Skip to content
Close
SEARCH
CONTACT
PHONE HOTLINE: +1 (800) 477-0778E-MAIL: US.Info@kiwa-asi.com
QUOTE REQUEST
PHONE HOTLINE: +1 (800) 477-0778E-MAIL: US.Info@kiwa-asi.com
QUOTE REQUEST

New Kiwa ASI Self-Paced Training: Train your whole team New Self-Paced Training: Train your whole team Browse Courses

Illustration of a cannabis packing room where a technician in a hairnet and gloves weighs dried flower into glass jars while an auditor with a tablet observes

Cannabis Third-Party Audits: 5 Reasons They Matter (2026)

Josh Clauser
Josh Clauser leads website, content, and SEO strategy at Kiwa ASI, where he creates educational content on SQF, BRCGS, FSSC 22000, and other GFSI certification topics. A passionate educator, Josh also develops the company's food safety courses and built the learning management system used to deliver them. He holds a BS in Dietetics and an MA in FCS/Nutrition from Ball State University, and previously taught Community Nutrition at the University of Connecticut.
Published Oct 2, 2026, 8:00:00 AM

A third-party audit is an independent check, by an organization with no stake in your business or your customers', that your cannabis operation follows good manufacturing practices (GMP) and its own quality system. It matters because there's still no federal cannabis GMP rule, New York, Florida, Maryland and Colorado require a third-party audit or certificate for some licensees, and recalls keep showing that lab testing alone misses process failures. Here are five reasons, the state-by-state rules, what an audit covers and how to choose an auditor.

At a glance

Cannabis Third-Party Audits at a Glance

  • 4 of 16States we checked that require a third-party GMP audit or certificate for some cannabis licenseesNY, FL, MD and CO rules
  • 0Federal rules requiring GMP audits for state-licensed cannabis, even after the April 2026 rescheduling order91 FR 22714
  • 191Recall entries on California's cannabis recalls portal, December 2023 to September 2026DCC Recalls Portal
  • 17%Edibles in a 2015 JAMA study whose THC content matched the label within 10%Vandrey et al., 2015

Key takeaways

  • A third-party audit is done by a body independent of you and your buyers. Accreditation is a separate question: it shows the certification body is competent.
  • New York and Florida require third-party GMP audits or certificates for some licensees, Maryland and Colorado only for narrow product classes, and Missouri requires a quality management system built on a published standard.
  • Federal law still sets no cannabis GMP rule. State-licensed medical marijuana moved to Schedule III in April 2026, but the order relies on state rules, and hemp's federal definition changes this November and December.
  • Some recalls and advisories in Colorado and Michigan trace back to contaminated inputs, uneven mixing, packaging and traceability, which a GMP audit checks and a finished-product test can miss.

Updated October 2, 2026. State rules were checked against each state's current code or regulator, and federal status against the Federal Register and DEA. Rules change often: confirm yours before you plan an audit.

Definition

What Is a Third-Party Audit?

A third-party audit is one done by a person or organization that is independent of whoever supplies the product and has no user interest in it.[1] ANAB (the ANSI National Accreditation Board), a U.S. accreditation body, groups audits the same way: first-party audits are internal, second-party audits are a customer auditing a supplier, and third-party audits are done by an independent organization such as a certification body, an accreditation body or a regulator.[2]

First-, second- and third-party audits
TypeWho auditsCannabis exampleIndependent?
First-partyYour own organizationYour QA team's internal audit of your SOPsNo
Second-partySomeone with a user interest, usually a customerA brand auditing its contract manufacturerPartly
Third-partyA body independent of you and of your customersA certification audit; a state-approved GMP auditYes

Accreditation is a separate layer. An accreditation body, such as ANAB, checks that a certification body is competent and impartial, usually against ISO/IEC 17065 for product certification. ISO notes that accreditation isn't compulsory, but it does give independent confirmation of competence.[1][3] Some states ask for it by name, as the state table below shows.

