New Kiwa ASI Self-Paced Training: Train your whole team New Self-Paced Training: Train your whole team Browse Courses
Phone hotline 1 (800) 477-0778 · US.Info@kiwa-asi.com
Kiwa ASI
Nearly a century of food safety expertise, headquartered in St. Louis.
Audits & Inspections
Independent second- and third-party audits for facilities at every stage.
Not sure which audit you need? Answer a few questions and see what fits. It takes about a minute.
Try the Audit Finder →cGMP Audits
Sector-specific Good Manufacturing Practice audits.
GFSI Certification
GFSI-benchmarked programs accepted by major retailers worldwide.
Not sure which audit you need? Answer a few questions and see what fits. It takes about a minute.
Try the Audit Finder →Cannabis Certification
Prove product safety in cultivation, extraction and manufacturing.
Cosmetics Certification
GMP for the cosmetics industry, including MoCRA readiness.
Dietary Supplement Certification
Go beyond basic GMPs with GFSI-benchmarked quality management.
CSR & Sustainability
Certifications for sourcing, allergens and environmental claims.
Food & Beverage
Find your sector. The tag shows the program most of our clients in that sector certify to.
ProcessingProgram
Ingredients & BeverageProgram
Cannabis
CSQ, GMP and state-specific regulatory audits.
Certification
State programs
In every tier, CSQ certification is an independent way to prove your program.
Regulatory QMS
Not sure which program your license requires? Our team maps state rules to the right audit.
Talk to a cannabis specialist →Cosmetics
GMP verification for beauty and personal-care manufacturers.
Dietary Supplements
FDA 21 CFR 111 compliance and GFSI-level quality.
Online Self-Paced Training
Short courses built by Kiwa ASI. Train anytime, on any device.
Frontline · $25 a seat
QA & Management · $499
Team training? Volume pricing from $12 a seat on the 30-minute frontline courses.
See volume pricing →Live Instructor-Led Training
Virtual classes led by Kiwa ASI instructors.
SQF Edition 10
FDA & Regulatory
Hazards & Controls
Live Trainings in St. Louis
In-person classes at our St. Louis headquarters.
Free Webinars
Fix It Fridays 2027: six free, 60-minute webinars on why food safety programs break down, and how to fix them.
Jan – May 2027
Jul – Nov 2027
Resources
Articles, answers and media from the Kiwa ASI team.
Forms
Order certification banners or submit feedback.
Show Me Food Safety Scholarship
Supporting the next generation of food safety professionals.
Ohio does not require third-party certification. It requires something stronger: every licensed cultivator and processor has owed written GMP policies and procedures since January 1, 2026 (OAC 1301:18-4-01), and beginning November 2, 2026 a GMP inspection is a condition of issuing or renewing every processor’s certificate of operation (OAC 1301:18-6-06(B)). Kiwa ASI audits and certifies cannabis and hemp operations to CSQ, the voluntary, independently verified proof layer for the GMP program Ohio already requires you to run.
Last updated October 28, 2026
Tell us your license type, what you grow or make, and when your certificate of operation renews. We’ll confirm your CSQ standard and level, quote the audit, and tell you the earliest dates we can offer against your renewal calendar.
No certificate is required, but do not mistake that for a light touch. Ohio mandates GMP itself: since January 1, 2026, every licensed cultivator and processor must establish, maintain, and comply with written policies and procedures for the safe, sanitary, and clean cultivation and manufacturing of cannabis (OAC 1301:18-4-01). The rule is modeled on FDA food GMP, 21 CFR Part 117. Only the third-party certificate is voluntary. Here is the short version.
Ohio finished building a manufacturing-grade compliance stack between January and November 2026. January 1: the GMP mandate, certified food protection manager availability, and training rules. March 20: SB 56 consolidated both programs under the Division of Cannabis Control and repealed ORC 3780. September 11: the universal THC symbol and packaging and labeling rules. October 5: package limits (OAC 1301:18-4-06) and the non-marijuana ingredient rule (OAC 1301:18-6-07). November 2: the codified processor GMP inspection (OAC 1301:18-6-06(B)), extraction standards, new definitions, and packaged-product transfer rules.
