Florida's Cannabis GMP Mandate and How to Comply

Q: Is Florida medical-only, and did Amendment 3 change that?

Florida is medical-only. The 2024 adult-use ballot measure (Amendment 3) received 55.9% support but Florida requires a 60% supermajority, so it failed, and no adult-use measure qualified for the 2026 ballot. MMTCs remain governed by the medical framework under § 381.986, Fla. Stat.

If you hold a Florida Medical Marijuana Treatment Center (MMTC) license, state law requires every one of your processing facilities to pass a third-party Food Safety GMP inspection within 12 months of licensure, and Florida's rules require that certification to be renewed at least every two years for edibles and extraction areas. This page explains what that means, whether it applies to you, which CSQ standard fits each part of your operation, and what certification with Kiwa ASI actually involves.

Florida Medical Cannabis Compliance · § 381.986(8)(e)9, Fla. Stat.

START HERE

Does Florida's Cannabis GMP Mandate Apply to Me?

Almost certainly yes. Florida requires every Medical Marijuana Treatment Center to demonstrate that all of its processing facilities have passed a Food Safety GMP inspection — every facility DOH has authorized for processing (extraction, formulation, edibles), not just the edibles kitchen. Here is the short version.

WHO IT APPLIES TO

Every MMTC processing facility

Florida MMTCs are vertically integrated — one license covers cultivation, processing (including extraction and edibles, which also need a Chapter 500 food permit), transport, and dispensing (§ 381.986(8)(e)). The GMP inspection requirement reaches every processing facility you run.

YOUR DEADLINE

12 months, then every 2 years

§ 381.986(8)(e)9 sets the clock at 12 months after licensure to demonstrate a passed Food Safety GMP inspection. Edibles and extraction areas must hold that certification before use and renew it before it expires or every two years, whichever comes first — Rules 64-4.205(3)(c) and 64-4.209(6).

IF YOU DON'T COMPLY

Processing stops at a failing facility

Under § 381.986(8)(e)9, an MMTC “must immediately stop processing at any facility which fails to pass this inspection” until it shows DOH the facility meets the requirement. Without current GMP certification you cannot produce edibles (Rule 64-4.205(3)(c)) or use an extraction area (Rule 64-4.209(6)), and violations can bring DOH fines and license suspension or revocation (§ 381.986(10)).

What Florida's Food Safety GMP requirement actually says

Florida does not leave GMP to good intentions. § 381.986(8)(e)9, Fla. Stat. requires that, within 12 months after licensure, a Medical Marijuana Treatment Center demonstrate to the Department of Health that all of its processing facilities have passed a “Food Safety Good Manufacturing Practices, such as Global Food Safety Initiative or equivalent, inspection by a nationally accredited certifying body.” Separately, any MMTC that produces edibles must hold a Chapter 500 (Florida Food Safety Act) food establishment permit and comply with its rules — § 381.986(8)(e)8 and Rule 64-4.205, F.A.C.

Two things make this different from most states. First, it is mandatory, not voluntary. Second, Florida names no single standard — it points to “GFSI or equivalent” verified by a nationally accredited certifying body, and leaves the choice of scheme to you. CSQ (Cannabis Safety and Quality) is a cannabis-specific option issued by an accredited certification body; the next sections walk through whether it is the right fit for your MMTC.

FIND YOUR PATH

Your MMTC Does Everything — Here's the CSQ Scope for Each Part

Because a Florida MMTC is vertically integrated under one license, you are not picking a single “license type.” You match each activity you perform to the CSQ standard that fits it. Most MMTCs need several scopes; Kiwa ASI coordinates them into a single audit plan and schedule, auditing co-located scopes in the same visit, to minimize disruption.

