Live instructor-led training is 20% off through December 31, 2026 Live training is 20% off through Dec 31 Code: sweaterweather20 View courses
Phone hotline 1 (800) 477-0778 · US.Info@kiwa-asi.com
Kiwa ASI
Nearly a century of food safety expertise, headquartered in St. Louis.
Audits & Inspections
Independent second- and third-party audits for facilities at every stage.
Not sure which audit you need? Answer a few questions and see what fits. It takes about a minute.
Try the Audit Finder →cGMP Audits
Sector-specific Good Manufacturing Practice audits.
GFSI Certification
GFSI-benchmarked programs accepted by major retailers worldwide.
Not sure which audit you need? Answer a few questions and see what fits. It takes about a minute.
Try the Audit Finder →Cannabis Certification
Prove product safety in cultivation, extraction and manufacturing.
Cosmetics Certification
GMP for the cosmetics industry, including MoCRA readiness.
Dietary Supplement Certification
Go beyond basic GMPs with GFSI-benchmarked quality management.
CSR & Sustainability
Certifications for sourcing, allergens and environmental claims.
Food & Beverage
Find your sector. The tag shows the program most of our clients in that sector certify to.
ProcessingProgram
Ingredients & BeverageProgram
Cannabis
CSQ, GMP and state-specific regulatory audits.
Certification
State programs
In every tier, CSQ certification is an independent way to prove your program.
Regulatory QMS
Not sure which program your license requires? Our team maps state rules to the right audit.
Talk to a cannabis specialist →Cosmetics
GMP verification for beauty and personal-care manufacturers.
Dietary Supplements
FDA 21 CFR 111 compliance and GFSI-level quality.
Live Instructor-Led Training
Virtual classes led by Kiwa ASI instructors.
SQF Edition 10
FDA & Regulatory
Hazards & Controls
Live Trainings in St. Louis
In-person classes at our St. Louis headquarters.
Online Self-Paced Training
Short courses built by Kiwa ASI. Train anytime, on any device.
Frontline · $25 a seat
QA & Management · $499
Team training? Volume pricing from $12 a seat on the 30-minute frontline courses.
See volume pricing →Free Webinars
A 6-part 2026 series on SQF Edition 10, supplier management and compliance.
Resources
Articles, answers and media from the Kiwa ASI team.
Forms
Order certification banners or submit feedback.
Show Me Food Safety Scholarship
Supporting the next generation of food safety professionals.
California already mandates the GMP program. Every licensed manufacturer must run a documented quality program under 4 CCR sections 17207 to 17218, every licensee must keep written recall procedures, and every batch is tested by an ISO/IEC 17025 accredited laboratory before retail. The Department of Cannabis Control verifies it all through licensing inspection. What California does not have is a certificate: no state GMP certificate exists, and no third-party certification is required. Kiwa ASI audits and certifies cannabis and hemp operations to CSQ, the voluntary, independently audited way to prove the program you already run.
Last updated October 29, 2026
Tell us your license types, what you grow or make, and where you operate. We’ll confirm your CSQ standard and level, quote the audit, and map co-located scopes so one visit covers them, each assessed individually.
No certificate is required, and none exists: California has neither a mandatory nor a voluntary state GMP certification (a bill to create even a voluntary one, AB 1833, died in 2020). What California has instead is one of the most detailed written GMP mandates in cannabis. Since the Department of Cannabis Control consolidated the program in 2021, every licensed manufacturer has owed a full documented GMP program under the DCC Good Manufacturing Practices article (4 CCR sections 17207 to 17218). Product-specific rules extend it to cannabis beverages and dried-meat products (sections 17219 and 17220). Here is the short version.
July 1, 2026: SB 170 moved the Department of Cannabis Control into the Business and Consumer Services Agency, and new sanitation rules for handling non-manufactured cannabis took effect (4 CCR sections 15060 to 15070). October 1, 2026: updated pesticide action levels for testing. Already in force under AB 8: licensed cannabis businesses may not handle industrial hemp before January 1, 2028, and from that date intoxicating hemp products must follow the same DCC rules as cannabis. The full hemp timeline is below, under Testing, Recalls and Hemp.
A documented GMP program for every licensed manufacturer (4 CCR §§17207–17218): a quality-control program, sanitary premises, maintained equipment, personnel hygiene and allergen controls, a documented training program, approved components, a written product quality plan, master manufacturing protocols, batch records, SOPs, and inventory control. Add written recall procedures for every licensee (§17226), batch testing through ISO/IEC 17025 accredited labs before retail (B&P §26100), and child-resistant, tamper-evident packaging with THC caps (§§17304, 17404–17412).