Written GMP for every cultivator and processor (OAC 1301:18-4-01), a certified food protection manager available during all operating hours when products are prepared or packaged (1301:18-3-10(C)(3)(a)), ingredient controls with division pre-approval (1301:18-6-07), package limits (1301:18-4-06), and packaging and labeling rules. Add batch testing through accredited labs and, beginning November 2, 2026, a GMP inspection before any processor’s certificate of operation is issued or renewed (1301:18-6-06(B)).
Third-party certification. No Ohio statute or rule requires a CSQ, GFSI or any other certificate. A CSQ audit is the voluntary way to prove, to regulators, buyers, and partners, that the GMP program Ohio already requires actually runs, verified by an independent certification body.
The Division of Cannabis Control enforces (ORC 3796.14: suspension, revocation, civil penalties, unannounced inspections), and for processors the Ohio Department of Agriculture conducts the GMP inspection tied to renewal. Outside state visits, no one verifies your quality system on any schedule unless you choose independent verification. That gap is where certification earns its keep.
Ohio’s four license types: cultivators (Level I and II), processors, dispensaries and testing laboratories, under dual-use licenses that cover both the medical and non-medical programs at one facility, consolidated under ORC 3796 and the Division of Cannabis Control since SB 56 took effect March 20, 2026.
The biggest change of 2026 is one paragraph of rule text, final-filed September 30, 2026 and effective November 2, 2026:
“Prior to the issuance or renewal of a certificate of operation, each processor must complete an inspection with the Ohio department of agriculture, or an equivalent body, evidencing compliance with the manufacturing standards established by the division and rule 1301:18-4-01 of the Administrative Code.” (OAC 1301:18-6-06(B))
Four readings decide what it means for you.
Since late 2025, Division of Cannabis Control guidance has told processors to expect the Ohio Department of Agriculture GMP inspection at least 90 days before the renewal deadline. From November 2, 2026, completing that inspection is written into the rule itself, as a condition of getting or keeping a certificate of operation.
Processor certificates of operation expire annually. The complete renewal application is due at least 30 calendar days before expiration, the inspection report uploads with it, and every noted deficiency must be fully remedied and verified by ODA before the application can even be submitted. Miss the deadline and the certificate suspends, then is deemed revoked (OAC 1301:18-2-08; DCC licensee guidance, December 15, 2025).
The rule names the Ohio Department of Agriculture “or an equivalent body” and defines the term nowhere. Who qualifies is entirely the Division’s call, and no published guidance answers it. Ask our certification team where CSQ stands on this question, and ask the Division before relying on any route other than the Ohio Department of Agriculture.
Compliance with OAC 1301:18-4-01 and the division’s manufacturing standards: the same written GMP program, sanitation, water, personnel and process controls a CSQ audit walks through. DCC’s own inspection guide tells processors to run internal audit preparation before ODA arrives.
Where a CSQ audit fits, stated plainly. A CSQ audit is a voluntary third-party assessment conducted by an ISO/IEC 17065 accredited certification body; it is not a substitute for the inspection the rule requires, and the Division of Cannabis Control determines what evidences compliance. November 2, 2026 also brings the exclusive extraction methods and solvents list (OAC 1301:18-6-06(E)), a conditional pathway to pull packaged retail cannabis back into extraction with re-testing duties (OAC 1301:18-6-08), new transfer rules for retail-packaged product between licensees (OAC 1301:18-3-18), and a replacement definitions rule (OAC 1301:18-1-01).
Since October 5, 2026, Ohio processors must run a real ingredient-control program: approved and regulated sources, GRAS status for anything in an ingestible product, division approval before any non-marijuana ingredient is used, receiving labels that capture source, date and allergens, and immediate quarantine with written notice to the Division when an ingredient fails (OAC 1301:18-6-07). These are the same systems a CSQ audit has always examined. The rule tells you what your program must do; the certificate shows regulators, partners and buyers that an independent certification body verified it actually does it.