Impartiality is the point. A certification body can't consult for the companies it certifies, or market its certification as linked with a consultant.[4] Under the CSQ program, its auditors also can't audit a site they consulted for in the past three years, and no auditor can do more than three certification audits in a row at the same site.[5] Disclosure: CSQ is owned by ASI Global Standards, LLC, which, like Kiwa ASI's certification body, ASI Food Safety, LLC, is part of ASI Holdings.[5][6]

Reason 1

1. Does Your State Require a Third-Party Audit?

Yes, in some states. Four of the 16 states we checked require a third-party GMP audit or certificate for at least some licensees: New York, Florida, Maryland and Colorado. Missouri requires a quality management system built on a published standard. Michigan and Oklahoma offer voluntary certification routes, and the rest rely on their own GMP or sanitation rules, checked by state inspectors.

Cannabis GMP and third-party audit rules by state (October 2026)
StateThird-party audit required?What the rules sayRule
ArizonaNoEdible makers need a state food establishment license under Arizona's food code, and every licensee follows the cleaning and sanitation rule. The health department inspects.R9-18-313, R9-18-315[7]
CaliforniaNoManufacturers run a documented quality control program under the state's own cannabis GMP rules. The Department of Cannabis Control inspects.4 CCR 17207-17218[8]
ColoradoFor one product classEvery licensee meets sanitary rules. An independent audit by a certified quality or GMP auditor is required before first transfer of "Audited Product" (metered-dose nasal spray, vaginal or rectal use), and the state can order a health and sanitary audit.Rules 3-310, 3-315, 5-325, 6-325[9]
FloridaYesEvery medical marijuana treatment center processing facility must pass a Food Safety GMP inspection ("such as Global Food Safety Initiative or equivalent") by a nationally accredited certifying body within 12 months of licensure, or stop processing. Since August 24, 2026, MMTCs that make edibles or run solvent-based extraction must renew that certification before it expires or every two years, whichever comes first.s. 381.986(8)(e)9.; 64-4.205, 64-4.209[10][11]
IllinoisNoInfusers need a state public health pre-operational GMP inspection under a food code that incorporates 21 CFR 117, plus a certified food service sanitation manager.8 Ill. Adm. Code 1300.475; 77 Ill. Adm. Code 730[12]
MarylandFor high-potency ediblesAll processors follow GMP-based SOPs. High-potency edibles, sold only to medical patients, need a third-party certification of cGMP under 21 CFR 111 or 210 from an accredited body, with the audit checklist, score and corrective plan.COMAR 14.17.11.04, 14.17.13.05(G)[13]
MassachusettsNoProcessing must meet the state's GMP for Food rule (105 CMR 500), and edibles its food sanitation rules. The only recurring third-party audit required is a security audit.935 CMR 500.105(3), 500.110(10), 500.130(2)[14]
MichiganVoluntary optionEdible producers comply with 21 CFR 117. GMP certification by an ISO 17065-accredited body is voluntary and can earn testing allowances. A pending rule overhaul would remove that option.R 420.305(4), R 420.403(8)[15][16]
MissouriQuality system requiredEvery licensee must implement a quality management system using a published standard, such as ISO, ASTM, CSQ or FOCUS, within one year of approval to operate. The state can order a third-party audit after repeat violations.19 CSR 100-1.100(4)(D), 100-1.030(4)(B)[17]
NevadaNoA mandatory GMP chapter covers facilities, sanitation, a quality control unit and process controls. The Cannabis Compliance Board inspects at least once a year.NAC 678B.104, 678B.460-.523[18]
New JerseyNoA manufacturing supervisor makes sure products are made under GMP per 21 CFR 110 and 210. The Cannabis Regulatory Commission inspects.N.J.A.C. 17:30-11.12(a)5[19]
New YorkYesAdult-use processors and medical registered organizations must submit proof of a qualified third-party GMP audit (21 CFR 111 or 117) within one year of starting operations. Hemp extractors and manufacturers need GMP certification before their license issues. The state approves the auditors.9 NYCRR 123.6(a), 113.12(d)(2), 114.4(f)[20][21][22]
OhioNoSince January 1, 2026, every cultivator and processor must follow written GMP policies. The Division of Cannabis Control inspects.OAC 1301:18-4-01[23]
OklahomaVoluntary optionProcessors follow Oklahoma's food rules, including its food GMP chapter. A voluntary process-validation program accepts a GMP certificate from an ISO 17021-1 or ISO 17065-accredited certification body that OMMA has approved, or a state self-assessment scoring 80% or more.OAC 442:10-5-8, 442:10-11-1[24]
PennsylvaniaNoGrower/processors must process in a safe and sanitary manner on food-grade surfaces. The Department of Health inspects.28 Pa. Code 1151a.27, 1151a.33[25]
UtahNoProcessors that manufacture register with the state's food program and keep a written recall plan.R66-2-4, R66-2-11[26]

Checked October 2, 2026 against each state's current code or regulator. Linked states have a Kiwa ASI page with the details. Rules for hemp products, medical-only programs and specific license types can differ.