Third-party certification. No California statute or rule requires a CSQ, GFSI or any other certificate, and the state runs no scheme of its own. A CSQ audit is the voluntary way to prove, to buyers, investors, and partners, that the GMP program California already requires actually runs, verified by an independent certification body.
The Department of Cannabis Control, through routine and complaint-driven inspections of licensed premises, escalating from a Notice to Comply through citations, embargoes, suspension and revocation. Its published self-inspection checklist tells manufacturers what inspectors evaluate, from track-and-trace entries to the product quality plan. Outside state visits, California requires no independent verification of your quality system on any schedule; it happens only if you choose it. That gap is where certification earns its keep.
California’s licensed operators: cultivators, Manufacturer 1 and 2 (Types 6 and 7), Type N infusion, processors, distributors, retailers and microbusinesses. All of them work under the dual system, where every operator needs both a DCC state license and local authorization, and, as of October 2026, most cities and counties allow no cannabis retail at all.
California already requires the hazard-analysis discipline. Every licensed manufacturer must build a written product quality plan for each product type, walking each step from component intake to transfer, evaluating biological, chemical, and physical hazards plus process failures, and setting preventive measures, monitoring methods, and corrective actions (4 CCR section 17214). The plan must be available to the Department, including during onsite inspection. Four things follow from that.
A product quality plan is a hazard analysis by another name: hazards identified step by step, preventive measures assigned, monitoring defined, corrective action planned. DCC’s own guidance describes it as mirroring the food industry’s food safety plan, and notes that each product type requires its own plan. If your plan is honest and current, the core work behind a quality system already exists.
CSQ Level 2 and above formalizes the same discipline into a full Codex HACCP system: a documented flow diagram, critical control points with measurable critical limits, validation and annual reanalysis, and a HACCP team led by one individual and one back-up certified in a course approved by the International HACCP Alliance (CSQ Standard for Manufacturing, Module 4A). A CSQ audit then tests whether the system behind the plan actually runs.
For cannabis juice and cannabis-infused beverages, California separately requires a written juice HACCP plan under 21 CFR Part 120 (4 CCR section 17219), and DCC allows one document to serve as both the product quality plan and the juice HACCP plan. A beverage maker is already running one true HACCP plan, which makes the step to CSQ’s Module 4A shorter.
DCC’s own guidance is blunt: regulatory compliance testing does not account for all possible hazards that could be introduced into a product during the manufacturing process. The batch test catches a failure after it happens; the quality system is what prevents it. That is exactly the layer a CSQ audit examines, record by record.
Where a CSQ audit fits, stated plainly. A CSQ certificate never replaces the product quality plan itself, which is a California license requirement the Department of Cannabis Control verifies through inspection. Certification is voluntary, independent proof that the plan and the system around it run as written, from an ISO/IEC 17065 accredited certification body.
The GMP article is only part of California’s stack. Four more rule sets shape how a quality program has to run, and each maps to disciplines a CSQ audit samples.
Every batch must be tested by a licensed laboratory before retail sale (B&P section 26100), and California writes ISO/IEC 17025 accreditation for those labs directly into the statute. Testing happens at the distribution stage: the distributor holds each batch while a lab samples it on video at the distributor’s premises, and reviews the certificate of analysis and labeling before anything moves to a store (4 CCR §§15304–15307).
Every licensee must keep written recall procedures: triggers, named personnel, notification protocols, and collection and destruction steps, with recalled goods quarantined at least 72 hours and the Department notified within 24 hours of starting a recall (4 CCR §17226). CSQ asks for the same written plan and then makes you prove it works: an annual mock recall completed in under two hours and a live traceability exercise at every audit (CSQ 1.8), plus 72-hour notice to the certification body of any real recall (CSQ Certification Program Requirements, Part 2, Section 3.10).
Child-resistant packaging, tamper-evident and opaque containers for edibles, the universal symbol in black or white, ingredient lists with a contains statement for allergens, and THC caps of 10 mg per serving and 100 mg per package for adult-use edibles (4 CCR §§17304, 17404–17412). Formulation, blending and dosing controls are what keep products inside those caps, and they are exactly what the audit samples (CSQ Manufacturing, Section 3C.1.10).