Every non-marijuana ingredient needs division approval before use, a licensed and regulated source, and GRAS status if the product is ingestible (hemp and botanical terpenes excepted). Banned outright: nicotine, melatonin, beer, wine and intoxicating liquor, dietary supplements and dietary ingredients. Receiving labels must capture the ingredient, its source, the date received and any allergens, and nonconforming ingredients are quarantined with written notice to the Division (OAC 1301:18-6-07, in force since October 5, 2026).
Ohio bans specific carriers in anything intended for smoking, combustion or vaporization: MCT oil and other triglycerides, squalene, squalane, vitamin E acetate and propylene glycol (OAC 1301:18-6-07(E)(8)). CSQ draws the same line from the other side: inhalation-grade ingredients plus a route-of-administration risk assessment, with a plain warning that food-grade or GRAS status alone is not sufficient for inhalable products (CSQ Manufacturing, Sections 3C.2.5.2 and 3C.2.5.3).
Ohio’s new extraction rule sets clear purity floors: hydrocarbon solvents and food-grade carbon dioxide at a minimum of 99 percent purity in professional-grade, closed-loop systems, and ethanol at a minimum of 99 percent purity (OAC 1301:18-6-06(E), effective November 2, 2026). CSQ’s audit specifications point the same direction and sit a notch higher: process gases and liquid organic solvents at not less than 99.5 percent purity unless otherwise specified or required, CO₂ at beverage grade or better, and non-denatured, food-grade ethanol whenever it is used as an ingredient (Sections 3B.1.5, 3B.1.6, 3C.1.3, 3C.1.4). The audit checks that purchasing specifications and certificates of analysis actually deliver those numbers.
Since October 5, 2026, Ohio has capped every direct-sale package: no product over 90 percent THC, every package within 90 to 110 percent of its registered THC target, and category-by-category limits such as 10 mg THC per serving and 100 mg per package for adult-use edibles (OAC 1301:18-4-06). Formulation, blending and dosing controls are what keep a product inside those bands, and they are exactly what the audit samples (CSQ Manufacturing, Section 3C.1.10).
Why this matters in practice: in April 2026, Ohio regulators recalled 40 infused gummy products from a single processor after a soy-based manufacturing input went undisclosed on labels as an allergen; nine months of production, sold at more than 40 dispensaries. Ohio’s 2026 allergen-labeling recalls show why the new ingredient rule exists, and ingredient intake, supplier approval and allergen declaration are precisely the controls a CSQ audit verifies (Sections 2A.11, 2A.10.2, 2A.12.7, 3C.2.6.2). CSQ certification never replaces compliance with the rules themselves: the approved solvent list, division approvals and closed-loop equipment requirements are conditions of your Ohio license.
CSQ publishes separate standards for cultivation, extraction, manufacturing, retail, and warehousing and distribution, so Ohio’s license types map cleanly onto one or two scopes. Ohio names no level and no standard; the readiness checklist below shows what each level covers. If you hold more than one scope, co-located scopes can be audited in the same visit, with each facility scoped individually; ask us to map yours.
Growing, harvesting, drying, curing and post-harvest handling, up to 100,000 square feet for Level I and 15,000 for Level II (ORC 3796.18(D)). The GMP mandate covers cultivators too (OAC 1301:18-4-01), alongside agrochemical controls (1301:18-5-03(F)) and inventory and harvest tracking (1301:18-5-06). CSQ Cultivation is a cGACP and cGMP certification program with a HACCP module based on Codex Alimentarius at Level 2 and above. CSQ’s levels are audit tiers, not Ohio’s cultivator license levels.
Solvent and non-solvent extraction and refinement. Ohio hooks: processor operating procedures and quality assurance (OAC 1301:18-6-03, including annual NIST-traceable scale calibration by an approved independent third party under (C)(6)), the new extraction standards (1301:18-6-06(E), from November 2, 2026), and a designated extraction-safety supervisor (1301:18-3-10(C)(3)(b)).