New York's rule is the broadest. The Office of Cannabis Management decides which auditors qualify, and its GMP guidance says audits must be done by an accredited third-party certification body that the Office has authorized. Licensees must keep proof of current GMP certification for the whole license term, and the guidance asks for an updated audit or certification at each license renewal. Type 3 processors and microbusinesses that only package, label and brand whole flower, non-infused pre-rolls made from purchased pre-ground flower, or kief (including kief pressed into pucks) can request a conditional exemption, which needs the Office's written approval; grinding is never exempt.[20][27] Florida's mandate comes from statute, and its 2026 edibles and extraction rules add a renewal clock: an MMTC that makes edibles or runs solvent-based extraction and whose certification was more than two years old on August 24, 2026, or due to expire within 90 days of it, has 90 days from that date to comply, which works out to about November 22, 2026.[10][11]

Rules in motion

Missouri has proposed amendments to the rule section that holds its quality-system requirement; they are due for publication on November 2, 2026, with comments through December 2.[28] Michigan's rule overhaul, still pending in October 2026, would drop the voluntary ISO 17065 certification option and extend 21 CFR 117 subparts A and B, within a year of taking effect, to businesses that hold unpackaged marihuana (consumption establishments excepted).[16]

Reason 2

2. Why Doesn't Federal Law Settle It?

No federal rule requires GMP audits for state-licensed cannabis, and none sets a cannabis GMP standard. Since April 28, 2026, marijuana in an FDA-approved drug or covered by a state medical marijuana license is in Schedule III, while all other marijuana, including adult-use, stays in Schedule I.[29] The order adds no GMP, quality or audit requirement. It relies on state regulatory systems instead.[29]

That makes state compliance a federal issue too. A state medical licensee's new DEA registration is automatically suspended if the state license is suspended, revoked or expires.[29] Full rescheduling is still pending. DEA's hearing ran from June 29 to July 15, 2026, but on September 29 its chief administrative law judge stayed the case while the judge decides a motion to add a new GAO report to the record; the government's response is due October 13.[30] Separately, on September 9, 2026, a federal appeals court refused to pause the April order while challenges to it proceed.[31]

FDA's position hasn't changed either. FDA says THC and CBD products are excluded from the dietary supplement definition, and adding them to food in interstate commerce is prohibited.[32] FDA hasn't applied 21 CFR 111 (dietary supplement GMP) or 21 CFR 117 (food GMP) to state-licensed marijuana operators, so in practice these rules serve as benchmarks, or apply where a state adopts them: New York (111 or 117), Michigan (117 for edibles) and Maryland (111 or 210 for high-potency edibles). New Jersey points to 21 CFR 110 and 210 instead.[20][15][13][19] Hemp-derived CBD products that FDA regulates are different: FDA says they face the same requirements as other products of their type, such as foods or drugs.[33]

Hemp and CBD: the rules change this fall

Hemp's federal definition changes in two steps. From November 12, 2026, products containing cannabinoids the plant can't naturally produce fall outside it. Once that partial phase ends on December 11, 2026, unless Congress acts again, the rest applies: the 0.3% limit counts total THC including THCA, and final products fall outside the definition if they contain more than 0.4 mg per container of total THC plus any other cannabinoids with THC-like effects, or cannabinoids synthesized outside the plant.[34][35] Documented process and supplier controls make reformulation and relabeling easier to prove.

Reason 3

3. Isn't Lab Testing Enough?

No. Required testing checks a sample of the finished product. A GMP audit checks the process that made it: supplier approval, inputs, mixing and homogeneity, packaging, labeling, sampling and traceability. Regulators' own notices show why both matter.

