — medical-grade is not acceptable
- Inhalation-grade ingredients for inhalable products (food-grade/GRAS is not sufficient)
- ADHS inspection readiness, investor/lender/M&A diligence, multi-state standardization, and buyer assurance
- A HACCP team and certified lead (Level 2 only — not an Arizona requirement)
- What CSQ does not replace: ADHS licensing and inspection, the state food-establishment license, and mandatory lab testing remain the operator's duty
Quick glossary — the terms that show up in an Arizona CSQ audit
Arizona Medical Marijuana Act (AMMA)
Arizona's medical marijuana statute (Proposition 203 of 2010; A.R.S. Title 36, Chapter 28.1, §36-2801 et seq.), administered by ADHS under A.A.C. Title 9, Chapter 17.
Smart and Safe Arizona Act
Arizona's adult-use marijuana law (Proposition 207 of 2020; A.R.S. Title 36, Chapter 28.2, §36-2850 et seq.); adult-use retail began January 2021, under A.A.C. Title 9, Chapter 18.
ADHS
The Arizona Department of Health Services — the regulator for both the medical and adult-use programs, through its Bureau of Marijuana Licensing. A health department, not a standalone cannabis commission.
Marijuana establishment
Arizona's vertically integrated adult-use license (A.R.S. §36-2850(21)) — one license can cover cultivation, manufacturing, and retail across up to three sites. There is no separate adult-use cultivator or manufacturer license class, so CSQ scope maps to the activity performed.
9 A.A.C. 8 (Arizona food code)
Arizona's own food-establishment rules. Edible-marijuana makers must obtain a food-establishment license under 9 A.A.C. 8, Article 1 and prepare product in compliance with it (R9-18-313) — a state retail food code, not federal 21 CFR manufacturing cGMP.
Marijuana testing facility
An ADHS-licensed laboratory that tests every batch for potency and contaminants before sale (R9-18-311). It must be accredited to ISO/IEC 17025 — a state accuracy license, not a product-GMP certification body.
ISO/IEC 17025
The competence standard for testing laboratories. Arizona requires its marijuana testing facilities to hold ISO/IEC 17025 accreditation (A.A.C. R9-18-101). CSQ requires the labs it relies on to hold the same — it is not the same as ISO/IEC 17065.
ISO/IEC 17065
The accreditation standard for bodies that certify products and processes. CSQ is delivered by ASI Food Safety as an ISO/IEC 17065-accredited certification body — the basis for an independent, accredited GMP certificate.
THE AUDIT
What a CSQ Audit Actually Looks Like
An Arizona CSQ audit is an onsite review of your quality management system against the standard that fits each activity you perform. Here is how scoring, findings, and timing work — followed by the technical mapping table for the people who want it.
Scoring (100-point scale)
How CSQ scores you and what it means for your certificate
| Score | Outcome | Surveillance Cycle |
|---|---|---|
| 80–100 | Certificate issued | Annual surveillance audit |
| 70–79 | Certificate issued | 6-month surveillance audit |
| Below 70 | No certificate | 6-month wait before re-audit |
Findings categories
CRITICAL · –100 POINTS
Auto-fail finding
Regulatory non-compliance, product safety risk, or foundational QMS breakdown. A single Critical finding fails the audit regardless of other scores.
MAJOR · –10 POINTS
Significant gap
Systemic failures or significant deviations from CSQ requirements — not an immediate safety risk but requires corrective action.
MINOR · –1 POINT
Isolated finding
Documentation gap, single-occurrence lapse, or correctable deviation that is not systemic.