Cultivation

§ 381.986(8)(e)

STANDARD

CSQ Cultivation v2.0.0

MINIMUM LEVEL

Level 1

PREP TIME

6–9 months

AUDIT LENGTH

~1 day onsite + 1 day offsite doc review (initial)

Indoor and enclosed-greenhouse cultivation (Florida requires MMTCs to grow within an enclosed structure — § 381.986(8)(e)6), including harvest and post-harvest drying, curing, and trimming. Foundation: cGACP (good agricultural and collection practices) plus cGMP. Established growers often add Level 2 (HACCP) for hazard control.

Processing — Extraction

Rule 64-4.209

STANDARD

CSQ Extraction v2.0.0

MINIMUM LEVEL

Level 1

PREP TIME

6–9 months

AUDIT LENGTH

~1 day onsite + 1 day offsite doc review (initial)

Solvent-based extraction (CO₂, ethanol, hydrocarbon) is governed by Rule 64-4.209: DOH approval, solvents at least 99.5% pure with a manufacturer certificate of analysis, and an extraction area that passes a Food Safety GMP inspection, renewed at least every two years. Mechanical (solventless) methods fall outside that rule. CSQ items to watch: beverage-grade (or better) CO₂, food-grade non-denatured ethanol where required, and residual-solvent specs that meet whichever is stricter — Florida rule or your internal spec.

Processing — Edibles / Manufacturing

Rule 64-4.205 · Ch. 500

STANDARD

CSQ Manufacturing v2.0.0

MINIMUM LEVEL

Level 1

PREP TIME

6–9 months

AUDIT LENGTH

~1 day onsite + 1 day offsite doc review (initial)

Edibles (Florida permits only lozenges, gelatins, baked goods, chocolates, and drink powders — Rule 64-4.205(5)), vape cartridges, topicals, and other derivative products. This is where Florida's GMP mandate bites directly: a Chapter 500 food establishment permit plus passed Food Safety GMP documentation from a nationally accredited body before you produce (Rule 64-4.205). Edibles must be shelf-stable and meet potency limits (≤200 mg THC per multi-serving edible, ≤10 mg per serving).

Dispensing

§ 381.986(8)(e)

STANDARD

CSQ Retail v1.0.0

MINIMUM LEVEL

Level 1

PREP TIME

4–6 months

AUDIT LENGTH

~1 day onsite + 1 day offsite doc review (initial)

MMTC dispensing facilities. Built on cGHP (good handling practices) — inventory, storage, customer-facing controls, and staff training.

Warehousing & Transport

§ 381.986(8)(e)

STANDARD

CSQ Warehousing & Distribution v1.0.0

MINIMUM LEVEL

Level 1

PREP TIME

4–6 months

AUDIT LENGTH

~1 day onsite + 1 day offsite doc review (initial)

Storage and transport operations that move product between your licensed facilities. Built on cGDP (good distribution practices).

Testing

§ 381.988 · Rule 64-4.212

STANDARD

External CMTL — ISO/IEC 17025

MINIMUM LEVEL

N/A

PREP TIME

Varies

AUDIT LENGTH

Per accreditation body

Florida MMTCs do not self-test — every retail batch is tested by a state-certified marijuana testing laboratory (CMTL) that must be ISO/IEC 17025 accredited. CSQ does not certify testing labs; it requires them to be ISO/IEC 17025 accredited.

FLORIDA REQUIRES VS. CSQ GOES FURTHER

What's a State Rule, and What's a CSQ Best Practice?

Florida's regulations are the legal floor. CSQ is a published, cannabis-specific GMP standard that requires compliance with all applicable regulations (Module 1.3) and adds requirements that are not in state law. Knowing which is which keeps you from over-buying or under-preparing.