  • Colorado issued advisories for products that passed required testing but were made with contaminated inputs, such as a June 2025 advisory for products made with ingredients over the limit for the pesticide chlorfenapyr.[36]
  • Michigan's regulator warned in November 2023 that vape cartridges, infused pre-rolls and gummies which passed compliance testing couldn't be traced back to regulated inputs, so their safety couldn't be ensured. In May 2024 it found a licensee had added product to packages after the lab took its compliance samples.[37]
  • In 2023, two Michigan edible makers, working with the regulator, recalled products because they couldn't show the product was homogeneous and THC per serving exceeded the limit.[37]
Studies on cannabis label accuracy
StudyWhat was testedFinding
Vandrey et al., JAMA 201575 edibles, San Francisco, Los Angeles and Seattle (2014)17% within 10% of the THC label; 60% had less THC than labeled and 23% more[38]
Schwabe et al., PLOS ONE 202323 flower samples, 10 Colorado dispensariesAverage THC 23.1% below the lowest label value; about 70% of samples more than 15% below label[39]
Giordano et al., Scientific Reports 2025277 products, 52 Colorado dispensariesWithin 15% of the THC label: 96.0% of concentrates but only 56.7% of flower[40]
Jikomes and Zoorob, Scientific Reports 2018Washington State seed-to-sale dataReported cannabinoid content varied systematically by testing lab[41]

Label accuracy is a process problem as much as a testing one. An auditor looks at how potency is targeted, how batches are mixed and sampled, and whether records tie each label back to a tested batch. For more on the difference between proving a control works and checking that it's working, see our guide to validation vs. verification.

Reason 4

4. How Often Do Cannabis Recalls Happen?

Often enough that you should plan for one. California's recalls portal lists 191 entries from December 2023 to mid-September 2026, most for Aspergillus, pesticides, inflated cannabinoid content or misbranding.[42] Colorado issued 17 health and safety advisories in 2025 and 18 more in 2026 through October 1, mostly for pesticides or for yeast, mold and Aspergillus; a few involved heavy metals, residual solvents or unapproved vape ingredients.[36]

California cannabis recall portal entries by year
YearEntriesMost common reasons
202464Aspergillus 26, pesticides 23, cannabinoid inflation 13, misbranding 20
202593Misbranding 38, Aspergillus 35, cannabinoid inflation 7, pesticides 3
2026 (to Sept. 15)33Misbranding 21, Aspergillus 5

Portal entries are product listings, not unique recall events, and one entry can list several reasons. One entry dates from December 2023.

Recent notices show how varied the failures are. On September 25, 2026, Colorado regulators warned about vape products made with an ingredient containing methylene chloride, sold at 405 stores, and later reported adverse health events from consumers.[36] All four 2025 recalls on Michigan's recall bulletin page were vape cartridges found to contain MCT oil; one covered 5,765 cartridges. Its 2023 notices included an edible with 200 mg of THC per serving in packaging that wasn't child-resistant, and a beverage whose cans swelled and burst.[37]

The stakes are highest for children. Poison centers recorded 7,043 edible cannabis exposures in children under 6 from 2017 to 2021, rising from 207 in 2017 to 3,054 in 2021; 22.7% led to a hospital admission.[43] Not every hazard is common, though: across 11 states' compliance data, aflatoxin and ochratoxin failure rates were very low.[44]

An audit tests whether you could run a recall today. CSQ requires an annual mock recall completed in under two hours, and a certified operation must tell its certification body within 72 hours of any recall, withdrawal or regulatory warning.[5] Several states also require written recall plans or procedures, including Colorado, Massachusetts and Utah.[9][14][26]

Reason 5

5. What Makes a Third-Party Audit Credible?

An audit is only worth what its independence and competence are worth. Regulators, retailers and partners can check both: whether the certification body is accredited for the scheme, whether the auditor is approved by your state, and whether your certificate is current in a public registry.

  • Your state accepts the auditorNew York accepts GMP audits only from auditors the Office of Cannabis Management has approved, and publishes the lists.[27][45]
  • Accreditation covers the schemeAsk for the accreditation certificate and its scope, not just a logo. Florida asks for a nationally accredited certifying body; Maryland, for high-potency edibles, for proof of accreditation to certify 21 CFR 111 or 210; and Oklahoma's program for an ISO 17021-1 or ISO 17065-accredited body that OMMA has approved.[10][13][24]
  • The certification body doesn't consultA CSQ certification body can't offer management system consulting or internal auditing to its clients, and its auditors, technical reviewers and decision makers can't work on an operation they consulted for in the past three years. CSQ counts writing documents, advising on improvements and delivering training as consulting.[5][4]
  • Audits aren't always scheduledAsk whether the scheme includes unannounced audits. CSQ, for example, requires one at least once every three years, and every Level 3 recertification is unannounced.[5]
  • Results are publicAsk whether the scheme publishes a registry of certified sites. CSQ's, for example, lists each site's scope, expiration date, status and audit score; check the expiration date as well as the status.[5][46]
  • The certificate is realCheck any supplier's certificate with the issuing body. Our post on falsified food safety certificates explains why.

