Colorado's Cannabis GMP Rules and Why CSQ Certification Is Worth It

No. Colorado does not mandate an accredited third-party GMP certificate for ordinary edible and concentrate makers, and it names no private GMP standard. But GMP-style practices are required: every regulated marijuana business must meet the general sanitary requirements of Rule 3-310, and products manufacturers must meet the health-and-safety requirements of Rule 3-335, which folds in Colorado's own retail-food establishment regulations (6 CCR 1010-2). Every product is tested by a MED-licensed, ISO/IEC 17025-accredited lab. CSQ certification is voluntary: accredited, independent proof of that program.

Both. Colorado has a medical program (Amendment 20, 2000) and an adult-use program (Amendment 64, 2012); its stores made the first legal adult-use retail sales in the United States on January 1, 2014. Both are regulated by the Marijuana Enforcement Division.

The Marijuana Enforcement Division (MED), a division of the Colorado Department of Revenue, licenses and regulates the entire medical and retail market — cultivation, manufacturing, stores, and testing — under the Colorado Marijuana Rules (1 CCR 212-3). The statutory State Licensing Authority is the Department of Revenue's executive director; the MED administers on its behalf. Edible manufacturing also answers to Colorado's own retail-food code (6 CCR 1010-2).

Yes — as practices, not a certificate. Products manufacturers must meet Colorado's general sanitary rule (3-310) and health-and-safety rule (3-335), comply with local kitchen standards and Colorado's retail-food establishment regulations (6 CCR 1010-2), and pass mandatory state lab testing. Colorado verifies this through MED licensing and inspection — it does not require a third-party GMP certificate, and it does not tie its rules to 21 CFR Part 111 or 117.

For most products, no — GMP compliance is verified through MED licensing, inspection, and mandatory testing, not by a required outside auditor. There is one narrow exception: a product intended for metered-dose nasal spray, vaginal, or rectal administration (an “Audited Product”) may not be transferred without a written independent audit by a certified quality or GMP auditor, completed within the last 24 months (Rules 6-325 / 5-325). That audit is not an accredited GMP certificate, and Colorado names no private scheme.

No. The Colorado Marijuana Rules name no private food-safety or GMP standard for manufacturers — not CSQ, SQF, BRCGS, FSSC, or ISO. The GMP benchmark is MED inspection against Colorado's own rules and retail-food code. CSQ is a voluntary, accredited option delivered by ASI Food Safety; it is built to meet — not to satisfy or replace — Colorado's rules.

Colorado requires the MED-published “THC” Universal Symbol — a diamond that is black on edibles and infused products, red on all other product types — on the front of the package (Rule 3-1010) and stamped, molded, or imprinted on each standardized serving of a multi-serving edible (Rule 3-335(D)(4)), where a standardized serving is no more than 10 mg of active THC and no retail edible unit exceeds 100 mg. That per-serving marking is a manufacturing and mold constraint — a CSQ certificate does not discharge it. CSQ documents the controls around it, but the symbol duty remains the operator's.

Cultivation facilities use CSQ Cultivation v2.0.0; products manufacturers (edibles, concentrates, infused products — extraction is included, since Colorado has no separate extraction license) use CSQ Extraction or Manufacturing v2.0.0; stores use CSQ Retail v1.0.0. Testing facilities follow ISO/IEC 17025 (CSQ does not certify labs but requires ISO/IEC 17025). Kiwa ASI can combine scopes into one coordinated audit.

Because it turns the food-safety practices Colorado already requires into accredited, independent proof. The highest-value cases: MED inspection readiness, investor / lender / M&A due diligence, a multi-state operator standardizing GMP across programs (including harder-posture states like New York and California), and retail or buyer assurance — plus audit-ready records that support the written recall plan and seed-to-sale tracking Colorado requires. You are largely certifying work you already have to do.

There is no single published price: cost depends on which CSQ standards apply, which level you pursue, facility size and complexity, whether it is your initial audit (which adds an offsite documentation day), and whether you combine multiple facility scopes. Most operations need 4 to 9 months to prepare, depending on license type and scope; a Level 1 audit is roughly 1 onsite day plus report time. Request a quote for a Colorado-specific scope.

Yes — but as separate legal entities to safeguard certification-body independence. CSQ certification audits are delivered by ASI Food Safety, LLC (the accredited certification body, ISO/IEC 17065 accredited and CSQ-licensed). Pre-assessments, gap analyses, training, and consulting are delivered by ASI Training and Consulting, LLC. The two operate independently to comply with ISO/IEC 17065 impartiality rules.