California is folding intoxicating hemp into the licensed cannabis system. Under AB 8, licensed cannabis businesses may not handle industrial hemp before January 1, 2028, and starting January 1, 2028 intoxicating hemp products must be manufactured, tested, and sold under the same DCC rules as cannabis, including the GMP article and a DCC manufacturing license. Hemp manufacturers preparing for DCC licensure can use CSQ certification to build those systems now.
Why this matters in practice: the Department published 35 recall notices in 2026 through October 29, after 93 in 2025. Recent recalls cite undeclared allergens on an edible label, failed beverage packaging seals, Aspergillus mold in pre-rolls, and cannabis from one supplier grown under unsanitary conditions with pesticide violations that reached finished tinctures, flower, and pre-rolls at two licensees. Ingredient intake, supplier approval, allergen declaration and packaging controls are precisely what a CSQ audit verifies (Sections 2A.11, 2A.10.2, 2A.12.7, 2A.12.8). Certification never replaces compliance with the rules themselves: the positive ingredient lists, testing gates and packaging rules are conditions of your California license.
CSQ publishes separate standards for cultivation, extraction, manufacturing, retail, and warehousing and distribution, so California’s license types map cleanly onto one or more scopes. California names no level and no standard; the readiness checklist below shows what each level covers. If you hold more than one scope, co-located scopes can be audited in the same visit, with each scope assessed individually; ask us to map yours.
Growing, harvesting, drying, curing and post-harvest handling under cultivation licenses (Types 1 through 5B and nursery) and Type 14 processor licenses. Since July 1, 2026, handlers of non-manufactured cannabis also owe the new sanitation rules (4 CCR §§15060–15070): daily equipment sanitizing, handwashing or food-safe gloves, and animal exclusion. CSQ Cultivation is a cGACP and cGMP certification program with a HACCP module based on Codex Alimentarius at Level 2 and above.
Volatile-solvent extraction under Type 7 and non-volatile extraction under Type 6. California hooks: the GMP article applies in full, extraction ethanol must be food grade (4 CCR §17204(a)(4)), closed-loop procedures belong in your SOPs (§17217), and failed batches are rendered unusable on video under the waste rules (§17223).
Edibles, beverages, vapes, topicals and pre-rolls under Type 6 and Type N licenses. California hooks: the full GMP article including the product quality plan (§17214), the edible ingredient positive list (§17301), the inhalable ingredient positive list (§17303.1), THC caps (§17304) and the packaging rules. Beverage makers also owe the juice HACCP plan (§17219), the shortest runway to CSQ Level 2.
Type 11 distributors hold every batch through testing, run the quality-assurance review, and move product in enclosed, locked, alarmed vehicles on manifests generated before transport (4 CCR §§15304–15307, 15311–15314). Standalone distribution operations map to CSQ Warehousing & Distribution, Version 1.0; distribution duties inside a producer license are covered by your standard’s storage and distribution sections.
Storefront retail (Type 10) and non-storefront delivery retail (the regulation-created Type 9 non-storefront license, 4 CCR §15414), under the retail chapter’s storage, inventory and handling rules. CSQ Retail is built on current good handling practices: inventory, storage, customer-facing controls and staff training. Pure buyer-assurance best practice; California requires no certificate for retailers.
Labs follow their own lane: California writes ISO/IEC 17025 accreditation into the statute itself (B&P §26100), and the lab chapter leans on further ISO standards for reference materials and proficiency testing. That is a state requirement, not a CSQ scope: CSQ publishes no laboratory standard, and Kiwa ASI does not provide laboratory testing.
Multi-scope sites are the California normal. A Type 12 microbusiness runs at least three of cultivation, manufacturing, distribution, and retail on one licensed premises (4 CCR section 15500), its manufacturing follows Manufacturer 1 rules, and many operators stack a Type 6 or Type 7 license beside a cultivation license on the same property. CSQ handles this with separate standards per activity. Co-located scopes can be audited in the same visit; each scope is assessed individually against its own standard. Ask us to map your licenses to the right set of standards before you schedule.
California’s rules are the legal floor, and for manufacturers that floor is genuinely manufacturing-grade. CSQ is a published, cannabis-specific standard that adds verified best practice the rules don’t spell out, plus an independent annual check between state inspections.
