CSQ CERTIFICATION
The CSQ Certification Program and applicable standards were built around ISO/IEC 17067
California MAUCRSA · Department of Cannabis Control · 4 CCR Div. 19
California GMP for Cannabis
California licenses and inspects every cannabis cultivator, manufacturer, retailer, and testing lab through the Department of Cannabis Control, and manufacturers must run a full documented GMP program (4 CCR §§17207–17218). California does not require a third-party GMP certificate — but CSQ is an accredited, independent way to prove the GMP program the state already requires.
California's Cannabis GMP Rules and Why CSQ Certification Is Worth It
California legalized both medical and adult-use cannabis and regulates it through the Department of Cannabis Control (DCC). California already makes GMP the law for manufacturers — a written product quality plan, master manufacturing protocol, batch records, SOPs, and mandatory recall procedures — but verifies them by DCC inspection, not a certificate. CSQ is an accredited, independent way to prove the GMP program California already requires. This page explains what California actually requires, which CSQ standard fits your license, and where certification with Kiwa ASI adds value.
START HERE
Does California Require Cannabis Operators to Be GMP Certified?
No — California requires no accredited third-party GMP certificate. But GMP itself is far from optional: cannabis manufacturers must run a full documented GMP program under the DCC rules. Here is the short version, and why CSQ still matters.
WHO THE DCC REGULATES
Cultivation, manufacturing, retail, testing labs
Since 2021 one agency — the Department of Cannabis Control — licenses the entire supply chain: cultivators, manufacturers (Type 6 non-volatile and Type 7 volatile), distributors, retailers, microbusinesses, and testing laboratories, for both medical and adult-use.
THE REQUIREMENT
A full GMP program + testing + recall, not a certificate
Manufacturers must implement the DCC GMP program (4 CCR §§17207–17218), pass ISO/IEC 17025 lab testing (B&P §26100), and keep written recall procedures (§17226). No accredited third-party GMP certificate is required — the DCC verifies GMP by inspection.
WHERE CSQ FITS
Voluntary — accredited proof of what CA mandates
CSQ is an accredited (ISO/IEC 17065) cannabis-specific GMP certification. California doesn't require it, but it gives independent, audit-ready proof of the GMP program California already mandates — valuable for DCC inspection readiness, diligence, and multi-state operators.
What California actually requires
California unified its medical and adult-use programs under the Medicinal and Adult-Use Cannabis Regulation and Safety Act (MAUCRSA), and since 2021 a single regulator — the Department of Cannabis Control (DCC) — administers the whole industry under Business & Professions Code Division 10 and the DCC regulations at California Code of Regulations, Title 4, Division 19. (The DCC replaced the three former agencies; cite the DCC, not its predecessors.)
For manufacturers, GMP is the law. The DCC's Good Manufacturing Practices article (4 CCR §§17207–17218) requires a self-administered quality-control program, sanitary premises and equipment, a written Product Quality Plan that performs a HACCP-style hazard analysis (§17214), a master manufacturing protocol, batch production records, written SOPs, and inventory control — and edible-handling personnel must hold an ANSI-accredited California food-handler certificate (§17211.1). Every batch must pass testing at an ISO/IEC 17025-accredited laboratory before sale (B&P §26100), and every licensee must maintain written recall procedures (§17226). What California does not do is require any accredited third-party GMP certificate — it names no private GMP standard (no SQF, BRCGS, FSSC, or CSQ), and the DCC verifies GMP through its own licensing inspections. California once considered even a voluntary state GMP certificate (AB 1833, 2019–2020), but it never became law. So in California CSQ is voluntary: accredited, independent proof of the GMP program the state already requires.
FIND YOUR PATH
Match Your California License to the Right CSQ Standard
CSQ is voluntary in California, so this is about which scope fits if you pursue certification. Match your DCC license to the CSQ standard that fits; operators who hold more than one license (California allows vertical integration via the microbusiness license) can combine scopes into one coordinated audit with Kiwa ASI.
Cultivation (Types 1–5)
B&P §26050(a) · 4 CCR Div. 19STANDARD
CSQ Cultivation v2.0.0
MINIMUM LEVEL
Level 1
PREP TIME
6–9 months
AUDIT LENGTH
~1 day onsite + 1 day offsite doc review (initial)
Cultivation, drying, curing, and trimming. Foundation: cGACP (good agricultural and collection practices) plus cGMP. California licenses cultivation in small-to-large size classes plus nursery; every batch is lab-tested at the distribution stage before it can be sold at retail.