Audit timing & certificate validity
What to expect onsite and on the calendar
| Item | Detail |
|---|---|
| Level 1 audit | 1 day onsite + 0.5 day report time |
| Level 2 audit | 1.5 days onsite + 1 day report time |
| Level 3 audit | 2 days onsite + 1 day report time (unannounced window) |
| Initial audit add-on | +1 day for offsite documentation evaluation (all levels) |
| Corrective action window | 30 days to close nonconformities |
| Certificate validity | 1 year + 45 days from audit date |
| Initial certification blackout | No initial certifications scheduled in November or December |
| Provisional certificate | Available for new operations (valid 6 months) |
| Dietary Supplement Addendum | 4-hour minimum · Pass/Fail · separate report within 72 hours |
For consultants, internal compliance leads, and operators who want the section-by-section map between Arizona's regulations and CSQ 2.0:
Arizona marijuana rules and corresponding CSQ 2.0 sections
| Missouri Requirement | Citation | CSQ Coverage |
|---|---|---|
| ADHS licensing (marijuana establishment, dispensary, lab) | AMMA (A.R.S. §36-2801 et seq.); Smart and Safe Act (A.R.S. §36-2850 et seq.); A.A.C. Title 9 Ch. 17 & 18 | Module 1 (CSQMS) + Section 1.3 (Regulatory Compliance) |
| State food-establishment license for edible makers | 9 A.A.C. 8, Article 1 (via A.A.C. R9-18-313 / R9-17-319) | Module 2A (cGMP) + Section 3C (formulated / ingestible product controls) |
| Cleaning and sanitation practices | A.A.C. R9-18-315 (medical R9-17-320) | Module 2A (cGMP) + Section 2A.5 (Personnel Training and Hygiene) |
| Adult-use edible THC limits + homogeneity | A.R.S. §36-2854(A)(7); A.A.C. R9-18-313 | Section 3C (formulated / ingestible product controls) |
| Packaging, text warning, QR code, shape/marketing limits | A.A.C. R9-18-310; A.R.S. §36-2854.01, §36-2860 | Section 2A.12.8 / 2B.11.6 (Product Labeling and Packaging) |
| Batch testing by an ISO/IEC 17025 lab | A.A.C. R9-18-311, Table 3.1; A.R.S. §36-2803 | Section 2A.12.9 / 2B.11.7 (Product Sampling and Testing) — CSQ requires ISO/IEC 17025 labs |
| Licensee inventory control (no statewide vendor) | A.A.C. R9-18-314 | Section 1.8 (Recall & Traceability) |
| Recall / market withdrawal (operator-run) | Arizona names no mandatory recall rule | Section 1.8 (Recall & Traceability) + Section 1.6 (CAPA) |
How to Prepare | A Realistic Path to CSQ Certification
Because CSQ is voluntary in Arizona, step one is deciding whether it earns its place for you. If it does, most operators need 4 to 9 months, depending on activity and scope, to be ready for an initial audit. Here is a sequence that works.
01
Decide whether CSQ is right for you
Arizona doesn't require it, so weigh the value: ADHS inspection readiness, investor / lender / M&A diligence, multi-state standardization, and buyer assurance. Because Arizona's edible tie is a retail food-establishment license rather than a manufacturing GMP program, CSQ closes a real gap. If those matter, CSQ is worth pursuing.
02
Confirm your CSQ standard and level
Match the activity you perform — cultivation, manufacturing/edibles/extraction, or retail — to its CSQ standard, and decide whether Level 1 is enough or you want Level 2/3. A vertically integrated marijuana establishment can combine scopes. Write the answer down; it drives every other step.
03
Run a gap analysis
Compare your current state to the CSQ standard, mapped against Arizona's rules (the cleaning-and-sanitation rules of A.A.C. R9-18-315 and the food-establishment requirements of 9 A.A.C. 8). ASI Training and Consulting, LLC can deliver a structured gap analysis as a separate engagement from the certification body.
04
Build the QMS documentation
Extend the controls Arizona already requires — sanitation, food-safety, inventory control, and product handling — into a full CSQ quality management system with SOPs, CAPA, internal audit, document control, and recall/traceability (the recall and seed-to-sale discipline Arizona leaves to the operator).
05
Address the cannabis-specific Critical items
The findings most likely to fail a first audit: CO₂ purity, ethanol grade, inhalation-grade ingredients, waste-stream separation, and route-of-administration risk assessments — plus, for adult-use edibles, the 10 mg-per-serving homogeneity requirement. Confirm your extraction and formulation controls are documented before the auditor arrives.
06
Train your team and run internal audits
Deliver competency-based, role-specific training on GMP, hygiene, PPE, allergen handling, and traceability. Then conduct a documented internal audit and an annual mock recall, and close nonconformities through CAPA.
07
Schedule your CSQ audit with Kiwa ASI
Schedule through Kiwa ASI in the CSQ Database. Allow time for the offsite documentation evaluation (1 day) plus the onsite audit (1–2 days depending on level). Request a quote to start.
Why Arizona Operators Choose Kiwa ASI
Kiwa ASI brings nearly a century of food safety expertise and the global Kiwa network's footprint in 30+ countries to Arizona — a mature dual medical and adult-use market where marijuana establishments and dispensaries operate under Department of Health Services rules.
Accredited
ISO/IEC 17065 + CSQ-Licensed
Audits and certificates are issued by ASI Food Safety, LLC — an ISO/IEC 17065-accredited certification body licensed by CSQ.
Expertise
Food-grade rigor for cannabis
Our auditors are credentialed food safety, GMP, and HACCP professionals with cannabis-specific qualifications. Cannabis is being regulated like food. We've been doing food for decades.
Efficiency
Direct scheduling, no surprises
Pre-audit scoping clarifies level, scope, and Module 3 requirements before you're onsite. Audit reports are turned around inside the standard CSQ timeline.