An initial CSQ audit has three parts: a one-day offsite evaluation of your documentation (no more than six months before the site visit), the onsite audit, and the report. Minimum onsite time is 1 day at Level 1, 1.5 days at Level 2 and 2 days at Level 3, plus report time; Level 3 onsite audits are unannounced. Your actual time depends on the standards in scope and the size of your site. The auditor checks your written system against CSQ and California’s rules (CSQ 1.3, Regulatory Compliance), watches your people work, and samples your records.
| Module | What the auditor checks |
|---|---|
| 1 Management system (all levels) | Documented CSQ system with SOPs and a copy of California’s rules, management commitment, regulatory compliance, records, internal audits, CAPA, complaints, recalls and withdrawals, product defense, fraud prevention and crisis management |
| 2A Good manufacturing practices (cultivation, extraction, manufacturing, deli-style) | Facility and infrastructure, equipment and calibration, cleaning and sanitation, waste, integrated pest management, air and water safety, environmental monitoring, storage, inventory and traceability, supplier approval, production and process controls, labeling and packaging, product testing, personnel |
| 2B Good handling practices (CSQ Retail, Version 1.0) | The retail twin of Module 2A: facility, sanitation, storage and temperature control, inventory management, product handling controls, labeling, sampling and personnel, built for dispensary operations |
| 3A / 3B / 3C / 3D / 3E Products and processes (all levels) | Cultivation (3A): water, fertigation, crop maintenance, harvest. Extraction (3B): process gases and solvents, extraction equipment, post-processing. Manufacturing (3C): ingredients, formulation, inhalable, ingestible and topical product controls, homogeneity and dosing. Deli-style retail (3D): herbal-material handling and pre-roll production. Retail (3E): cannabinoid materials and products handled at the store |
| 4A / 4B HACCP (Level 2 and above) | Hazard analysis, critical control points, monitoring, corrective actions, validation and verification. Module 4A (producers and deli-style) also requires a HACCP team with one member and a back-up certified through an IHA-approved course; plain Retail is audited to the basic HACCP module 4B |
| 5 Advanced quality management (Level 3) | Advanced management system requirements, safety and quality culture, customer satisfaction and product realization; Level 3 onsite audits are unannounced |
| Mock recall and traceability | Your annual mock recall record, plus a traceability exercise during the audit |
Each audit starts at 100, and every nonconformance deducts points. The final score decides the outcome:
| Result | Score | What happens next |
|---|---|---|
| Certified | 80–100 | Certificate; next annual certification audit in a year |
| Certified with surveillance | 70–79 | Certificate plus a surveillance audit in six months; a score of 79 or below on that audit suspends the certificate |
| Not certified | 0–69 | No certificate; wait six months before reapplying |
Certificates are valid for one year plus 45 days and are listed on CSQ’s public registry, where your wholesale buyers and anyone else can look them up.
A requirement that has not been implemented and is a significant risk to product safety and quality. A critical finding fails the audit.
A deficiency in meeting a CSQ requirement that, if not addressed, will likely lead to a risk to product safety and quality.
A deficiency in meeting a CSQ requirement that, if not addressed, may lead to a risk to product safety or quality.
After the audit: corrective actions must be approved and closed within 30 calendar days of the closing meeting, and the final report and certificate follow within about 45 days. Every certified site also gets an unannounced audit at least once every three years. Agree blackout dates with us for days your operation won’t be running, and submit them no later than 60 days before the unannounced audit window; refusing an unannounced audit suspends the certificate.
The Department of Cannabis Control inspects against the GMP article, its own self-inspection checklist tells you what inspectors look for, and a CSQ audit samples the same disciplines. Use this list to check you’re ready before anyone arrives.
