GMP
Kiwa ASI cGMP V2.0 Training
One day on current Good Manufacturing Practices for the people who run your floor every day.
Upcoming dates$499 per seat
Dates on request. Ask about upcoming dates
Maryland Cannabis GMP Audits: What the MCA Requires and How to Get Certified
Maryland makes good manufacturing practices mandatory for every cannabis processor, with SOPs, GMP and a training plan before production, and edibles makers also need an MCA permit and a state pre-operation inspection (COMAR 14.17.11). High-potency edibles go further and must hold third-party cGMP certification to 21 CFR Part 111 or Part 210 (COMAR 14.17.13.05(G)). Kiwa ASI audits and certifies cannabis and hemp operations to CSQ (Cannabis Safety & Quality), whose Dietary Supplement Addendum is built on the Part 111 rules Maryland names.
- CSQ Certification Body
- COMAR 14.17.11 & 14.17.13.05
- Built on 21 CFR Part 111
- Cannabis & Hemp
Last updated October 27, 2026
Get a Maryland GMP Audit Quote
Tell us your license type, what you make, and whether high-potency edibles are on your roadmap. We’ll confirm your CSQ standard, level and any addendum, and tell you the earliest audit dates we can offer.
Does Maryland’s GMP Rule Apply to You?
If you process cannabis in Maryland, yes. Every processor must develop standard operating procedures in accordance with COMAR 14.17.11.19, good manufacturing practices, and a training plan before producing cannabis concentrates or infused products (COMAR 14.17.11.04(A)(1)(a)). Edibles add an MCA permit and a state inspection. What Maryland does not do is demand a third-party certificate from everyone: that mandate applies to exactly one product class, high-potency edibles. Here is the short version.
The one certificate mandate: high-potency edibles
Maryland allows edibles above the standard caps, meaning more than 10 mg THC per serving or 100 mg per package, only through MCA product approval, and caps them at 40 mg per serving and 400 mg per package. Those products must comply with cGMP under 21 CFR Part 111 or Part 210, proven by a third-party certification package submitted to the MCA (COMAR 14.17.13.05(G)), and dispensaries may sell them only to qualified patients and registered caregivers. The next section walks through the rule, and the CSQ route to it.
-
Everyone
Who Runs GMP
Every Maryland processor. SOPs covering sanitation, hygiene, equipment that comes into contact with cannabis, decontamination and edible controls, plus good manufacturing practices and a training plan, all in place before production starts (COMAR 14.17.11.04, 14.17.11.19).
-
Permit
The Edibles Gate
Before engaging in the business of processing edible cannabis products, a processor needs an MCA edibles permit and must pass a pre-operation inspection (COMAR 14.17.11.05(B)). That is Maryland’s own verification of your premises and SOPs, not a third-party certificate.
-
Certificate
Who Must Certify
Only processors seeking high-potency edible product approval. The MCA submission must include a third-party certification demonstrating cGMP under 21 CFR Part 111 or Part 210, proof of the certifier’s accreditation to certify that cGMP, an attestation of a facility audit, the audit checklist with your facility’s score and score scale, a corrective plan for any deficiencies, and documentation that the dosage form is recognized by the USP, the National Formulary or the FDA (COMAR 14.17.13.05(G)(2)–(3)).
-
Voluntary
Everyone Else
Growers, dispensaries and warehouses face no GMP-certificate mandate, and standard-edibles processors stop at the permit and inspection. For standard-edibles processors, CSQ certification is voluntary, independent proof that the GMP program Maryland already requires actually works; for growers, dispensaries and warehouses it is voluntary proof of good practice, and a differentiator with wholesale buyers.
The High-Potency Edibles Rule, Decoded
COMAR 14.17.13.05(G) is short, but it decides your certification plan. It names no scheme and no accreditor, only the federal cGMP rules: 21 CFR Part 111, the dietary-supplement cGMPs, or 21 CFR Part 210, the drug cGMPs. Which CSQ configuration prepares you for it matters, because CSQ’s Part 111 vehicle is not available at every level.
-
Level 2 + Addendum
Part 111: the Practical Lane
Within CSQ, the Part 111-specific controls, meaning master production records, batch records, retention samples and botanical identity, sit in the Dietary Supplement Addendum, which is built on 21 CFR Part 111 and which CSQ restricts to Level 2 and Level 3 certifications. The minimum CSQ configuration for the high-potency lane is therefore CSQ Manufacturing Level 2 plus the Dietary Supplement Addendum. Level 1 cannot carry the Addendum.
-
Level 3 route
Part 210: the Heavyweight Lane
CSQ’s Pharma-GMP Addendum (Version 1.0, October 2026) is built on 21 CFR Parts 210 and 211 plus EudraLex, attaches only to Level 3 certifications, whose base audits are unannounced, and adds a two-day minimum addendum audit. It targets botanical drug and herbal medicinal products, so for a dispensary-channel edible it is rarely the right fit. Talk to our certification team before you plan around it.