CSQ certification marks can go on marketing materials and websites, but not on final product packaging.[5]

Scope

What Does a Cannabis Audit Cover?

It depends on the scheme your state or customer names. New York's audits are against 21 CFR 111 or 117, Maryland's high-potency edible certifications against 21 CFR 111 or 210, and Florida's inspections against Food Safety Good Manufacturing Practices "such as Global Food Safety Initiative or equivalent".[20][13][10] Cannabis-specific schemes are written for cannabis operations. CSQ (Cannabis Safety and Quality), for example, has standards for cultivation, extraction, manufacturing, retail and warehousing and distribution, applies to marijuana and hemp, and certifies at three levels.[5] CSQ's owner and Kiwa ASI's certification body are both part of ASI Holdings.

CSQ 2.0 certification levels
LevelModulesWhat it coversMinimum on site
Level 1Modules 1-3Management system, good practices for your scope (GMP, good handling or good distribution practices) and product and process rules1 day, announced
Level 2Modules 1-4Level 1 plus HACCP (full, or basic for standard retail)1.5 days, announced
Level 3Modules 1-5Level 2 plus an advanced quality management system2 days, unannounced

Every initial audit also includes a one-day offsite documentation evaluation and a report write-up. Sites at Level 2 or 3 in cultivation, extraction or manufacturing can add a Dietary Supplement Addendum.

Scoring is simple. Each minor nonconformance costs 1 point, each major 10, and a critical 100, an automatic failure. You need 70 to be certified: 80 to 100 means an annual audit, and 70 to 79 adds a six-month surveillance audit. Below 70, no certificate is issued and you wait six months to reapply. Corrective actions must be closed within 30 days of the closing meeting, and certificates expire one year and 45 days after the last audit day.[5]

CSQ is one option, not the only one: state rules point to 21 CFR 111, 117 or 210, state GMP codes, or Food Safety GMP "such as Global Food Safety Initiative or equivalent".[20][13][8][23][18][10] CSQ describes itself as conforming to ISO/IEC 17067 but not an accredited standard, and it isn't a GFSI-benchmarked scheme.[6][5][47]

Preparation

How Do You Prepare for a Cannabis Audit?

Start with your state's rule and your customers' requirements, then build records the auditor can follow.

  1. Confirm the requirementCheck your state's rule and deadline, and ask buyers which scheme they accept.
  2. Choose the standard and scopeMatch it to your license type: cultivation, extraction, manufacturing, retail or distribution.
  3. Write and run your SOPsCSQ recommends at least 60 days of records before your first audit. If your state requires an audit before you can operate, the certification body can issue a six-month provisional certificate, with a second audit within 45 days either side of the six-month mark.[5]
  4. Train your peopleEvery CSQ Certification Program Manager must complete CSQ's online Certification Program Overview course. At Level 2 and 3, except standard retail, which uses basic HACCP, one person and a backup must be certified in an International HACCP Alliance-approved HACCP course.[5]
  5. Test yourselfRun an internal audit and a mock recall. An optional pre-assessment can be done by your own team or a CSQ-licensed certification body, which can point out gaps but can't advise on fixes.[5]
  6. Book the audit and close findingsPlan for corrective actions due within 30 days, and use root cause analysis so findings don't come back.
Support

How Kiwa ASI Can Help

ASI Food Safety, LLC (Kiwa ASI) is currently CSQ's licensed certification body.[6] CSQ is owned by ASI Global Standards, LLC, which, like ASI Food Safety, is part of ASI Holdings; CSQ publishes an impartiality statement on that relationship.[5][6] Kiwa ASI LLC is also on New York's approved GMP auditor lists for adult-use processors (July 21, 2026) and cannabinoid hemp processors (revised April 20, 2023); that approval comes from the Office of Cannabis Management.[45]

As a certification body, ASI Food Safety, LLC doesn't consult for, write documents for or advise on fixes for the operations it certifies.[5][4] See the cannabis GMP certification page for every state's rules, or the CSQ certification page for the scheme.