| California requirement | Citation (4 CCR / B&P) | CSQ sections |
|---|---|---|
| Quality-control program | 4 CCR §17208 | 1.1 Cannabis Safety and Quality Management System (General Requirements) + 1.2 Management Commitment + 1.3 Regulatory Compliance + 2A.13.1 Personnel Roles and Responsibilities |
| Premises, grounds, sanitation, water | §17209 | 2A.1 Facility and Facility Infrastructure + 2A.3 Cleaning and Sanitation + 2A.5 Integrated Pest Management + 2A.6 Facility Air Safety and Quality + 2A.7 Facility Water Safety and Quality |
| Equipment and utensils | §17210 | 2A.2 Equipment, Maintenance, and Calibration + 2A.3 Cleaning and Sanitation |
| Personnel hygiene; allergen cross-contact | §17211 | 2A.13 Personnel Requirements (2A.13.3 to 2A.13.7) + 2A.12.7 Allergen Management |
| Training program incl. the food-handler course | §17211.1 | 2A.13.2 Personnel Training + 2A.13.1 Personnel Roles and Responsibilities |
| Components; edible ingredient positive list | §17212; §17301 | 2A.11 Supplier Approval and Vendor Qualifications + 2A.10.2 Acceptance and Release + 2A.10.4 Hold and Release (Quarantine) + 3C.1.8 Non-Cannabinoid Ingredients Used During Manufacturing |
| Product quality plan; beverage HACCP | §17214; §17219 | Module 4A HACCP (Level 2 and above) + 2A.12.2 Process Flow, Segregation, and Cross-Contamination Prevention + 2A.12.6 Cross-Contamination Controls |
| Master manufacturing protocol; batch records | §17215; §17216 | 1.4 Documentation and Recordkeeping + 2A.12.1 Standard Operating Procedures + 2A.10.1 Identification and Traceability + 3C.1.10 Blending, Compounding, Formulation, and Mixing |
| Standard operating procedures | §17217 | 2A.12.1 Standard Operating Procedures + 1.9 Product Defense + 1.11 Crisis Management |
| Inventory control and reconciliation | §17218 | 2A.10 Inventory Management (2A.10.1 Identification and Traceability + 2A.10.3 Stock Management) |
| Complaints; written recall procedures | §§17225–17227; B&P §26039.1 | 1.7 Complaint Management + 1.8 Product Recalls and Withdrawals + 1.6 Corrective Actions and Preventive Actions (CAPA) |
| Distribution-stage testing; ISO/IEC 17025 labs | B&P §§26100, 26110; 4 CCR §§15304–15307 | 2A.12.9 Product Sampling and Testing + 2A.10.4 Hold and Release (Quarantine) |
| Packaging, labeling, THC limits | §§17404–17412; §17304 | 2A.12.8 Product Labeling and Packaging + 3C.2.6.2 Allergen Declaration + 3C.1.10 Blending, Compounding, Formulation, and Mixing |
| State track and trace | 4 CCR §§15048–15049; §17218(b) | 2A.10.1 Identification and Traceability + 2A.10.3 Stock Management + 1.4 Documentation and Recordkeeping |
| Waste management | §17223 | 2A.4 Waste Management (2A.4.1 Cannabinoid Waste; 2A.4.2 Non-Cannabinoid Waste) |
| Transport and distribution | §§15311–15314; B&P §26110 | 2A.9 Storage and Distribution (2A.9.4 Shipping and Receiving) + 1.9 Product Defense |
| Dispensary handling, storage, inventory and labeling (CSQ Standard for Retail & Deli-Style Retail, Version 1.0) | Type 10 and non-storefront retail; 4 CCR §§15400–15427 | Module 2B + 2B.8 Storage and Distribution + 2B.9 Inventory Management + 2B.11 Product Handling Controls + 2B.12 Personnel Requirements + Module 3E |
Mapping by Kiwa ASI to CSQ Version 2.0 producer standards and CSQ Retail, Version 1.0; California names no scheme and no level, and the mapping is Kiwa ASI’s reading of where each duty lands in CSQ, not a state-endorsed crosswalk. Level 1 covers the management system, good-practices, and products-and-processes modules (Modules 1 to 3); Level 2 and above add HACCP. Ask us which configuration fits your facility.
California sets no deadline and schedules nothing: certification is voluntary, and DCC inspections arrive on the Department’s clock, not yours. That makes the sequence yours to control. Work from readiness, not a date.
California will not ask you for it, so be clear about who will: wholesale buyers and retail chains doing supplier diligence, investors and lenders, multi-state partners standardizing quality programs, and your own inspection readiness. Write the answer down; it drives scope, level and timing.
Match CSQ Cultivation, Extraction, Manufacturing, Retail or a combination to what you actually do, and choose a level: Level 1 is a complete good-practices and quality management certification (cGMP on the producer standards, good handling practices on Retail), Level 2 and above add HACCP. Multi-scope sites are the California normal, so ask us to map licenses to standards before you schedule.
A quality manual on your chosen standard, built over the documents California already requires: your product quality plans, master manufacturing protocols, batch records, SOPs, written recall procedures, supplier approval with certificates of analysis, sanitation and environmental monitoring, traceability tied to the state track and trace system, internal audit and CAPA. Your program manager also takes CSQ’s online Certification Program Overview course, accessed through the CSQ website.
Run the training program California requires: onboarding within 30 days, pre-process training, annual refreshers, records, and the ANSI-accredited food handler course for edible-product personnel, completed within 90 days and renewed every three years (4 CCR §17211.1). Train every person on GMP, hygiene and their own procedures, and for Level 2 and above have one HACCP team member and a back-up certified through a course approved by the International HACCP Alliance.