-
In practice
What the Registry Shows
Every Maryland operation on CSQ’s public registry holds a dietary-supplement scope, and the CSQ 2.0 certificates among them are all Level 2 with the Dietary Supplement Addendum, the only such pairings on the registry (October 2026). In practice, Maryland’s Part 111 lane is why Maryland sites certify at Level 2.
-
G(3)(a)
The Accreditation Proof
Maryland requires proof of the certifier’s accreditation to certify that cGMP (COMAR 14.17.13.05(G)(3)(a)). CSQ certificates are issued by ASI Food Safety, LLC (Kiwa ASI), CSQ’s licensed certification body, which is accredited to ISO/IEC 17065. Ask our certification team to confirm the accreditation-scope documentation for your MCA submission before you file.
Standard edibles stay simple. At 10 mg per serving and 100 mg per package, Maryland mandates no certificate at any level: the MCA edibles permit, the pre-operation inspection and your GMP SOPs carry the compliance load, and CSQ Manufacturing Level 1 is the voluntary entry point. You can step up to Level 2 and add the Dietary Supplement Addendum when high-potency approval enters your roadmap: the Addendum is a pass/fail, four-hour-minimum audit that can run alongside any CSQ certification audit, but never on its own before certification.
Proving It to the MCA, and Keeping It Current
Maryland approves products, not auditors. There is no state list of approved GMP auditors or certification schemes; instead, the high-potency rule demands proof of the certifier’s accreditation with each submission, and MCA inspectors check the underlying GMP program themselves.
-
Submit
Submit With Product Approval
High-potency edibles reach the market only through MCA product approval (COMAR 14.17.13.05(B)(4)). The approval package carries the third-party certification, the proof of the certifier’s accreditation, the facility-audit attestation, the scored checklist and corrective plan, and documentation that the dosage form is recognized by the United States Pharmacopeia, the National Formulary or the FDA (COMAR 14.17.13.05(G)(2)–(3)).
-
Maintain
Keep It Current
A CSQ certificate is valid for one year plus 45 days, so the annual recertification audit keeps your certification current for new product-approval submissions. Book it well before your certificate expires: CSQ allows extensions only in extreme circumstances such as fire, severe weather or a pandemic, and a lapsed certificate cannot anchor a new submission.
-
Inspect
Expect Inspections
The MCA publishes no inspection checklist, “the checklist is COMAR,” and runs at least one announced inspection a year plus between 2 and 5 unannounced inspections annually. A documented, audited GMP system is what the inspector walks through.
-
Since 2026
The Pathogen Stop Rule
Since early 2026, one failed pathogen test stops production: quarantine, an MCA administrative hold, pre- and post-cleaning swabs by an independent testing laboratory, and MCA clearance before you resume. A repeat positive within 60 days triggers a mandatory corrective action plan the MCA must approve. A working sanitation and environmental monitoring program is what shortens that shutdown.
Match Your Maryland License to the Right CSQ Standard
Match what you actually do to the CSQ standard that covers it. Maryland licenses each activity separately (§ 36-401), and if you hold more than one, the standards in scope are audited together in one coordinated audit. Maryland doesn’t name a CSQ level; the readiness checklist below shows what each level covers.
-
§ 36-401 · COMAR 14.17.10
Grower (Standard or Micro)
Cultivation and post-harvest drying and curing under MCA operations rules. CSQ Cultivation covers the grow through post-harvest handling.
- Standard: CSQ Cultivation Version 2.0
- Level: Level 1 or higher; Level 2 adds HACCP
- No Maryland certificate mandate: certification is voluntary, independent proof
- Minimum audit: 1-day document review plus 1 day onsite at Level 1
-
COMAR 14.17.11
Processor: Extraction and Concentrates
Solvent-based and solventless extraction, concentration and refinement. Maryland requires GMP SOPs before you produce concentrates (COMAR 14.17.11.04). CSQ Extraction adds input specs: process gases and solvents of at least 99.5% purity unless otherwise specified, CO₂ of beverage grade or better, and non-denatured, food-grade ingredient ethanol.
- Standard: CSQ Extraction Version 2.0; add CSQ Manufacturing if you also make finished products such as edibles, beverages or topicals
- Level: Level 1 or higher; Level 2 adds HACCP
- No Maryland certificate mandate: certification is voluntary, independent proof
- Minimum audit: 1-day document review plus 1 day onsite at Level 1
-
COMAR 14.17.11 · 14.17.13.05
Processor: Edibles and Manufacturing
Edibles, beverages, vape cartridges, topicals and other infused products. This is where Maryland’s rules bite hardest: mandatory GMP SOPs, the MCA edibles permit, the state pre-operation inspection, and, for high-potency edibles, the third-party cGMP certificate (COMAR 14.17.13.05(G)). Standard edibles are capped at 10 mg THC per serving and 100 mg per package.