Edibles, beverages, vapes, topicals and pre-rolls. Ohio hooks: the GMP mandate (OAC 1301:18-4-01), the ingredient rule (1301:18-6-07), package limits (1301:18-4-06), single serving units (1301:18-4-23) and, from November 2, 2026, the manufacturing and inspection rule (1301:18-6-06). Processors holding both scopes: co-located scopes can be audited in the same visit, with each facility scoped individually.
Retail storage, handling and sale under Chapter 1301:18-8, with employee training duties under 1301:18-3-10. CSQ Retail is built on current good handling practices: inventory, storage, customer-facing controls and staff training. Pure buyer-assurance best practice; no Ohio rule hook.
Ohio has no separate transporter or distributor license; transport duties live inside the four license types, with manifests and real-time vehicle location (OAC 1301:18-3-13), food-grade tamper-evident business-to-business packaging (1301:18-3-16) and, from November 2, 2026, new transfer rules for retail-packaged product (1301:18-3-18). Standalone warehousing and distribution operations map to CSQ Warehousing & Distribution, Version 1.0; duties inside a producer license are covered by your standard’s storage and distribution sections.
Labs follow their own lane: Ohio requires ISO/IEC 17025 accreditation within two years of provisional licensure, from an accreditation body that is an ILAC MRA signatory (OAC 1301:18-7-04). That is a state requirement, not a CSQ scope: CSQ publishes no laboratory standard, and Kiwa ASI does not provide laboratory testing.
Where the testing rules stand. Ohio’s testing panel still runs under OAC 3796:4-2-04 (effective 2022): potency, moisture, water activity, foreign matter, microbial and mycotoxin contamination, heavy metals, pesticide and fertilizer residue, and residual solvents for processed products. The Division’s replacement testing rules remain pending as of October 28, 2026, so your lab obligations today trace to the 2022 panel and your product testing duties to your certificate conditions.
Ohio’s rules are the legal floor, and since January 2026 that floor is genuinely manufacturing-grade. CSQ is a published, cannabis-specific standard that adds verified best practice the rules don’t spell out, plus an independent annual check between state inspections.
An initial CSQ audit has three parts: a one-day offsite evaluation of your documentation (no more than six months before the site visit), the onsite audit, and the report. Minimum onsite time is 1 day at Level 1, 1.5 days at Level 2 and 2 days at Level 3, plus report time; Level 3 onsite audits are unannounced. Your actual time depends on the standards in scope and the size of your site. The auditor checks your written system against CSQ and Ohio’s rules (CSQ 1.3, Regulatory Compliance), watches your people work, and samples your records.
| Module | What the auditor checks |
|---|---|
| 1 Management system (all levels) | Documented CSQ system with SOPs and a copy of Ohio’s rules, management commitment, regulatory compliance, records, internal audits, CAPA, complaints, recalls and withdrawals, product defense, fraud prevention and crisis management |
| 2A Good manufacturing practices (cultivation, extraction, manufacturing, deli-style) | Facility and infrastructure, equipment and calibration, cleaning and sanitation, waste, integrated pest management, air and water safety, environmental monitoring, storage, inventory and traceability, supplier approval, production and process controls, labeling and packaging, product testing, personnel |
| 2B Good handling practices (CSQ Retail, Version 1.0) | The retail twin of Module 2A: facility, sanitation, storage and temperature control, inventory management, product handling controls, labeling, sampling and personnel, built for dispensary operations |
| 3A / 3B / 3C / 3D / 3E Products and processes (all levels) | Cultivation (3A): water, fertigation, crop maintenance, harvest. Extraction (3B): process gases and solvents, extraction equipment, post-processing. Manufacturing (3C): ingredients, formulation, inhalable, ingestible and topical product controls, homogeneity and dosing. Deli-style retail (3D): herbal-material handling and pre-roll production. Retail (3E): cannabinoid materials and products handled at the store |
| 4A / 4B HACCP (Level 2 and above) | Hazard analysis, critical control points, monitoring, corrective actions, validation and verification. Module 4A (producers and deli-style) also requires a HACCP team with one member and a back-up certified through an IHA-approved course; plain Retail is audited to the basic HACCP module 4B |
| 5 Advanced quality management (Level 3) | Advanced management system requirements, safety and quality culture, customer satisfaction and product realization; Level 3 onsite audits are unannounced |
| Mock recall and traceability | Your annual mock recall record, plus a traceability exercise during the audit |
Each audit starts at 100, and every nonconformance deducts points. The final score decides the outcome:
| Result | Score | What happens next |
|---|---|---|
| Certified | 80–100 | Certificate; next annual certification audit in a year |
| Certified with surveillance | 70–79 | Certificate plus a surveillance audit in six months; a score of 79 or below on that audit suspends the certificate |
| Not certified | 0–69 | No certificate; wait six months before reapplying |
Certificates are valid for one year plus 45 days and are listed on CSQ’s public registry, where your wholesale buyers, inspectors and anyone else can look them up.