Manufacturer 2 — Volatile (Type 7)
Type 7 · 4 CCR §§17207–17218STANDARD
CSQ Extraction / Manufacturing v2.0.0
MINIMUM LEVEL
Level 1
PREP TIME
6–9 months
AUDIT LENGTH
~1 day onsite + 1 day offsite doc review (initial)
Volatile-solvent extraction and manufacturing of concentrate and infused products. This is where California's DCC GMP program (§§17207–17218) bites hardest, and where CSQ maps most directly. CSQ items to watch: beverage-grade CO₂ (99.5%), food-grade non-denatured ethanol, and residual-solvent controls.
Manufacturer 1 — Non-Volatile / Infusion (Type 6 / N)
Type 6 / N · 4 CCR §§17207–17218STANDARD
CSQ Manufacturing v2.0.0
MINIMUM LEVEL
Level 1
PREP TIME
4–6 months
AUDIT LENGTH
~1 day onsite + 1 day offsite doc review (initial)
Non-volatile and mechanical extraction, and infusion of edibles, beverages, and topicals. Full GMP program applies: written product quality plan (§17214), master manufacturing protocol, batch records, and SOPs. Edible-handling staff need an ANSI-accredited California food-handler certificate (§17211.1).
Retailer (Type 10)
Type 10 · 4 CCR Div. 19STANDARD
CSQ Retail v1.0.0
MINIMUM LEVEL
Level 1
PREP TIME
4–6 months
AUDIT LENGTH
~1 day onsite + 1 day offsite doc review (initial)
Storefront and non-storefront (delivery) retailers. Built on cGHP (good handling practices) — storage, handling, inventory, track-and-trace verification, and staff training.
Testing Laboratory (Type 8)
Type 8 · B&P §26100(i)STANDARD
ISO/IEC 17025
MINIMUM LEVEL
N/A
PREP TIME
Varies
AUDIT LENGTH
Per accreditation body
California requires cannabis testing laboratories to obtain and maintain ISO/IEC 17025 accreditation (B&P §26100(i)). CSQ does not certify testing labs; it requires them to be ISO/IEC 17025 accredited.
CALIFORNIA REQUIRES VS. CSQ GOES FURTHER
What's a State Rule, and What's a CSQ Best Practice?
California's regulations are the legal floor, enforced by DCC licensing, inspection, and mandatory lab testing. CSQ is a voluntary published standard that documents GMP beyond that floor — and gives independent proof of the program California already requires. Knowing which is which keeps you from over-buying or under-preparing.
What California requires (the legal floor)
- DCC licensing for cultivation, manufacturing, distribution, retail, and testing — MAUCRSA (B&P §26000 et seq.) + 4 CCR Div. 19
- A full documented GMP program for manufacturers: quality-control program, sanitary operations, a HACCP-style product quality plan, master manufacturing protocol, batch records, and written SOPs — 4 CCR §§17207–17218
- Edible-handling personnel hold an ANSI-accredited California food-handler certificate — 4 CCR §17211.1
- Mandatory pre-market testing by an ISO/IEC 17025-accredited laboratory — B&P §26100
- Written recall procedures (72-hour quarantine, 24-hour DCC notice) — 4 CCR §17226
- Packaging & labeling: child-resistant, tamper-evident, universal THC symbol, allergen labeling, THC limits — 4 CCR §§17304, 17404–17412
- No accredited third-party GMP certificate is required — California names no private GMP standard
What CSQ adds (voluntary best practice)
- An accredited (ISO/IEC 17065) cannabis GMP certification — independent, audit-ready proof of the GMP program California already requires
- Built to meet the food-safety and GMP practices California's DCC rules mandate (§§17207–17218)
- A documented internal audit program (Section 1.5) and CAPA system (Section 1.6)
- An annual mock recall (Section 1.8) and verified traceability test — proving out California's mandatory recall procedures (§17226)
- Cannabinoid and non-cannabinoid waste streams kept completely separated (Section 2A.4 / 2B.4)
- Beverage-grade CO₂ (99.5%) for extraction — medical-grade is not acceptable
- Inhalation-grade ingredients for inhalable products (food-grade/GRAS is not sufficient)
- DCC inspection readiness, investor/lender/M&A diligence, multi-state standardization, and retail/buyer assurance
- A HACCP team and certified lead (Level 2 only — not a California requirement)
Quick glossary — the terms that show up in a California CSQ audit
DCC
The Department of Cannabis Control — California's single cannabis regulator since 2021, when it consolidated the three former agencies (Bureau of Cannabis Control, CDPH Manufactured Cannabis Safety Branch, and CDFA CalCannabis).