- Standard: CSQ Manufacturing Version 2.0
- Level: Level 1 (standard edibles, voluntary) · Level 2 + Dietary Supplement Addendum (high-potency lane)
- High-potency edibles must hold third-party cGMP certification to 21 CFR Part 111 or 210: the CSQ route is Manufacturing Level 2 minimum plus the Dietary Supplement Addendum, which CSQ restricts to Level 2 and Level 3 certifications
- Minimum audit at Level 2: 1-day document review, 1.5 days onsite, plus the 4-hour Addendum audit, which can run concurrently
-
§ 36-401 · COMAR 14.17.12
Dispensary (Standard or Micro)
Retail medical and adult-use dispensaries. CSQ Retail is built on current good handling practices: inventory, storage, customer-facing controls and staff training.
- Standard: CSQ Retail Version 1.0
- Level: Level 1 or higher
- No Maryland certificate mandate: certification is voluntary, independent proof
- Minimum audit: 1-day document review plus 1 day onsite at Level 1
-
MCA-licensed operations
Warehousing & Transport
Storage and transport operations moving product between Maryland-licensed businesses. CSQ Warehousing & Distribution is built on current good distribution practices.
- Standard: CSQ Warehousing & Distribution Version 1.0
- Level: Level 1 or higher
- No Maryland certificate mandate: certification is voluntary, independent proof
- Minimum audit: 1-day document review plus 1 day onsite at Level 1
Planning the Addendum. The Dietary Supplement Addendum’s scope names CSQ Certification, Cultivation, Extraction and Manufacturing, so plan it on your processing certification at Level 2 or 3. It can be audited alongside your certification audit or added at a later audit, but never on its own before CSQ certification. Growers can certify the grow voluntarily with CSQ Cultivation, and vertically integrated operators combine standards in one audit.
What Maryland Requires vs. What CSQ Adds
Maryland’s regulations are the legal floor. CSQ is a published cannabis- and hemp-specific standard built on federal cGMP that adds requirements state law doesn’t have. Knowing which is which keeps you from over-buying or under-preparing.
-
The legal floor
What Maryland Requires
- GMP-based SOPs, good manufacturing practices and a training plan before producing concentrates or infused products (COMAR 14.17.11.04(A)(1)(a))
- SOPs for sanitation, hygiene, equipment that comes into contact with cannabis, decontamination after a presumptive positive pathogen test, edible controls, rework, green waste and recall-material handling (14.17.11.19)
- An MCA edibles permit and a passed pre-operation inspection before the edibles business (14.17.11.05(B))
- Standard edibles capped at 10 mg THC per serving and 100 mg per package, with servings physically separated (14.17.13.05(B))
- Only geometric shapes; no human, animal, toy or fruit shapes; no added nicotine or caffeine, with an exception for naturally occurring caffeine in coffee, tea and chocolate (14.17.13.05(C), (E))
- Compliance with federal food law, including 21 CFR and the federal food, meat and poultry acts (14.17.13.05(F))
- High-potency edibles, up to 40 mg per serving and 400 mg per package: MCA product approval plus third-party cGMP certification to 21 CFR Part 111 or 210, with accreditation proof, a facility-audit attestation, the scored checklist and a corrective plan (14.17.13.05(G)); sold only to qualified patients and registered caregivers
- Lot testing under the MCA’s testing rules, through independent laboratories registered with the MCA and accredited to ISO/IEC 17025 (lab registration: COMAR 14.17.08)
- Packaging and labeling under COMAR 14.17.18, amended effective September 2026
- Since early 2026: a failed pathogen test stops production until the MCA clears post-cleaning swab results, and repeat positives within 60 days require an MCA-approved corrective action plan (MCA processor guidance)
-
Verified best practice
What CSQ Adds
- An annual certification audit, plus an unannounced audit at least every three years at every level
- A documented internal audit program (CSQ 1.5) and corrective and preventive action with annual trending (1.6), the same discipline the MCA’s pathogen rule now expects
- A mock recall at least once a year, completed in under two hours (1.8)
- A risk-based environmental monitoring program for microbial hazards (2A.8), your early warning against the pathogen stop rule
- Annual ISO/IEC 17025 testing of facility air and water (2A.6, 2A.7)
- Process gases and extraction solvents of at least 99.5% purity unless otherwise specified, CO₂ of beverage grade or better (never medical grade), and non-denatured, food-grade ingredient ethanol (3B.1, 3C.1)
- Route-of-administration risk assessments for formulated, inhalable and topical products (3C.2)
- Cannabinoid and non-cannabinoid waste kept separate (2A.4) and contract manufacturers audited (2A.11)
- Notice to your certification body within 72 hours of a recall, voluntary withdrawal or regulatory warning; a missed notice suspends your CSQ certificate
- At Level 2, a HACCP system built on the 12 Codex steps, with one team member and one back-up certified through a course approved by the International HACCP Alliance (4A.1, 4A.2)
- For dietary-supplement-type products: master production records, batch records, retention samples and botanical identity under the Dietary Supplement Addendum, on Level 2 and Level 3 certifications
What a CSQ Audit Looks Like in Maryland
An initial CSQ audit has three parts: a one-day offsite review of your documentation (no more than six months before the site visit), the onsite audit, and the report. Minimum onsite time is 1 day at Level 1, 1.5 days at Level 2 and 2 days at Level 3, plus report time; your actual time depends on the standards in scope and the size of your site. The auditor checks your written system against CSQ and Maryland’s rules (CSQ 1.3, Regulatory Compliance), watches your people work, and samples your records.