Separately, ASI Training and Consulting, LLC offers HACCP training (IHA-accredited), internal auditing training and cGMP training. It operates separately from the certification body and has no effect on audit outcomes, and because CSQ counts delivering training as consulting, anyone who trains your team can't audit, review or decide on your CSQ certification for three years.[5]

FAQ

Frequently Asked Questions

What is a third-party audit for cannabis companies?

It's an audit by an organization independent of your business and your customers, such as a certification body or a state-approved auditor, that checks your operation against a GMP or quality standard. Internal audits are first-party, and a customer auditing you is second-party.

Is a third-party GMP audit required for cannabis?

In some states. New York requires one for adult-use processors, medical registered organizations and some hemp processors; Florida for medical marijuana treatment center processing facilities; Maryland for high-potency edibles; and Colorado for metered-dose nasal sprays and vaginal or rectal products. Missouri requires a quality management system built on a published standard. Most other states inspect against their own GMP rules.

Does federal law require cannabis GMP certification?

No. The April 2026 order moving state-licensed medical marijuana to Schedule III adds no GMP or audit requirement and relies on state rules. FDA treats THC and CBD products as outside the dietary supplement definition and hasn't applied 21 CFR 111 or 117 to state-licensed marijuana operators; in practice those rules serve as benchmarks or apply where a state adopts them. Hemp-derived CBD products that FDA regulates face the requirements for their product type.

Which GMP rules do cannabis audits use?

It depends on the state. New York uses 21 CFR 111 or 117, Maryland 21 CFR 111 or 210 for high-potency edibles, New Jersey 21 CFR 110 and 210, and Michigan 21 CFR 117 for edibles. California, Ohio and Nevada have their own cannabis GMP rules, and Florida asks for a Food Safety GMP inspection such as Global Food Safety Initiative or equivalent.

What is CSQ certification?

CSQ (Cannabis Safety and Quality) is a cannabis- and hemp-specific certification program owned by ASI Global Standards, LLC, which, like Kiwa ASI's certification body, ASI Food Safety, LLC, is part of ASI Holdings. It has standards for cultivation, extraction, manufacturing, retail and warehousing and distribution. Level 1 covers good practices for your scope (GMP, good handling or good distribution practices), Level 2 adds HACCP, and Level 3 adds an advanced quality management system.

Is CSQ accredited or GFSI-recognized?

CSQ says it conforms to ISO/IEC 17067 but isn't an accredited standard, and it isn't on GFSI's list of recognized programs. Accreditation applies to certification bodies, not standards, so ask any certification body for its current scope of accreditation. CSQ is owned by ASI Global Standards, LLC, which, like Kiwa ASI's certification body, ASI Food Safety, LLC, is part of ASI Holdings; ASI Food Safety is currently CSQ's licensed certification body.

Can a certification body also consult for you?

No. ISO/IEC 17065 bars a certification body from consulting for the clients it certifies and from marketing certification as linked with consulting, and if a related company consults, the certification body's managers, reviewers and decision makers can't take part in that work. CSQ adds that auditors, technical reviewers and decision makers can't work on an operation they consulted for in the past three years, and counts writing documents, advising on improvements and delivering training as consulting. Using a particular consultant or trainer doesn't make certification easier or faster. CSQ's owner and Kiwa ASI's certification body are both part of ASI Holdings.

How long does a CSQ audit take?

Under CSQ's rules, an initial audit has a one-day offsite documentation evaluation, then at least 1 day on site for Level 1, 1.5 days for Level 2 and 2 days for Level 3, plus a report write-up. Corrective actions are due within 30 days of the closing meeting. CSQ's owner and Kiwa ASI's certification body are both part of ASI Holdings.

Can I put a certification logo on my cannabis packaging?

Not for CSQ. Certified operations can use the CSQ logo and level insignia in marketing and on their websites, but not on final product packaging. CSQ's owner and Kiwa ASI's certification body are both part of ASI Holdings.

How do the 2026 hemp changes affect audits?