A requirement that has not been implemented and is a significant risk to product safety and quality. A critical finding fails the audit.
A deficiency in meeting a CSQ requirement that, if not addressed, will likely lead to a risk to product safety and quality.
A deficiency in meeting a CSQ requirement that, if not addressed, may lead to a risk to product safety or quality.
After the audit: corrective actions must be approved and closed within 30 calendar days of the closing meeting, and the final report and certificate follow within about 45 days. Every certified site also gets an unannounced audit at least once every three years. Agree blackout dates with us for days your operation won’t be running, and submit them no later than 60 days before the unannounced audit window; refusing an unannounced audit suspends the certificate.
The Division enforces through inspections and the state inventory system, ODA walks OAC 1301:18-4-01 paragraph by paragraph at processor renewals, and a CSQ audit samples the same disciplines. Use this list to check you’re ready before anyone arrives.
| Ohio requirement | Citation (OAC / ORC) | CSQ sections |
|---|---|---|
| GMP scope, sanitation, water, personnel, allergens | 1301:18-4-01 (eff. 1/1/2026) | Module 2A + 2A.1 Facility and Facility Infrastructure + 2A.3 Cleaning and Sanitation + 2A.7 Facility Water Safety and Quality + 2A.13 Personnel Requirements + 2A.12.7 Allergen Management |
| Processor SOPs and quality assurance; scale calibration | 1301:18-6-03 | 1.1 Cannabis Safety and Quality Management System + 1.3 Regulatory Compliance + 2A.12.1 Standard Operating Procedures + 2A.2 Equipment, Maintenance, and Calibration |
| Extraction methods and solvent purity | 1301:18-6-06(E) (eff. 11/2/2026) | 3B.1.2 Solvent-Based Extraction and Refinement + 3B.1.5 Air, Carbon Dioxide, Liquefied Petroleum Gases (LPG), and Other Process Gases + 3B.1.6 Ethanol and Other Liquid Organic Solvents |
| Non-marijuana ingredient controls, GRAS, receiving, quarantine | 1301:18-6-07 (eff. 10/5/2026) | 2A.11 Supplier Approval and Vendor Qualifications + 2A.10.2 Acceptance and Release + 2A.10.4 Hold and Release (Quarantine) + 3C.1.8 Non-Cannabinoid Ingredients Used During Manufacturing |
| Packaging, labeling, THC symbol, package limits | 1301:18-4-04, -19 to -21, -23 (eff. 9/11/2026); 1301:18-4-06 (eff. 10/5/2026) | 2A.12.8 Product Labeling and Packaging + 3C.1.10 Blending, Compounding, Formulation, and Mixing + 2A.12.9 Product Sampling and Testing |
| Batch testing; accredited labs | 3796:4-2-04 (panel; replacement rules pending); 1301:18-7-04 | 2A.12.9 Product Sampling and Testing |
| Inventory tracking and traceability | ORC 3796.07 (state inventory system) | 2A.10 Inventory Management (2A.10.1 Identification and Traceability + 2A.10.3 Stock Management) |
| Transport, B2B packaging and transfers | 1301:18-3-13; 18-3-16; 18-3-18 (eff. 11/2/2026) | 2A.9 Storage and Distribution (2A.9.4 Shipping and Receiving) |
| Training and personnel qualifications | 1301:18-3-10 (eff. 1/1/2026) | 2A.13.2 Personnel Training + 2A.13.1 Personnel Roles and Responsibilities |
| Waste | 1301:18-3-12 | 2A.4 Waste Management (2A.4.1 Cannabinoid Waste; 2A.4.2 Non-Cannabinoid Waste) |