CSQ Audit Modules
| Module | What the auditor checks |
|---|---|
| 1 Management system (all levels) | Documented CSQ system with SOPs and a copy of Maryland’s rules, management commitment, regulatory compliance, records, internal audits, CAPA, complaints, recalls and withdrawals, product defense, fraud prevention and crisis management |
| 2A Good manufacturing practices (all levels) | Facility and infrastructure, equipment and calibration, cleaning and sanitation, waste, integrated pest management, air and water safety, environmental monitoring, storage, inventory and traceability, supplier approval, production and process controls, labeling and packaging, product testing, personnel |
| 3B / 3C Cannabinoid products and processes (all levels) | Extraction (3B): process gases and solvents, extraction equipment, post-processing. Manufacturing (3C): ingredients, formulation, inhalable, ingestible and topical product controls, homogeneity and dosing against Maryland’s caps |
| 4A HACCP (Level 2 and up) | Multidisciplinary HACCP team with one member and a back-up certified through an IHA-approved course, hazard analysis, critical control points, monitoring, corrective actions, validation and verification |
| 5 Advanced quality management (Level 3) | Advanced management system requirements, safety and quality culture, customer satisfaction and product realization; Level 3 audits are unannounced |
| Dietary Supplement Addendum (Level 2 and 3 only) | A pass/fail scope extension of at least four hours, audited with your certification audit: master production records, batch records, retention samples and botanical identity, with its own report within 72 hours |
| Mock recall and traceability | Your annual mock recall record, plus a traceability exercise during the audit |
How CSQ Audits Are Scored
Each audit starts at 100, and every nonconformance deducts points. The final score decides the outcome:
| Result | Score | What happens next |
|---|---|---|
| Certified | 80–100 | Certificate; next annual certification audit in a year |
| Certified with surveillance | 70–79 | Certificate plus a surveillance audit in six months; a score of 79 or below on that audit suspends the certificate |
| Not certified | 0–69 | No certificate; wait six months before reapplying |
Certificates are valid for one year plus 45 days and are listed on CSQ’s public registry, where anyone, including the MCA and your wholesale buyers, can look them up.
Nonconformance Categories
-
Critical−100
A requirement that has not been implemented and is a significant risk to product safety and quality. A critical finding fails the audit.
-
Major−10
A deficiency in meeting a CSQ requirement that, if not addressed, will likely lead to a risk to product safety and quality.
-
Minor−1
A deficiency in meeting a CSQ requirement that, if not addressed, may lead to a risk to product safety or quality.
After the audit: the evidence record follows within 7 days, corrective actions must be approved and closed within 30 calendar days of the closing meeting, and the final report and certificate follow within about 45 days; Maryland audits have run about six weeks from audit to certificate. Every certified site also gets an unannounced audit at least once every three years. Agree blackout dates with us for days your operation won’t be running, and submit them no later than 60 days before the unannounced audit window; refusing an unannounced audit suspends the certificate.
Maryland GMP Audit Readiness Checklist
The MCA publishes no inspection checklist, “the checklist is COMAR,” and a CSQ audit samples the same system your inspectors walk through. Use this list to check you’re ready before the auditor arrives.