What Florida requires (the legal floor)

A third-party Food Safety GMP inspection — “GFSI or equivalent” — by a nationally accredited certifying body, within 12 months of licensure — § 381.986(8)(e)9
Edibles: a Chapter 500 food establishment permit + passed GMP documentation before producing, renewed before expiry and at least every 2 years — § 381.986(8)(e)8 / Rule 64-4.205
Shelf-stable edibles; sanitary storage; shape, form, and ingredient limits; potency ≤200 mg THC per multi-serving edible and ≤10 mg per serving (±15%) — Rule 64-4.205
Solvent-based extraction: DOH approval, solvents ≥99.5% pure with a certificate of analysis, and a Food Safety GMP inspection of the extraction area before use, renewed at least every 2 years — Rule 64-4.209
Compliance testing of every retail batch before transfer, via a Certified Marijuana Testing Laboratory — § 381.988 / Rule 64-4.212 / 64-4.308
Compliant packaging and labeling — Rule 64-4.219
Seed-to-sale tracking and inventory control — Rule 64-4.221 / .222
Waste management and disposal; product remediation — Rule 64-4.207 / .213

What CSQ adds (best practice on top)

An independent certificate audited and issued by ASI Food Safety, LLC, an ISO/IEC 17065-accredited, CSQ-licensed certification body — purpose-built for cannabis
A documented internal audit program (Module 1.5)
A corrective and preventive action (CAPA) system (Module 1.6)
An annual mock recall (Module 1.8) and verified traceability test
Cannabinoid and non-cannabinoid waste streams kept completely separated (Module 2A.4 / 2B.4)
Beverage-grade (or better) CO₂ for extraction — medical-grade is not acceptable (Florida separately requires ≥99.5% solvent purity)
Food-grade, non-denatured ethanol where used as an ingredient
Inhalation-grade ingredients for inhalable products (food-grade/GRAS is not sufficient)
Route-of-administration risk assessments for formulated, inhalable, and topical products
A multidisciplinary HACCP team with a HACCP-certified individual and certified backup (Level 2 and above — not a Florida state requirement)

Quick glossary — the terms that show up in a Florida CSQ audit

MMTC

Medical Marijuana Treatment Center. Florida's single, vertically integrated cannabis license — an MMTC must itself cultivate, process, transport, and dispense, and generally may not contract those activities out (§ 381.986(8)(e)).

OMMU

Office of Medical Marijuana Use, the office within the Florida Department of Health that regulates MMTCs and certifies testing labs (CMTLs).

GFSI

Global Food Safety Initiative — the food-safety benchmark Florida's statute references (“GFSI or equivalent”). CSQ is a cannabis-specific scheme, not a GFSI-benchmarked food scheme.

Chapter 500

The Florida Food Safety Act. MMTCs that produce edibles must hold a Chapter 500 food establishment permit.

CMTL

Certified Marijuana Testing Laboratory. The ISO/IEC 17025-accredited lab that must test every retail batch before it is transferred to dispensing.

cGMP / cGHP / cGDP

Current Good Manufacturing / Handling / Distribution Practices — the CSQ foundations for facilities that make product, dispense, and distribute.

HACCP

Hazard Analysis & Critical Control Points. A formal hazard-control method required at CSQ Level 2 and above — not required by Florida.

Nationally accredited certifying body

The third party § 381.986(8)(e)9 requires to perform the Food Safety GMP inspection; Florida does not define the term or pre-approve bodies. CSQ audits are issued by ASI Food Safety, LLC, an ISO/IEC 17065-accredited certification body.

THE AUDIT

What a CSQ Audit Actually Looks Like

A Florida CSQ audit is an onsite review (plus, for initial certification, a one-day offsite documentation evaluation) of your quality management system against the standard that fits each activity your MMTC performs. Here is how scoring, findings, and timing work — followed by the technical mapping table for the people who want it.

Scoring (100-point scale)

How CSQ scores you and what it means for your certificate

Score	Outcome	Surveillance Cycle
80–100	Certificate issued	Annual recertification audit
70–79	Certificate issued	6-month surveillance audit
Below 70	No certificate	6-month wait before re-audit

Findings categories

CRITICAL · –100 POINTS

Auto-fail finding

A requirement has not been implemented and is a significant risk to product safety and quality. Scored –100 (automatic failure): a single Critical finding fails the audit, no matter the other scores.