MAUCRSA
The Medicinal and Adult-Use Cannabis Regulation and Safety Act — California's unified governing statute (B&P Code Division 10, §26000 et seq.), enacted 2017 to merge the medical and adult-use programs.
4 CCR Division 19
The DCC's implementing regulations (California Code of Regulations, Title 4, Division 19, §§15000–17905) — licensing, GMP, testing, packaging, labeling, and recalls. Uses current 15xxx/17xxx section numbers, not the legacy 5xxx numbers.
Product Quality Plan
The written HACCP-style hazard analysis California requires of manufacturers (4 CCR §17214), covering biological, chemical/radiological, and physical hazards — the DCC rule closest to a food-safety plan.
DCC GMP program
California's Good Manufacturing Practices article for manufacturers (4 CCR §§17207–17218): quality control, sanitation, personnel, the product quality plan, master manufacturing protocol, batch records, SOPs, and inventory control.
ISO/IEC 17025
The competence standard for testing laboratories. California requires cannabis testing labs to obtain and maintain ISO/IEC 17025 accreditation (B&P §26100(i)); CSQ requires labs to hold the same. It applies to labs only, not manufacturers.
ISO/IEC 17065
The accreditation standard for bodies that certify products and processes. CSQ is delivered by ASI Food Safety as an ISO/IEC 17065-accredited certification body — the basis for an independent, accredited GMP certificate.
Microbusiness (Type 12)
A single California license that allows vertical integration — at least three of cultivation, manufacturing, distribution, and retail under one operator (B&P §26070).
THE AUDIT
What a CSQ Audit Actually Looks Like
A California CSQ audit is an onsite review of your quality management system against the standard that fits each activity you perform. Here is how scoring, findings, and timing work — followed by the technical mapping table for the people who want it.
Scoring (100-point scale)
How CSQ scores you and what it means for your certificate
| Score | Outcome | Surveillance Cycle |
|---|---|---|
| 80–100 | Certificate issued | Annual surveillance audit |
| 70–79 | Certificate issued | 6-month surveillance audit |
| Below 70 | No certificate | 6-month wait before re-audit |
Findings categories
CRITICAL · –100 POINTS
Auto-fail finding
Regulatory non-compliance, product safety risk, or foundational QMS breakdown. A single Critical finding fails the audit regardless of other scores.
MAJOR · –10 POINTS
Significant gap
Systemic failures or significant deviations from CSQ requirements — not an immediate safety risk but requires corrective action.
MINOR · –1 POINT
Isolated finding
Documentation gap, single-occurrence lapse, or correctable deviation that is not systemic.