| Cultivation inputs, pest management, harvest | 1301:18-5-03, 18-5-06; 18-4-01(C)(3), (D)(1) | 2A.5 Integrated Pest Management + 3A.1.5 Cultivation Inputs and Controls + 3A.1.10 Water Used During Cultivation + 3A.1.15 Harvesting + 3A.1.16 Drying, Curing, and Post-Harvest Activities |
| Recalls and product alerts | ORC 3796.14; 1301:18-9-04 | 1.8 Product Recalls and Withdrawals + 1.6 Corrective Actions and Preventive Actions (CAPA) |
| Dispensary handling, storage, inventory and labeling (CSQ Standard for Retail & Deli-Style Retail, Version 1.0) | Chapter 1301:18-8; 18-3-10 | Module 2B + 2B.8 Storage and Distribution + 2B.9 Inventory Management + 2B.11 Product Handling Controls + 2B.12 Personnel Requirements + Module 3E |
Mapping by Kiwa ASI to CSQ Version 2.0 producer standards and CSQ Retail Version 1.0; Ohio names no scheme and no level, and the mapping is Kiwa ASI’s reading of where each duty lands in CSQ, not a state-endorsed crosswalk. Level 1 covers the management system, GMP, and products-and-processes modules (Modules 1 to 3); Level 2 and above add HACCP. Ask us which configuration fits your facility.
Ohio hands every processor the calendar: an annual certificate of operation, the ODA GMP inspection expected at least 90 days before the renewal deadline, and a complete renewal application, inspection report attached and every deficiency verified as fixed, due 30 days before expiration (OAC 1301:18-2-08; DCC licensee guidance, December 15, 2025). Work backward from the inspection, not the audit.
Write down your certificate-of-operation expiration date, then count back: renewal application due at least 30 days before it, ODA GMP inspection expected at least 90 days before the deadline, and every inspection deficiency remedied and ODA-verified before the application can be submitted. That is the clock certification work has to fit inside.
Match CSQ Cultivation, Extraction, Manufacturing, Retail or a combination to what you actually do, and choose a level: Level 1 is a complete GMP and quality management certification, Level 2 and above add HACCP. Request a quote so we can confirm scope and audit time.
A quality manual on your chosen standard, the written GMP policies and procedures Ohio already requires (OAC 1301:18-4-01), SOPs for every operation, batch records, supplier approval with division ingredient approvals, sanitation, environmental monitoring, traceability tied to the state inventory system, a recall plan, documentation and recordkeeping, internal audit and CAPA. Your program manager also takes CSQ’s online Certification Program Overview course, accessed through the CSQ website.
Keep the certified food protection manager available during production and packaging hours, meet the annual OSHA requirement (a safety supervisor with the 30-hour OSHA course or a division-approved third-party consultant), and designate your extraction-safety supervisor (OAC 1301:18-3-10). Train every person on GMP, hygiene and their own procedures, and for Level 2 and above have one HACCP team member and a back-up certified through a course approved by the International HACCP Alliance.
Operate the system, and build up about 60 days of records, which CSQ recommends before certification. Run a documented internal audit and a mock recall in under two hours, close what you find through CAPA, and check yourselves against the published standard before the real audit, a step CSQ strongly recommends and one your own team can run.