Operate the system, and build up about 60 days of records, which CSQ recommends before certification. Run a documented internal audit and a mock recall in under two hours, close what you find through CAPA, and check yourselves against the published standard before the real audit, a step CSQ strongly recommends and one your own team can run. Kiwa ASI audits and certifies; it does not prepare the system for you.
Sign the certification agreement with ASI Food Safety, LLC and set your audit dates with our certification team. Send your documents for the offsite evaluation, which can happen up to six months before the onsite audit, and pick an onsite date that leaves time for corrective actions.
Close corrective actions within 30 days of the closing meeting and, with a passing score, receive your certificate, typically within about 45 days of the audit. Keep it current with the annual certification audit: a current certificate is standing, independent proof of the GMP program California already requires you to run.
A worked example, on your own clock: because California sets no deadline, the calendar is yours. A manufacturer that decides in January to pursue Level 2 would spend the first months extending its product quality plan into a full Codex HACCP system and getting an IHA-approved HACCP course completed by a lead and a back-up. The system is generating records by spring (CSQ recommends about 60 days of records). The one-day offsite documentation evaluation lands in early summer, the 1.5-day onsite audit in late summer, corrective actions close within 30 days, and the certificate, valid for one year plus 45 days, arrives inside the year. A score below 70, or any critical finding, means a six-month wait before reapplying, which is the practical argument for one well-prepared attempt. Put your licenses in the form above and we’ll tell you the earliest audit dates we can offer.
Live online courses, taught by experienced food safety trainers, for the GMP disciplines California’s rules expect and the qualifications CSQ asks for. CSQ’s own Certification Program Overview course for your program manager is taken online through CSQ.
One day on current Good Manufacturing Practices for the people who run your floor every day, the discipline California’s GMP article (4 CCR §§17207–17218) already mandates.
8 contact hours · 1 full day · Live via Zoom · 8:30 AM–4:30 PM CT
Dates on request. Ask about upcoming dates
IHA-accredited HACCP certification. CSQ Level 2 and above on Cultivation, Extraction, Manufacturing and Deli-Style Retail need one HACCP team member and a back-up certified in an IHA-approved course (4A.2).
16 contact hours · 4 half-days · Live via Zoom · 8:30 AM–12:30 PM CT
Dates on request. Ask about upcoming dates
The FSPCA Preventive Controls for Human Food course, the food industry’s preventive-controls qualification in hazard analysis and risk-based preventive controls.
22 contact hours · 5 half-days · Live via Zoom · 8:30 AM–12:30 PM CT
Dates on request. Ask about upcoming dates
Plan, run and report the internal audits CSQ requires (1.5).
Full day · Live online · 8:30 AM–2:30 PM CT
Dates on request. Ask about upcoming dates
Design the risk-based environmental monitoring program CSQ requires (2A.8), a discipline California’s rules don’t spell out.
Half day · Live online
Dates on request. Ask about upcoming dates
Allergen risk assessment and cross-contact control for infused edibles and beverages, duties California writes into its GMP article and labeling rules (4 CCR §§17211, 17212, 17406).
4 hours · Live online
Dates on request. Ask about upcoming dates
Threat assessments and a defense plan, supporting CSQ’s product defense and fraud prevention requirements (1.9, 1.10).
Full day · Live online · 8:30 AM–2:30 PM CT
Dates on request. Ask about upcoming dates
Need to train 6+ people? Request private training. Training is delivered separately from certification by a different legal entity, and taking a course has no effect on your audit result.
Kiwa ASI has audited food safety and GMP programs for decades and brings the same discipline to California’s cannabis operators, in the largest U.S. cannabis market by total sales, where buyers and investors price in proof.
CSQ certificates are issued by ASI Food Safety, LLC (Kiwa ASI), CSQ’s licensed certification body, which is accredited to ISO/IEC 17065.
CSQ is purpose-built for cannabis operations, with standards covering cultivation, extraction, manufacturing, retail, and warehousing and distribution, each on three levels. You certify to a standard written for what you actually do, not a food scheme stretched to fit.
As of October 2026, the public CSQ registry lists 115 sites across 16 states. None is in California yet. In the largest U.S. cannabis market by total sales, California operators who certify now would be among the first in the state to hold a CSQ certificate.
CSQ auditors need bioscience education (or equivalent work experience), IHA-recognized HACCP training and CSQ lead auditor training, and can’t audit a site they provided consulting to, including delivering training, in the past three years.