MAJOR · –10 POINTS

Significant gap

Systemic failures or significant deviations from CSQ requirements — not an immediate safety risk but requires corrective action.

MINOR · –1 POINT

Isolated finding

A gap against a CSQ requirement that, if not addressed, may lead to a risk to product safety or quality — often an isolated documentation or recordkeeping lapse. Still requires an approved corrective action within 30 calendar days.

Audit timing & certificate validity

What to expect onsite and on the calendar

Item	Detail
Level 1 audit	1 day onsite + 0.5 day report time
Level 2 audit	1.5 days onsite + 1 day report time
Level 3 audit	2 days onsite + 1 day report time (unannounced window)
Initial audit add-on	+1 day for offsite documentation evaluation (all levels)
Corrective action window	30 days to close nonconformities
Certificate validity	1 year + 45 days from audit date
Provisional certificate	For pre-operational audits without records (valid 6 months; a follow-up audit then issues the full certificate)

Show the full Florida requirement → CSQ section mapping

For consultants, internal compliance leads, and operators who want the section-by-section map between Florida's regulations and CSQ 2.0:

Florida cannabis rules and corresponding CSQ 2.0 sections

Requirement	Citation	CSQ Coverage
Third-party Food Safety GMP inspection (GFSI or equivalent)	381.986(8)(e)9	CSQ Level 1 minimum (Modules 1–3) issued by an ISO/IEC 17065-accredited body
Edibles: Chapter 500 food establishment + GMP documentation	381.986(8)(e)8 / 64-4.205	Module 2A (cGMP) + Section 3C (formulated/ingestible product controls)
Shelf-stable edibles, sanitary storage, potency limits	64-4.205	2A.9 (Storage) + 2A.12 (Production and Process Controls) + 2A.8 (Environmental Monitoring)
Solvent-based extraction (≥99.5% solvent purity; extraction-area GMP inspection)	64-4.209	Sections 3B.1.1–3B.1.9 + 3B.2.2.2 (extraction safety, CO₂ & ethanol grade, residual solvents)
Compliance testing of every retail batch (potency, contaminants)	64-4.212 / 64-4.308	Section 2A.12.9 / 2B.11.7 (Product Sampling and Testing)
Packaging & labeling (child-resistant, cannabinoid content, warnings)	64-4.219	Section 2A.12.8 / 2B.11.6 (Product Labeling and Packaging)
Seed-to-sale tracking & inventory control	64-4.221 / .222	Section 2A.10 / 2B.9 (Inventory Management) + Section 1.3 (Regulatory Compliance)
Waste management, disposal, and remediation	64-4.207 / .213	Module 2A.4 / 2B.4 (Waste Management) + Section 1.6 (CAPA)
Food establishment sanitary practices (edibles)	Chapter 500	Section 2A.1 (Facility and Facility Infrastructure) + 2A.3 (Cleaning & Sanitation) + 2A.13 (Personnel)

How to Prepare | A Realistic Path From Licensure to Certificate

Plan backwards from your licensure date. Florida gives you 12 months to demonstrate a passed Food Safety GMP inspection, and edibles and extraction areas need GMP certification before use, renewed at least every two years — so most MMTCs start 6 to 9 months out, and established MMTCs plan each renewal ahead of expiry. Here is a sequence that works.

Confirm your CSQ standards and level

Use the Find-Your-Path section above. Map each activity your MMTC performs — cultivation, extraction, edibles, dispensing, distribution — to its CSQ standard, and decide whether Level 1 is enough or you want Level 2/3. Write the answer down; it drives every other step.

Run a gap analysis

Compare your current state to the CSQ standard. ASI Training and Consulting, LLC can deliver a structured gap analysis as a separate engagement from the certification body — the cheapest way to find out where you stand before paying for an audit.