Audit timing & certificate validity
What to expect onsite and on the calendar
| Item | Detail |
|---|---|
| Level 1 audit | 1 day onsite + 0.5 day report time |
| Level 2 audit | 1.5 days onsite + 1 day report time |
| Level 3 audit | 2 days onsite + 1 day report time (unannounced window) |
| Initial audit add-on | +1 day for offsite documentation evaluation (all levels) |
| Corrective action window | 30 days to close nonconformities |
| Certificate validity | 1 year + 45 days from audit date |
| Initial certification blackout | No initial certifications scheduled in November or December |
| Provisional certificate | Available for new operations (valid 6 months) |
| Dietary Supplement Addendum | 4-hour minimum · Pass/Fail · separate report within 72 hours |
For consultants, internal compliance leads, and operators who want the section-by-section map between California's regulations and CSQ 2.0:
California cannabis rules and corresponding CSQ 2.0 sections
| Missouri Requirement | Citation | CSQ Coverage |
|---|---|---|
| DCC licensing of cannabis operators | B&P §26050 / 4 CCR Div. 19 | Module 1 (CSQMS) + Section 1.3 (Regulatory Compliance) |
| DCC Good Manufacturing Practices program | 4 CCR §§17207–17218 | Module 2A (cGMP) + Section 3C (formulated / ingestible product controls) |
| Written product quality plan (HACCP-style hazard analysis) | 4 CCR §17214 | Section 1.7 (Hazard Analysis) + Module 2A (cGMP) |
| Written standard operating procedures | 4 CCR §17217 | Module 1 (CSQMS) + Section 1.4 (Document Control) |
| Pre-market testing; labs ISO/IEC 17025 accredited | B&P §26100(a),(i) | Section 2A.12.9 / 2B.11.7 (Product Sampling and Testing) — CSQ requires ISO/IEC 17025 labs |
| Packaging, labeling, allergen, and THC-limit rules | 4 CCR §§17304, 17404–17412 | Section 2A.12.8 / 2B.11.6 (Product Labeling and Packaging) |
| Written recall procedures; agency-ordered recalls | 4 CCR §§17226–17227 | Section 1.8 (Recall & Traceability) + Section 1.6 (CAPA) |
How to Prepare | A Realistic Path to CSQ Certification
Because CSQ is voluntary in California, step one is deciding whether it earns its place for you. If it does, most operators need 4 to 9 months, depending on license type and scope, to be ready for an initial audit. Here is a sequence that works.
01
Decide whether CSQ is right for you
California doesn't require it, so weigh the value: DCC inspection readiness, investor / lender / M&A diligence, multi-state standardization, and retail or buyer assurance. Because California already mandates a documented GMP program, CSQ mostly certifies what you are already doing. If those matter, CSQ is worth pursuing.
02
Confirm your CSQ standard and level
Match your DCC license — cultivation, Manufacturer 1/2, retail — to its CSQ standard, and decide whether Level 1 is enough or you want Level 2/3. Write the answer down; it drives every other step.
03
Run a gap analysis
Compare your current state to the CSQ standard, mapped against California's DCC GMP program (4 CCR §§17207–17218). ASI Training and Consulting, LLC can deliver a structured gap analysis as a separate engagement from the certification body.
04
Build the QMS documentation
Extend the documents California already requires — your product quality plan (§17214), master manufacturing protocol, batch records, SOPs, and recall procedures (§17226) — into a full CSQ quality management system with CAPA, internal audit, and document control.
05
Address the cannabis-specific Critical items
The findings most likely to fail a first audit: CO₂ purity, ethanol grade, inhalation-grade ingredients, waste-stream separation, and route-of-administration risk assessments. Verify these before the auditor arrives.
06
Train your team and run internal audits
Deliver competency-based, role-specific training on GMP, hygiene, PPE, allergen handling, and traceability. Then conduct a documented internal audit and an annual mock recall, and close nonconformities through CAPA.
07
Schedule your CSQ audit with Kiwa ASI
Schedule through Kiwa ASI in the CSQ Database. Allow time for the offsite documentation evaluation (1 day) plus the onsite audit (1–2 days depending on level). Request a quote to start.
Why California Operators Choose Kiwa ASI
Kiwa ASI brings nearly a century of food safety expertise and the global Kiwa network's footprint in 30+ countries to California — the largest U.S. cannabis market by total sales, and one that already regulates manufacturing with a detailed, food-style GMP program.
Accredited
ISO/IEC 17065 + CSQ-Licensed
Audits and certificates are issued by ASI Food Safety, LLC — an ISO/IEC 17065-accredited certification body licensed by CSQ.
Expertise
Food-grade rigor for cannabis
Our auditors are credentialed food safety, GMP, and HACCP professionals with cannabis-specific qualifications. Cannabis is being regulated like food. We've been doing food for decades.
Efficiency
Direct scheduling, no surprises
Pre-audit scoping clarifies level, scope, and Module 3 requirements before you're onsite. Audit reports are turned around inside the standard CSQ timeline.
Comprehensive
Training and consulting available
Pre-assessments and gap analyses are delivered by ASI Training and Consulting, LLC, a separate legal entity, kept structurally separate from the certification body to safeguard impartiality under ISO/IEC 17065.