-
Documents
Paperwork to Have Ready
- Your MCA license, edibles permit and pre-operation inspection record, with a copy of the Maryland rules you follow
- SOPs for every area COMAR 14.17.11.19 names: sanitation, hygiene, equipment that contacts cannabis, decontamination, edible controls, rework, green waste and recalls
- Master production records for each product, with batch record templates
- Supplier approval file, including COAs for CO₂, solvents, ethanol and ingredients
- An organization chart and job descriptions, with training records for every person, refreshed on Maryland’s two-year agent-training cycle
-
Records (CSQ recommends 60+ days)
Records You Need Running
- Batch production records with quality-control review and release
- Cleaning and sanitation logs, pest control reports and equipment calibration records
- Environmental monitoring results and annual air and water test reports
- Lot testing COAs from your MCA-registered, ISO/IEC 17025-accredited laboratory
- Traceability records that tie inputs to finished lots, plus your mock recall record
- An internal audit report and a CAPA log showing findings closed
-
CSQ specifics
Cannabis-Specific Items Auditors Check Closely
- Process-gas and CO₂ grade, and food-grade, non-denatured ingredient ethanol
- Route-of-administration risk assessments for formulated, inhalable and topical products
- Potency, homogeneity and dosing controls against Maryland’s 10 mg and 100 mg caps
- Cannabinoid waste kept separate from non-cannabinoid waste
- Labels and packaging checked against COMAR 14.17.18 before release
- For the high-potency lane: master production records, batch records and retention samples ready for the Dietary Supplement Addendum audit
| Maryland requirement | Citation | CSQ coverage |
|---|---|---|
| GMP, SOPs and a training plan before production | 14.17.11.04(A)(1)(a) | 2A.12.1 Standard Operating Procedures + 1.1 CSQMS General Requirements + 2A.13.2 Personnel Training (Level 1) |
| SOPs: sanitation, hygiene, equipment that contacts cannabis | 14.17.11.19 | 2A.3 Cleaning and Sanitation + 2A.2 Equipment, Maintenance, and Calibration + 2A.13 Personnel Requirements + 2A.8 Environmental Monitoring (Level 1) |
| Edibles permit + pre-operation inspection | 14.17.11.05(B) | 2A.1 Facility and Facility Infrastructure + 1.3 Regulatory Compliance (Level 1) |
| Federal food-safety law (21 CFR; 21 U.S.C.) | 14.17.13.05(F) | Module 2A (cGMP) + 3C.2.6 Ingestible Cannabinoid Products + 3C.1.8 Non-Cannabinoid Ingredients (Level 1) |
| High-potency edibles: third-party cGMP certificate (21 CFR Part 111/210) | 14.17.13.05(G) | CSQ Manufacturing Level 2 minimum + Dietary Supplement Addendum, built on Part 111; the Part 210 route is Level 3 + the Pharma-GMP Addendum, a certification-team conversation; confirm the accreditation-scope proof G(3)(a) requires with our certification team |
| Potency caps and homogenization (standard edibles) | 14.17.13.05(B) | 3C.1.10 Blending, Compounding, Formulation, and Mixing + 2A.12.9 Product Sampling and Testing (Level 1) |
| Lot testing through MCA-registered laboratories (ISO/IEC 17025) | MCA testing rules; labs: COMAR 14.17.08 | 2A.12.9 Product Sampling and Testing (Level 1) |
| Packaging and labeling | 14.17.18 | 2A.12.8 Product Labeling and Packaging (Level 1) |
| Decontamination after pathogen detection | 14.17.11.19(A)(11) | 2A.12.6 Cross-Contamination Controls + 2A.10.4 Hold and Release + 2A.8 Environmental Monitoring + 1.6 CAPA (Level 1) |
| Receipt and storage of ingredients (edibles SOPs) | 14.17.11.19(A)(12) | 2A.11 Supplier Approval and Vendor Qualifications (Level 1) |
Mapping by Kiwa ASI to CSQ Manufacturing Version 2.0; Maryland names no scheme and no level. Level 1 covers the GMP practices Maryland mandates for every processor. Level 2 adds HACCP, and the Dietary Supplement Addendum, the Part 111 vehicle for the high-potency lane, attaches only to Level 2 and Level 3 certifications. Ask us which configuration fits your products.
How to Get CSQ Certified in Maryland
Start early. Most operations need several months to build the system and collect records before the audit, and for the high-potency lane the certification package has to exist before the MCA will approve the product.
-
01
Step 1: Map Your Products to the Rules
Standard edibles stop at 10 mg per serving and 100 mg per package; anything above that needs MCA product approval and the third-party certificate (COMAR 14.17.13.05(G)). Note where you stand on the edibles permit and pre-operation inspection, and decide whether high-potency approval is on your roadmap, because it decides your CSQ level.
-
02
Step 2: Choose Your CSQ Standard, Level and Addendum
Match CSQ Cultivation, Extraction, Manufacturing or a combination to what you do. Level 1 is the voluntary entry point, but the high-potency lane is never Level 1: plan CSQ Manufacturing Level 2 plus the Dietary Supplement Addendum. Request a quote so we can confirm scope and audit time.
-
03
Step 3: Write the System
SOPs for every area COMAR 14.17.11.19 names, master production records, batch records, supplier approval, sanitation, environmental monitoring, traceability and recall procedures, document control, internal audit and CAPA. Your program manager also takes CSQ’s free online Certification Program Overview course.
-
04
Step 4: Train Your Team
Train every person on GMP, hygiene and their own procedures, and keep the records on Maryland’s two-year agent-training cycle. For Level 2, have one HACCP team member and a back-up certified through a course approved by the International HACCP Alliance.