Build the QMS documentation

Author or update SOPs for sanitation, process flow, cross-contamination, allergens, environmental monitoring, waste, traceability, and product release. Stand up your CAPA, internal audit, and document-control systems.

Secure the Chapter 500 permit for edibles

If you produce edibles, obtain your Chapter 500 food establishment permit and align your facility to the Florida Food Safety Act — this is a statutory prerequisite alongside the GMP documentation (§ 381.986(8)(e)8).

Close the cannabis-specific gaps

CSQ requirements a food-GMP program may not have covered: CO₂ and ethanol grade (Florida already requires ≥99.5% solvent purity), inhalation-grade ingredients, waste-stream separation, and route-of-administration risk assessments. Verify these before the auditor arrives.

Train your team and run internal audits

Deliver competency-based, role-specific training on OMMU rules, Chapter 500 for edibles, hygiene, PPE, allergen handling, and traceability. Then conduct a documented internal audit and an annual mock recall, and close nonconformities through CAPA.

Schedule your CSQ audit with Kiwa ASI

Schedule through Kiwa ASI in the CSQ Database. Allow time for the offsite documentation evaluation (1 day) plus the onsite audit (1–2 days depending on level). Request a quote to start.

Why Florida Operators Choose Kiwa ASI

Kiwa ASI brings nearly a century of food safety expertise and the global Kiwa network's footprint in 30+ countries to Florida's medical cannabis market — and Florida regulates edibles like food.

Accredited

ISO/IEC 17065 + CSQ-Licensed

Audits and certificates are issued by ASI Food Safety, LLC — an ISO/IEC 17065-accredited certification body licensed by CSQ.

Expertise

Food-grade rigor for cannabis

Our auditors are credentialed food safety, GMP, and HACCP professionals with cannabis-specific qualifications. Cannabis is being regulated like food. We've been doing food for decades.

Efficiency

Direct scheduling, no surprises

Pre-audit scoping clarifies level, scope, and Module 3 requirements before you're onsite. Audit reports are turned around inside the standard CSQ timeline.

Comprehensive

Training and consulting available

Pre-assessments and gap analyses are delivered by ASI Training and Consulting, LLC, a separate legal entity, kept structurally separate from the certification body to safeguard impartiality under ISO/IEC 17065.

Continuity

Surveillance and recertification

We manage the full CSQ cycle: annual recertification before your certificate expires, plus the 6-month surveillance audit required after a 70–79 score. Continuity matters as much as the initial certificate.

Partnership

Global Kiwa network

Operations in 30+ countries. Useful when a Florida operator expands into other state markets or builds an international supply chain.

Frequently Asked Questions About Florida Cannabis GMP & CSQ Certification

Does Florida require cannabis operators to be third-party GMP certified?

Yes. § 381.986(8)(e)9, Fla. Stat. requires every Medical Marijuana Treatment Center to demonstrate, within 12 months of licensure, that all of its processing facilities have passed a Food Safety Good Manufacturing Practices inspection — “such as Global Food Safety Initiative or equivalent” — by a nationally accredited certifying body. MMTCs that produce edibles must additionally hold a Chapter 500 food establishment permit and current GMP documentation before producing (Rule 64-4.205). That certification must be renewed before it expires or every two years, whichever comes first, for edibles and extraction areas (Rules 64-4.205(3)(c), 64-4.209(6)), and a facility that fails the inspection must stop processing until it passes (§ 381.986(8)(e)9).

Is Florida medical-only, and did Amendment 3 change that?

What is an MMTC, and why does vertical integration matter here?