Continuity
Surveillance, recertification, transfer
If you're already CSQ-certified through another body and the relationship isn't working, we accept transfer audits. Continuity matters as much as the initial certificate.
Partnership
Global Kiwa network
Operations in 30+ countries. Useful when a California operator expands into other state markets or builds an international supply chain.
Frequently Asked Questions About California Cannabis GMP & CSQ Certification
No. California does not mandate an accredited third-party GMP certificate, and it names no private GMP standard. But GMP itself is required: manufacturers must run the DCC Good Manufacturing Practices program (4 CCR §§17207–17218) — a quality-control program, a written product quality plan, master manufacturing protocol, batch records, and SOPs — every batch is lab-tested (B&P §26100), and every licensee keeps written recall procedures (§17226). CSQ certification is voluntary: accredited, independent proof of that program.
Both. California legalized medical cannabis in 1996 (Proposition 215, the Compassionate Use Act) and adult-use (21+) in 2016 (Proposition 64). The two programs were unified in 2017 under the Medicinal and Adult-Use Cannabis Regulation and Safety Act (MAUCRSA), which the Department of Cannabis Control administers today.
The Department of Cannabis Control (DCC), a single agency within the Business, Consumer Services and Housing Agency. Since 2021 the DCC has consolidated the three former cannabis agencies (the Bureau of Cannabis Control, CDPH's Manufactured Cannabis Safety Branch, and CDFA's CalCannabis) into one regulator, operating under B&P Code Division 10 and the DCC regulations at 4 CCR Division 19.
Yes — as a mandated, documented program, not a certificate. The DCC Good Manufacturing Practices article (4 CCR §§17207–17218) requires a quality-control program, sanitary operations, a written product quality plan doing a HACCP-style hazard analysis (§17214), a master manufacturing protocol, batch records, written SOPs, and inventory control. Edible-handling personnel also need an ANSI-accredited California food-handler certificate (§17211.1). The DCC verifies all of this by licensing inspection — California does not require a third-party GMP certificate.
No. GMP compliance is verified through DCC licensing and inspection, mandatory lab testing, and each licensee's own recordkeeping — not by a required outside auditor. California once considered even a voluntary, state-run GMP certificate (AB 1833 in 2019–2020), but that bill never became law. A CSQ certificate is voluntary and does not replace DCC licensing or lab testing.
No. California's statutes (B&P Division 10) and DCC regulations (4 CCR Division 19) name no private food-safety or GMP standard for manufacturers — not CSQ, SQF, BRCGS, FSSC, or ISO. The only ISO standard California names is ISO/IEC 17025, and that applies to testing laboratories, not manufacturers. CSQ is a voluntary, accredited option delivered by ASI Food Safety, not a legal requirement.
Cultivators use CSQ Cultivation v2.0.0; Manufacturer 2 (volatile) operators use CSQ Extraction or Manufacturing v2.0.0; Manufacturer 1 (non-volatile / infusion) operators use CSQ Manufacturing; retailers use CSQ Retail v1.0.0. Testing laboratories follow ISO/IEC 17025 (CSQ does not certify labs but requires ISO/IEC 17025). Kiwa ASI can combine scopes into one coordinated audit.
Because it turns the GMP program California already mandates into accredited, independent proof. The highest-value cases: DCC inspection readiness, investor / lender / M&A due diligence, a multi-state operator standardizing GMP across programs, and retail or buyer assurance — plus audit-ready records for edibles and beverages. You are largely certifying work you already have to do.
There is no single published price: cost depends on which CSQ standards apply, which level you pursue, facility size and complexity, whether it is your initial audit (which adds an offsite documentation day), and whether you combine multiple facility scopes. Most operations need 4 to 9 months to prepare, depending on license type and scope; a Level 1 audit is roughly 1 onsite day plus report time. Request a quote for a California-specific scope.
Yes — but as separate legal entities to safeguard certification-body independence. CSQ certification audits are delivered by ASI Food Safety, LLC (the accredited certification body, ISO/IEC 17065 accredited and CSQ-licensed). Pre-assessments, gap analyses, training, and consulting are delivered by ASI Training and Consulting, LLC. The two operate independently to comply with ISO/IEC 17065 impartiality rules.