-
05
Step 5: Run It and Audit Yourself
Operate the system, and aim for at least 60 days of records, which CSQ recommends before certification. Run a documented internal audit and a mock recall in under two hours, close what you find through CAPA, and check yourselves against the published standard before the real audit, a step CSQ strongly recommends and one your own team can run.
-
06
Step 6: Schedule With Kiwa ASI
Sign the certification agreement and send your documents for the offsite review. Pick an onsite date that leaves time for corrective actions and the certificate ahead of your MCA submissions, and plan the four-hour Addendum audit alongside the certification audit if the high-potency lane is in scope.
-
07
Step 7: Close Out, Then Put the Certificate to Work
Close corrective actions within 30 days of the closing meeting and receive your certificate, typically within about 45 days of the audit. For high-potency approval, assemble the COMAR 14.17.13.05(G) package around it, and keep it current with annual recertification.
Worked backward from a Q3 2027 high-potency approval target: records running by November 2026 (CSQ recommends 60 days), the offsite document evaluation in January or February 2027, the Level 2 onsite audit plus the concurrent four-hour Addendum audit around March 2027, corrective actions closed within 30 days, and the certificate in hand by about May 2027, since Maryland audits have run about six weeks from audit day to certificate. That leaves margin for the MCA product-approval review, whose timeline the MCA does not publish. A score below 70, or any critical finding, costs a six-month wait before reapplying, so plan one solid attempt per cycle. If your target is close, put your date in the form above and we’ll tell you the earliest audit dates we can offer.
Prepare Your Team with Kiwa ASI Training
Live online courses, taught by experienced food safety trainers, for the GMP knowledge Maryland’s rules expect and the qualifications CSQ asks for. CSQ’s own Certification Program Overview course for your program manager is taken online through CSQ.
HACCP
HACCP Certification Training
IHA-accredited HACCP certification. CSQ Level 2 and 3 need one HACCP team member and a back-up certified in an IHA-approved course (4A.2).
16 contact hours · 4 half-days · Live via Zoom · 8:30 AM–12:30 PM CT
Upcoming dates$695 per seat
Dates on request. Ask about upcoming dates
Part 117
PCQI Certification Training
The FSPCA Preventive Controls for Human Food course behind 21 CFR Part 117, the federal food rule most edibles and beverage operations build on.
22 contact hours · 5 half-days · Live via Zoom · 8:30 AM–12:30 PM CT
Upcoming dates$899 per seat
Dates on request. Ask about upcoming dates
Internal Audit
Principles of Internal Auditing
Plan, run and report the internal audits CSQ requires (1.5), and follow up with corrective action (1.6).
Full day · Live online · 8:30 AM–2:30 PM CT
Upcoming dates$499 per seat
Dates on request. Ask about upcoming dates
EMP
Environmental Monitoring Program Training
Design the risk-based environmental monitoring program CSQ requires (2A.8), your early warning against Maryland’s pathogen stop rule.
Half day · Live online
Upcoming dates$300 per seat
Dates on request. Ask about upcoming dates
Allergens
Allergen Management Training
Allergen risk assessment and cross-contact control for infused edibles and beverages.
4 hours · Live online
Upcoming dates$300 per seat
Dates on request. Ask about upcoming dates
Food Defense
Food Defense Coordinator Training
Threat assessments and a defense plan, supporting CSQ’s product defense and fraud prevention requirements (1.9, 1.10).
Full day · Live online · 8:30 AM–2:30 PM CT
Upcoming dates$499 per seat
Dates on request. Ask about upcoming dates
Need to train 6+ people? Request private training. Training is delivered by ASI Training and Consulting, LLC, separately from certification, and taking a course has no effect on your audit result.
Why Maryland Operators Choose Kiwa ASI
Kiwa ASI has audited food safety and GMP programs for decades and brings the same discipline to Maryland’s cannabis processors, under the federal cGMP rules Maryland names.
-
Accredited
CSQ’s Licensed Certification Body
CSQ certificates are issued by ASI Food Safety, LLC (Kiwa ASI), CSQ’s licensed certification body, which is accredited to ISO/IEC 17065.
-
Track record
Maryland’s Level 2 Benchmark
Every Maryland operation on CSQ’s public registry holds a dietary-supplement scope, and the CSQ 2.0 certificates among them are all Level 2 with the Dietary Supplement Addendum (October 2026): the pairing Kiwa ASI maps to Maryland’s Part 111 high-potency lane. Maryland itself names no scheme or level.
-
Part 111
Built for the Part 111 Lane
CSQ’s Dietary Supplement Addendum is built on 21 CFR Part 111, the dietary-supplement cGMP rule Maryland names for high-potency edibles, and layers master production records, batch records, retention samples and botanical identity on top of the base GMP audit.