From November 12, 2026, hemp excludes products containing cannabinoids the plant can't naturally produce. Once that partial phase ends on December 11, 2026, unless Congress acts again, final products with more than 0.4 mg per container of combined total THC (including THCA) and THC-like cannabinoids fall outside the definition. Audited supplier and labeling controls help you show which products still meet it.

Plan your cannabis audit

Kiwa ASI is currently CSQ's licensed certification body and is on New York's approved GMP auditor lists for adult-use and cannabinoid hemp processors. Tell us your state, license type and timeline, and we'll confirm whether our accreditation and approvals fit your state's rule before we scope the audit.

Request a certification quoteCannabis rules by state

Questions? Email US.Info@kiwa-asi.com or call 1 (800) 477-0778.

Keep reading

Sources

  1. NIST. ABC's of Conformity Assessment, NIST SP 2000-01 (definitions from ISO/IEC 17000). nist.gov
  2. ANAB. 1st, 2nd and 3rd Party Audits Explained (June 2026). blog.ansi.org
  3. ISO. Certification (accessed October 2, 2026). iso.org
  4. International Accreditation Service. Sample ISO/IEC 17065:2012 checklist, clauses 4.2.6 to 4.2.9. iasonline.org (PDF)
  5. CSQ. Certification Program Requirements, Version 2.0 (October 2025), and the CSQ Cultivation, Extraction, Manufacturing, Retail and Warehousing & Distribution standards (October 2025). Download from csqcertification.com
  6. CSQ. CSQ Certification Program Oversight (impartiality statement) (accessed October 2, 2026). csqcertification.com
  7. Arizona Department of Health Services. 9 A.A.C. 18 (effective July 1, 2026), R9-18-313 and R9-18-315. azdhs.gov (PDF)
  8. California Department of Cannabis Control. DCC Regulations, 4 CCR 17207-17218 (rev. July 1, 2026). cannabis.ca.gov (PDF)
  9. Colorado Marijuana Rules, 1 CCR 212-3, Rules 3-310, 3-315, 3-335, 3-336, 5-325 and 6-325. coloradosos.gov (PDF)
  10. Florida Statutes s. 381.986(8)(e)8.-9. (2026). flsenate.gov
  11. Florida Administrative Code Rules 64-4.205 (edibles) and 64-4.209 (extraction), effective August 24, 2026. flrules.org
  12. 8 Ill. Adm. Code 1300.475 and 77 Ill. Adm. Code 730 (incorporated materials include 21 CFR 117). ilga.gov (Part 1300); ilga.gov (Part 730)
  13. COMAR 14.17.13.05 (edible cannabis products, including G, high-potency edibles) and 14.17.11.04 (processor SOPs). regs.maryland.gov
  14. Massachusetts Cannabis Control Commission. 935 CMR 500.000 (effective September 11, 2026), 500.105(3), 500.110(10), 500.120(12), 500.130(2) and 500.130(5). masscannabiscontrol.com (PDF)
  15. Michigan Cannabis Regulatory Agency. Marihuana Rules R 420.1 to R 420.1004, including R 420.305(4) and R 420.403(8). michigan.gov (PDF)
  16. Michigan Cannabis Regulatory Agency. Public hearing, administrative rules (July 2026) and rule set 2023-25 LR status (accessed October 2, 2026). michigan.gov
  17. Missouri Code of State Regulations 19 CSR 100-1.100(4)(D) and 100-1.030(4)(B). sos.mo.gov (PDF)
  18. Nevada Administrative Code Chapter 678B, including NAC 678B.104 and 678B.460-678B.523. leg.state.nv.us
  19. N.J.A.C. 17:30-11.12 (manufacturing). law.cornell.edu
  20. New York Office of Cannabis Management. Adopted Adult-Use Cannabis Regulations, 9 NYCRR 123.6 (effective November 5, 2025). cannabis.ny.gov (PDF)
  21. 9 NYCRR 113.12, Manufacturing Requirements (medical cannabis). law.cornell.edu
  22. 9 NYCRR 114.2 and 114.4 (cannabinoid hemp processor licensing). law.cornell.edu
  23. Ohio Administrative Code 1301:18-4-01, Cultivator and Processor Good Manufacturing Processes. codes.ohio.gov