Comprehensive
Training and consulting available
Pre-assessments and gap analyses are delivered by ASI Training and Consulting, LLC, a separate legal entity, kept structurally separate from the certification body to safeguard impartiality under ISO/IEC 17065.
Continuity
Surveillance, recertification, transfer
If you're already CSQ-certified through another body and the relationship isn't working, we accept transfer audits. Continuity matters as much as the initial certificate.
Partnership
Global Kiwa network
Operations in 30+ countries. Useful when an Arizona operator expands into other state markets or builds an international supply chain.
Frequently Asked Questions About Arizona Marijuana GMP & CSQ Certification
No. Arizona does not mandate an accredited third-party GMP certificate, and it names no private GMP standard. But food-safety practices are required: an edible maker must hold a state food-establishment license under Arizona's own food code (9 A.A.C. 8, Article 1), meet cleaning-and-sanitation rules (A.A.C. R9-18-315), and have every batch lab-tested (R9-18-311). CSQ certification is voluntary: accredited, independent proof of the manufacturing GMP a retail food-establishment license doesn't reach.
Both. Arizona has a medical program under the Arizona Medical Marijuana Act (Proposition 203 of 2010) and an adult-use program under the Smart and Safe Arizona Act (Proposition 207 of 2020); adult-use retail began in January 2021. Both are regulated by the Arizona Department of Health Services (ADHS).
The Arizona Department of Health Services (ADHS), through its Bureau of Marijuana Licensing, regulates both the medical and adult-use programs — a health department, not a standalone cannabis commission. Medical operators fall under A.A.C. Title 9, Chapter 17 and adult-use under Chapter 18.
Yes — as practices, not a certificate. Makers of edible marijuana products must obtain a state food-establishment license under Arizona's own food code (9 A.A.C. 8, Article 1) and comply with it (R9-18-313), meet cleaning-and-sanitation rules (R9-18-315), and have every batch tested. Arizona verifies this through ADHS licensing, inspection, and lab testing — and its tie is to Arizona's food code, not federal 21 CFR Part 111 or 117.
No. GMP compliance is verified through ADHS licensing, inspection, and mandatory lab testing — not by a required outside auditor. The testing laboratory tests the product; it does not certify the manufacturer's GMP program. A CSQ certificate is voluntary and does not replace ADHS inspection or lab testing.
No. The ADHS marijuana rules name no private food-safety or GMP standard for makers — not CSQ, SQF, BRCGS, FSSC, or ISO 22000/22716. The one ISO standard Arizona requires (ISO/IEC 17025) applies only to testing laboratories. CSQ is a voluntary, accredited option delivered by ASI Food Safety; it is built to meet — not to satisfy or replace — Arizona's rules.
Arizona issues one vertically integrated marijuana establishment license (cultivation + manufacturing + retail), so CSQ scope maps to the activity you perform: cultivation uses CSQ Cultivation v2.0.0; manufacturing, edibles, and extraction use CSQ Extraction or Manufacturing v2.0.0; retail uses CSQ Retail v1.0.0. Testing laboratories follow ISO/IEC 17025 (CSQ does not certify labs but requires ISO/IEC 17025). Kiwa ASI can combine scopes into one coordinated audit.
For adult-use edibles, no more than 10 mg of total THC per serving and 100 mg per package, and multi-serving products must be scored or delineated into standard servings of homogeneous consistency (A.R.S. §36-2854(A)(7); A.A.C. R9-18-313). The medical program has no per-serving or per-package THC cap, so these limits are an adult-use rule, not a blanket Arizona rule.
No. Arizona does not mandate a universal THC symbol, a red diamond, or a per-serving symbol stamp. Its consumer warning is a text ADHS statement, and adult-use packaging must carry a scannable product QR code (A.R.S. §36-2854.01) plus child-resistant packaging (R9-18-310). Products also may not resemble a human, animal, insect, fruit, toy, or cartoon (A.R.S. §36-2860).
Because it turns the food-safety practices Arizona already requires into accredited, independent proof — and closes the gap a retail food-establishment license leaves open, since Arizona ties edibles to its food code rather than a manufacturing GMP program. The highest-value cases: ADHS inspection readiness, investor / lender / M&A due diligence, multi-state standardization (including a harder-posture state like New York, which mandates a third-party GMP audit), and buyer assurance — plus the recall and seed-to-sale discipline Arizona leaves to the operator.
Yes — but as separate legal entities to safeguard certification-body independence. CSQ certification audits are delivered by ASI Food Safety, LLC (the accredited certification body, ISO/IEC 17065 accredited and CSQ-licensed). Pre-assessments, gap analyses, training, and consulting are delivered by ASI Training and Consulting, LLC. The two operate independently to comply with ISO/IEC 17065 impartiality rules.