CSQ is owned by ASI Global Standards, LLC, which, like ASI Food Safety, LLC, is part of ASI Holdings. CSQ discloses that relationship and publishes an impartiality statement. The same three-year consulting bar applies to auditors, and every report gets an independent technical review before a certificate is issued.
Part of Kiwa, a testing, inspection and certification group operating in more than 30 countries. Kiwa ASI audits and certifies; it doesn’t provide laboratory testing.
No certificate is required, and none exists, but the GMP program itself is mandatory. Every licensed manufacturer must run a documented GMP program under 4 CCR sections 17207 to 17218, every licensee must keep written recall procedures, and every batch is lab-tested before retail sale. The Department of Cannabis Control verifies it all through licensing inspection. Third-party certification such as CSQ stays voluntary: it is independent proof that the program California already requires actually runs.
A quality-control program, sanitary premises with potable water, maintained and calibrated equipment, personnel hygiene with allergen cross-contact controls, a documented training program, components from approved sources, a written product quality plan per product type, master manufacturing protocols, concurrent batch production records, written SOPs, and inventory control reconciled every 30 days (4 CCR sections 17207 to 17218). Cannabis beverages add a juice HACCP plan under 21 CFR Part 120 (section 17219), and dried-meat products follow section 17220.
The product quality plan (4 CCR section 17214) is a written, per-product-type hazard analysis: each step from component intake to transfer, the biological, chemical, and physical hazards plus process failures at each step, and the preventive measures, monitoring methods, and corrective actions that control them. It is HACCP-style discipline, though the plan itself is not a HACCP system. CSQ Level 2 and above formalizes it into full Codex HACCP: a flow diagram, critical control points with measurable limits, validation and annual reanalysis, and an IHA-certified HACCP lead and back-up (Module 4A). A CSQ certificate never replaces the product quality plan, which is a license requirement the Department inspects.
No. The rules name no private GMP standard (no CSQ, BRCGS, FSSC or SQF), and the state runs no certification program of its own; a 2019 bill to create even a voluntary state GMP certificate (AB 1833) died in 2020. The one accreditation California writes into statute is ISO/IEC 17025, and it applies to testing laboratories; the lab chapter also names further ISO standards for reference materials and proficiency testing. No scheme is named, required, or endorsed for cultivators, manufacturers or retailers.
Every licensee must keep written recall procedures covering triggers, named personnel, notification protocols, and collection and destruction steps, with recalled goods quarantined at least 72 hours and the Department notified within 24 hours of starting a recall (4 CCR section 17226). The Department can also order a recall (section 17227). CSQ asks for the same written plan and then makes you prove it works: certified operations run a mock recall at least annually and must complete it in under two hours, and your team performs a live traceability exercise at every audit (CSQ 1.8).
Testing happens at the distribution stage. The distributor holds each batch while a licensed laboratory samples it on video at the distributor’s premises, tests it, and issues a certificate of analysis; the distributor reviews the certificate and labeling before anything moves to a store (B&P sections 26100 and 26110; 4 CCR sections 15304 to 15307). California writes ISO/IEC 17025 accreditation for its cannabis labs directly into the statute, the same accreditation CSQ requires for finished-product compliance testing (Section 2A.12.9).
Adult-use edibles are capped at 10 mg THC per serving and 100 mg per package, with topicals and concentrates at 1,000 mg and defined medicinal exceptions (4 CCR section 17304). Packaging must be child-resistant and tamper-evident, edible packaging opaque, the universal symbol printed in black or white, and labels must list ingredients with a contains statement for allergens (sections 17404 to 17412). Homogeneity and dosing controls are what keep products inside the caps, and they are audit territory under CSQ Manufacturing Section 3C.1.10.
Cultivators and Type 14 processors use CSQ Cultivation; Type 7 and Type 6 extraction uses CSQ Extraction; Type 6 and Type N infused-product manufacturing uses CSQ Manufacturing; Type 11 distributors use CSQ Warehousing & Distribution, Version 1.0; dispensaries use CSQ Retail, Version 1.0. Co-located scopes can be audited in the same visit, with each scope assessed individually. Cultivation, Extraction and Manufacturing are on Version 2.0. Testing laboratories follow California’s own lane, ISO/IEC 17025 accreditation, which CSQ does not cover.