A Medical Marijuana Treatment Center is Florida's single cannabis license. Under § 381.986(8)(e), an MMTC must itself cultivate, process, transport, and dispense marijuana, and generally may not contract those activities out (a narrow single-contractor exception applies to the original pre-2017 licensees) — it is vertically integrated. That matters for GMP because the Food Safety GMP requirement applies to every facility you operate with DOH processing authorization (extraction, formulation, and edibles manufacturing). Cultivation-only and dispensing facilities are not named in § 381.986(8)(e)9, though CSQ Cultivation and Retail certification are available as best practice.

Does Florida require a specific standard like CSQ?

No. Unlike Missouri, which names ISO, ASTM, CSQ, and FOCUS, Florida names no specific scheme. The statute is performance-based: a Food Safety GMP inspection “GFSI or equivalent” by a nationally accredited certifying body. CSQ is a cannabis-specific GMP certification, audited and issued by ASI Food Safety, LLC, an ISO/IEC 17065-accredited certification body licensed by CSQ. The statute cites GFSI as an example, but GFSI food schemes largely exclude US THC products — SQF's cannabis guidance, for example, applies only in Canada.

Which CSQ standard applies to my MMTC's facilities?

Cultivation uses CSQ Cultivation v2.0.0; extraction uses CSQ Extraction v2.0.0; edibles/manufacturing uses CSQ Manufacturing v2.0.0; dispensing uses CSQ Retail v1.0.0; and warehousing/transport uses CSQ Warehousing & Distribution v1.0.0. Because your MMTC performs several of these under one license, Kiwa ASI can coordinate the applicable scopes into one audit plan (co-located scopes can be audited in the same visit; each separate facility still receives its own onsite audit).

What are Florida's edibles food-safety requirements?

MMTCs that produce edibles must hold a Chapter 500 (Florida Food Safety Act) food establishment permit and, before producing, obtain documentation from a nationally accredited certifying body that the facility passed a Food Safety GMP inspection, renewed before expiration or every two years, whichever comes first (Rule 64-4.205). Edibles must be shelf-stable, stored in a sanitary manner, limited to permitted shapes, forms (lozenges, gelatins, baked goods, chocolates, and drink powders), and ingredients, and capped at 200 mg THC per multi-serving edible and 10 mg per serving.

What lab testing does Florida require?

Every retail batch must be tested by a Certified Marijuana Testing Laboratory (CMTL) — an ISO/IEC 17025-accredited lab certified by the Department under § 381.988 — and must pass before it is transferred to a dispensing facility (Rule 64-4.212). The panel (Rule 64-4.308) covers potency, heavy metals, microbials, mycotoxins, residual solvents, pesticides, filth, and water activity/moisture. On a failure, product is resampled, remediated, or disposed of.

How much does CSQ certification cost in Florida, and how long does it take?

There is no single published price: cost depends on which CSQ standards apply, which level you pursue, facility size and complexity, whether it is your initial audit (which adds an offsite documentation day), and whether you combine multiple facility scopes. Most operations need 6 to 9 months to prepare; a Level 1 audit is 1 day onsite (plus 1 offsite documentation day for an initial audit) and report time. Request a quote for a Florida-specific scope.

Does CSQ certification satisfy Florida's GMP requirement on its own?

Florida requires a Food Safety GMP inspection by a nationally accredited certifying body. CSQ audits are issued by ASI Food Safety, LLC, an ISO/IEC 17065-accredited certification body, and cover the cGMP practices at the heart of the requirement. Because Florida leaves the choice of scheme to the operator and does not pre-approve specific standards, confirm your intended scheme with OMMU or counsel for your facility type. Kiwa ASI can scope CSQ for each MMTC facility.

Can Kiwa ASI provide both training and CSQ certification for Florida operators?

Yes — but as separate legal entities to safeguard certification-body independence. CSQ certification audits are delivered by ASI Food Safety, LLC (the accredited certification body, ISO/IEC 17065 accredited and CSQ-licensed). Pre-assessments, gap analyses, training, and consulting are delivered by ASI Training and Consulting, LLC. The two operate independently to comply with ISO/IEC 17065 impartiality rules.