  24. Oklahoma Medical Marijuana Authority. OAC 442:10 emergency rules effective August 28, 2026, including 442:10-5-8 and 442:10-11-1. oklahoma.gov (PDF)
  25. 28 Pa. Code Chapter 1151a, sections 1151a.27 and 1151a.33. pacodeandbulletin.gov
  26. Utah Administrative Code R66-2, Cannabis Processing (R66-2-4, R66-2-11). adminrules.utah.gov (current text)
  27. New York Office of Cannabis Management. GMP Audit Guidance (June 2024). cannabis.ny.gov (PDF)
  28. Missouri DHSS, Division of Cannabis Regulation. Cannabis rules and law (proposed amendments to 19 CSR 100-1.100) (accessed October 2, 2026). health.mo.gov
  29. U.S. Department of Justice / DEA. Schedules of Controlled Substances: Rescheduling of Food and Drug Administration Approved Products Containing Marijuana and Marijuana Subject to a State Medical Marijuana License (91 FR 22714, April 28, 2026), including 21 CFR 1301.13(k). federalregister.gov
  30. DEA Office of Administrative Law Judges. Proposed Rescheduling of Marijuana, Docket No. 26-96: Stay and Briefing Order (September 29, 2026). dea.gov (PDF)
  31. U.S. Court of Appeals for the D.C. Circuit. Smart Approaches to Marijuana, Inc. v. DOJ, No. 26-1106 (consolidated), order of September 9, 2026 denying a stay. courtlistener.com
  32. U.S. FDA. FDA Regulation of Cannabis and Cannabis-Derived Products, Including Cannabidiol (CBD) (accessed October 2, 2026). fda.gov
  33. U.S. FDA. Letter from Commissioner Makary on enforcement discretion for certain hemp-derived CBD products (April 1, 2026). fda.gov (PDF)
  34. Public Law 119-37, Division B, Sec. 781 (hemp definition; signed November 12, 2025). govinfo.gov
  35. Public Law 119-103, Sec. 2019 (Continuing Appropriations and Extensions Act, 2027; signed September 2, 2026). govinfo.gov
  36. Colorado Marijuana Enforcement Division. Health and Safety Advisories, 2025 and 2026 (accessed October 2, 2026). med.colorado.gov
  37. Michigan Cannabis Regulatory Agency. Public Health and Safety Advisory Bulletins and Recalls (accessed October 2, 2026). michigan.gov
  38. Vandrey R, et al. Cannabinoid Dose and Label Accuracy in Edible Medical Cannabis Products. JAMA. 2015;313(24):2491-2493. pubmed.ncbi.nlm.nih.gov
  39. Schwabe AL, et al. Uncomfortably high: Testing reveals inflated THC potency on retail Cannabis labels. PLOS ONE. 2023;18(4):e0282396. pubmed.ncbi.nlm.nih.gov
  40. Giordano G, et al. Accuracy of labeled THC potency across flower and concentrate cannabis products. Scientific Reports. 2025;15:20822. pubmed.ncbi.nlm.nih.gov
  41. Jikomes N, Zoorob M. The Cannabinoid Content of Legal Cannabis in Washington State Varies Systematically Across Testing Facilities and Popular Consumer Products. Scientific Reports. 2018;8:4519. pubmed.ncbi.nlm.nih.gov
  42. California Department of Cannabis Control. Recalls Portal, entries December 7, 2023 to September 15, 2026 (accessed October 2, 2026). recalls.cannabis.ca.gov
  43. Tweet MS, et al. Pediatric Edible Cannabis Exposures and Acute Toxicity: 2017-2021. Pediatrics. 2023;151(2):e2022057761. pubmed.ncbi.nlm.nih.gov
  44. Boyar K, et al. Mycotoxin Trends of Cannabis Compliance Testing in Cannabis Flower and Concentrates in the United States. Clinical Therapeutics. 2026;48(9):876-882. pubmed.ncbi.nlm.nih.gov
  45. New York Office of Cannabis Management. Approved Adult Use Cannabis GMP Auditors (July 21, 2026) and Approved Cannabinoid Hemp GMP Auditors (revised April 20, 2023). cannabis.ny.gov (PDF); hemp list (PDF)
  46. CSQ. Certified Sites registry (228 listings, viewed October 2, 2026). csqcertification.com
  47. GFSI. GFSI-Recognised Certification Programme Owners (accessed October 2, 2026). mygfsi.com