-
Auditors
Qualified, Impartial Auditors
CSQ auditors need bioscience education, IHA-recognized HACCP training and CSQ lead auditor training, and can’t audit a site they provided consulting to, including delivering training, in the past three years.
-
Integrity
Impartiality, Disclosed
CSQ is owned by ASI Global Standards, LLC, which, like ASI Food Safety, LLC, is part of ASI Holdings. CSQ discloses that relationship and publishes an impartiality statement. Auditors can’t audit a site they provided consulting to, including delivering training, in the past three years, and every report gets an independent technical review before a certificate is issued.
-
Partnership
Global Kiwa Network
Part of Kiwa, a testing, inspection and certification group operating in more than 30 countries. Kiwa ASI audits and certifies; it doesn’t provide laboratory testing.
Frequently Asked Questions About Maryland Cannabis GMP Audits
Does Maryland require a third-party GMP audit for cannabis?
Not as a blanket rule. GMP practice is mandatory for every processor: SOPs, good manufacturing practices and a training plan before production (COMAR 14.17.11.04), plus an MCA edibles permit and a state pre-operation inspection for edibles (14.17.11.05(B)). The one third-party certificate mandate is for high-potency edibles, which must hold cGMP certification to 21 CFR Part 111 or Part 210 (COMAR 14.17.13.05(G)). For everyone else, certification is voluntary, independent proof that the GMP program Maryland already requires actually works.
What counts as a high-potency edible in Maryland?
An edible above the standard caps, meaning more than 10 mg THC per serving or 100 mg per package, up to 40 mg per serving and 400 mg per package (COMAR 14.17.13.05(G)(4)). It exists only through MCA product approval, and dispensaries may sell it only to qualified patients and registered caregivers.
What certification do high-potency edibles need?
The MCA submission must include a third-party certification demonstrating cGMP under 21 CFR Part 111 or Part 210, proof of the certifier’s accreditation to certify that cGMP, an attestation that the third party audited your facility with a checklist covering the products in scope, the checklist with your facility’s score and score scale, a corrective plan for any deficiencies, and documentation that the dosage form is recognized by the USP, the National Formulary or the FDA (COMAR 14.17.13.05(G)(2)–(3)). Within CSQ, that points to Manufacturing Level 2 plus the Dietary Supplement Addendum; ask our certification team to confirm the accreditation-scope documentation for your submission.
What is the CSQ Dietary Supplement Addendum, and why does it need Level 2?
The Dietary Supplement Addendum is CSQ’s scope extension for dietary-supplement-type products, built on 21 CFR Part 111: master production records, batch records, retention samples and botanical identity. CSQ’s own scope statement restricts it to Level 2 and Level 3 certifications, so a Level 1 site cannot carry it. It is a pass/fail audit of at least four hours that runs alongside any CSQ certification audit, never on its own before certification, with its own report within 72 hours. That restriction is why the Maryland high-potency lane starts at CSQ Manufacturing Level 2.
I make standard 10 mg edibles. Do I need CSQ certification?
Maryland doesn’t mandate it. Standard edibles, capped at 10 mg THC per serving and 100 mg per package, need the MCA edibles permit, the pre-operation inspection and your GMP SOPs, with no third-party certificate at any level. CSQ Manufacturing Level 1 is the voluntary entry point many operators use as independent proof for buyers, and you can step up to Level 2 and add the Dietary Supplement Addendum when high-potency approval enters your roadmap.
Does Maryland require or approve CSQ certification?
No. Maryland’s rules name only the federal cGMP regulations, 21 CFR Part 111 and Part 210, and the MCA keeps no list of approved auditors or schemes: it approves products, and its high-potency rule demands proof of the certifier’s accreditation instead (COMAR 14.17.13.05(G)(3)(a)). Kiwa ASI audits Maryland operations to CSQ, a cannabis- and hemp-specific GMP standard, and CSQ certificates are issued by ASI Food Safety, LLC (Kiwa ASI), CSQ’s licensed certification body, which is accredited to ISO/IEC 17065.
Which CSQ standard applies to my license?
Growing uses CSQ Cultivation, extraction and concentrates use CSQ Extraction, and making finished products such as edibles, beverages and topicals uses CSQ Manufacturing; dispensaries use CSQ Retail and warehouses use CSQ Warehousing & Distribution. Maryland licenses each activity separately, and operators holding more than one combine the standards in one coordinated audit. CSQ Cultivation, Extraction and Manufacturing are on Version 2.0, in effect since January 2026; Retail and Warehousing & Distribution are on Version 1.0.
Which CSQ level do I need in Maryland?
Maryland names no level, so it depends on your products. Level 1 covers CSQ’s GMP modules, the practices Maryland mandates for every processor. Level 2 adds a full HACCP system with an IHA-certified team member and back-up, and Level 3 adds advanced quality management with unannounced audits. The deciding factor is the high-potency lane: the Dietary Supplement Addendum attaches only to Level 2 and Level 3, so high-potency plans mean Level 2 at minimum. On CSQ’s public registry, every Maryland CSQ 2.0 certificate is Level 2 with the Addendum (October 2026).