California sets no level, so the choice is yours. Level 1 (Modules 1 to 3) is a complete good-practices and quality management certification: cGMP on the producer standards, good handling practices on Retail. Level 2 adds a HACCP system, the natural step for manufacturers whose product quality plan already does hazard analysis. On the Cultivation, Extraction, Manufacturing and Deli-Style Retail standards it needs one team member and a back-up certified through an International HACCP Alliance approved course; plain Retail is audited to the basic HACCP module, which has no such staffing requirement. Level 3 adds advanced quality management, and its onsite audits are unannounced. On the public CSQ registry, every site certified to the Version 2.0 standards holds Level 1 or Level 2 as of October 2026.
Most operations need several months to build the system and collect records; CSQ recommends about 60 days of records before attempting certification, and in our experience California operations typically need 4 to 9 months of preparation depending on license type and scope (a Kiwa ASI estimate, not a CSQ figure). The audit itself is a 1-day offsite documentation evaluation, up to six months before the onsite visit, plus at least 1 day onsite at Level 1, 1.5 days at Level 2 or 2 days at Level 3. Corrective actions close within 30 days, and the final report and certificate follow within about 45 days. CSQ also has a provisional six-month certificate route for sites that must be audited before beginning operations.
There’s no single price. Audit time drives the fee: your CSQ level (1, 1.5 or 2 days onsite minimum), the standards in scope, the number of employees and product types, the 1-day documentation evaluation on initial audits, the number of sites and travel. Request a quote for your California scope.
Once a year. A CSQ certificate is valid for one year plus 45 days, so the annual certification audit keeps it current. A score of 70–79 adds a surveillance audit about six months later, and a score of 79 or below on that audit suspends the certificate. Every certified site also gets an unannounced audit at least once every three years.
A score below 70, or any critical finding, means no certificate and a six-month wait before reapplying, so plan for one solid attempt. A score of 70–79 still earns a certificate with a surveillance audit six months later. Corrective actions from any audit must be approved and closed within 30 calendar days of the closing meeting.
No. Department of Cannabis Control inspections are the state’s own verification, and a certificate neither replaces nor schedules them. What a CSQ certificate does is put a documented, independently audited GMP system behind everything an inspector walks through, and give buyers and partners standing, independent proof between state visits.
Under AB 8, licensed cannabis businesses may not handle industrial hemp before January 1, 2028, and starting January 1, 2028 intoxicating hemp products must be manufactured, tested, and sold under the same DCC rules as cannabis: the GMP article, track and trace, final-form testing, packaging and labeling, and a DCC manufacturing license. Hemp manufacturers preparing for DCC licensure can use CSQ certification to build those systems now; CSQ’s standards cover cannabinoid herbal materials, substances and products across cannabis and hemp alike.
Because proof is a differentiator when buyers can choose among hundreds of licensed suppliers. California is the largest U.S. cannabis market by total sales, with about 3.9 billion dollars in licensed cannabis sales in 2025 (CDTFA data) and 7,678 active licenses including 433 manufacturers as of the Department’s October 28, 2026 dashboard. In fiscal year 2024-25 the Department reported 2,214 Notices to Comply and 88 citations, and it published 35 recall notices in 2026 through October 29. In that market, an independent certificate is how an operator stands out on trust, and as of October 2026 the public CSQ registry lists no California site.
No. California requires its cannabis testing laboratories to hold ISO/IEC 17025 accreditation by statute (B&P section 26100), and the lab chapter leans on further ISO standards for reference materials and proficiency testing. CSQ publishes no laboratory standard; what CSQ requires of certified operations is that finished-product compliance testing run through ISO/IEC 17025 accredited laboratories (2A.12.9). Kiwa ASI does not provide laboratory testing.
CSQ certificates are issued by ASI Food Safety, LLC, the company behind the Kiwa ASI brand and CSQ’s licensed certification body, which is accredited to ISO/IEC 17065. CSQ itself is a standard, so it isn’t accredited, and it isn’t GFSI-benchmarked. Certificates are listed on CSQ’s public registry, where anyone can verify them.
Tell us your license types, what you grow or make, and where you operate. We’ll recommend a CSQ standard and level, quote your audit and tell you the earliest audit dates we can offer.
ASI Food Safety, LLC (Kiwa ASI) is currently CSQ's licensed certification body and is accredited to ISO/IEC 17065. CSQ is a standard, so it isn't itself accredited, and it isn't GFSI-benchmarked. California mandates the GMP program itself and verifies it through Department of Cannabis Control inspection; it names no certification scheme, requires no certificate, and runs no voluntary certification program of its own. CSQ is owned by ASI Global Standards, LLC, which, like ASI Food Safety, is part of ASI Holdings (see CSQ’s program oversight and impartiality statement). Kiwa ASI training is delivered separately from certification.