What do the MCA edibles permit and pre-operation inspection involve?
Before engaging in the business of processing edible cannabis products, you need an edibles permit from the MCA and must pass a pre-operation inspection (COMAR 14.17.11.05(B)), with your SOPs, GMP program and training plan already in place (14.17.11.04). The MCA publishes no inspection checklist, its guidance says “the checklist is COMAR,” so the regulation itself is the prep list.
How long does CSQ certification take in Maryland?
Most operations need several months to build the system and collect records; CSQ recommends at least 60 days (two months) of records before attempting certification. The audit itself is a 1-day offsite documentation review, up to six months before the onsite visit, plus 1 day onsite at Level 1 or 1.5 days at Level 2, and corrective actions close within 30 days. The final report and certificate follow within about 45 days; Maryland audits have run about six weeks from audit day to certificate.
How much does CSQ certification cost in Maryland?
There’s no single price. Audit time drives the fee: your CSQ level (1, 1.5 or 2 days onsite minimum), the standards in scope, the four-hour Dietary Supplement Addendum, the 1-day document review on initial audits, the number of sites and travel. Request a quote for your Maryland scope.
How often do I need to be audited?
Once a year. A CSQ certificate is valid for one year plus 45 days, so the annual certification audit keeps it current, which matters if you hold or plan high-potency product approvals. A score of 70–79 adds a surveillance audit about six months later, and a score of 79 or below on that audit suspends the certificate. Every certified site also gets an unannounced audit at least once every three years.
What happens if we fail the audit?
A score below 70, or any critical finding, means no certificate and a six-month wait before reapplying, so plan for one solid attempt. A score of 70–79 still earns a certificate with a surveillance audit six months later. Corrective actions from any audit must be approved and closed within 30 calendar days of the closing meeting.
Can a brand-new facility get certified before launch?
Where an audit is needed before operations begin and production records don’t yet exist, CSQ allows a provisional six-month certificate, followed by a full audit around the six-month mark. Ask us whether the provisional route fits your Maryland timeline and your buyers’ expectations.
What is Maryland’s pathogen stop rule?
Since early 2026, MCA guidance codifies what happens after a failed pathogen test: production stops, product is quarantined under an MCA administrative hold, an independent testing laboratory swabs before and after cleaning, and the MCA clears you to resume. A repeat positive within 60 days triggers a mandatory investigation report and corrective action plan the MCA must approve. CSQ’s environmental monitoring, sanitation and CAPA requirements are built to catch these problems before the state does.
How does Maryland treat hemp-derived edibles?
Intoxicating hemp products, those with more than 0.5 mg THC per serving or 2.5 mg per package, may be sold only by licensed dispensaries and must be manufactured, processed and tested in accordance with MCA regulations, per MCA guidance; processors also need prior MCA approval to acquire hemp from registered growers. Maryland has no separate hemp GMP-certificate rule, so hemp product lines ride on the same processor rules, and CSQ covers cannabis and hemp cannabinoid operations alike.
Does Kiwa ASI training affect my CSQ audit?
No. Training and certification are kept separate. CSQ certification audits are delivered by ASI Food Safety, LLC, the certification body. Training is delivered by ASI Training and Consulting, LLC, separately from certification, and taking a course has no effect on your audit result. An auditor, technical reviewer or certification decision maker can’t work on your certification if they provided consulting, including delivering training, to your operation in the past three years.
Who issues CSQ certificates, and are they accredited?
CSQ certificates are issued by ASI Food Safety, LLC, the company behind the Kiwa ASI brand and CSQ’s licensed certification body, which is accredited to ISO/IEC 17065. CSQ itself is a standard, so it isn’t accredited, and it isn’t GFSI-benchmarked. Certificates are listed on CSQ’s public registry, where the MCA and your buyers can verify them.
Ready to plan your Maryland CSQ audit?
Tell us your license type, what you make and whether high-potency approval is on your roadmap. We’ll recommend a CSQ standard, level and any addendum, quote your audit and tell you the earliest audit dates we can offer.
Standards & Trust
ASI Food Safety, LLC (Kiwa ASI) is currently CSQ's licensed certification body and is accredited to ISO/IEC 17065. CSQ is a standard, so it isn't itself accredited, and it isn't GFSI-benchmarked. Maryland names no certification scheme and keeps no list of approved auditors: the MCA approves products, and its high-potency rule instead demands proof of the certifier’s accreditation (COMAR 14.17.13.05(G)(3)(a)). CSQ is owned by ASI Global Standards, LLC, which, like ASI Food Safety, is part of ASI Holdings (see CSQ’s program oversight and impartiality statement). Kiwa ASI training is delivered separately from certification.