Sign the certification agreement with ASI Food Safety, LLC and set your audit dates with our certification team. Send your documents for the offsite evaluation, which can happen up to six months before the onsite audit, and pick an onsite date that leaves time for corrective actions before your renewal window.
Close corrective actions within 30 days of the closing meeting and, with a passing score, receive your certificate, typically within about 45 days of the audit. Keep it current with the annual certification audit: a current certificate is standing, independent proof of the GMP program Ohio already requires you to run, renewal after renewal.
Worked backward from an October renewal: a processor whose certificate of operation renews in October should expect the ODA inspection around July. An operator who wants a CSQ certificate in hand before that inspection would have its system generating records by winter (CSQ recommends about 60 days of records), book the one-day offsite documentation evaluation in late winter, run the onsite audit in early spring, close corrective actions within 30 days, and hold the certificate before ODA arrives, with months to spare before the October renewal. A score below 70, or any critical finding, means a six-month wait before reapplying, which is the practical argument for not starting in the quarter your inspection is due. Put your renewal date in the form above and we’ll tell you the earliest audit dates we can offer.
Live online courses, taught by experienced food safety trainers, for the GMP disciplines Ohio’s rules expect and the qualifications CSQ asks for. CSQ’s own Certification Program Overview course for your program manager is taken online through CSQ.
One day on current Good Manufacturing Practices for the people who run your floor every day, the discipline OAC 1301:18-4-01 made mandatory.
8 contact hours · 1 full day · Live via Zoom · 8:30 AM–4:30 PM CT
Dates on request. Ask about upcoming dates
IHA-accredited HACCP certification. CSQ Level 2 and above on Cultivation, Extraction, Manufacturing and Deli-Style Retail need one HACCP team member and a back-up certified in an IHA-approved course (4A.2).
16 contact hours · 4 half-days · Live via Zoom · 8:30 AM–12:30 PM CT
Dates on request. Ask about upcoming dates
The FSPCA Preventive Controls for Human Food course built on 21 CFR Part 117, the federal GMP baseline Ohio’s cannabis rule is modeled on, and the regulation Ohio adopts in its entirety for food processing establishments (OAC 901:3-17-01).
22 contact hours · 5 half-days · Live via Zoom · 8:30 AM–12:30 PM CT
Dates on request. Ask about upcoming dates
Plan, run and report the internal audits CSQ requires (1.5).
Full day · Live online · 8:30 AM–4:30 PM CT
Dates on request. Ask about upcoming dates
Design the risk-based environmental monitoring program CSQ requires (2A.8), a discipline Ohio’s rules don’t spell out.
Half day · Live online
Dates on request. Ask about upcoming dates
Allergen risk assessment and cross-contact control for infused edibles and beverages, the failure mode behind Ohio’s April 2026 allergen-labeling recalls (OAC 1301:18-4-01(F)(2)(i)).
4 hours · Live online
Dates on request. Ask about upcoming dates
Threat assessments and a defense plan, supporting CSQ’s product defense and fraud prevention requirements (1.9, 1.10).
Full day · Live online · 8:30 AM–4:30 PM CT
Dates on request. Ask about upcoming dates
Need to train 6+ people? Request private training. Training is delivered separately from certification by a different legal entity, and taking a course has no effect on your audit result.
Kiwa ASI has audited food safety and GMP programs for decades and brings the same discipline to Ohio’s cannabis operators, in a young market where non-medical sales are growing fast and regulation is moving faster.
CSQ certificates are issued by ASI Food Safety, LLC (Kiwa ASI), CSQ’s licensed certification body, which is accredited to ISO/IEC 17065.
CSQ is purpose-built for cannabis operations, with standards covering cultivation, extraction, manufacturing, retail, and warehousing and distribution, each on three levels. You certify to a standard written for what you actually do, not a food scheme stretched to fit.
As of October 2026, the public CSQ registry lists 115 certified sites across 16 states, exactly one of them in Ohio, certified under a legacy CSQ scope. No Ohio site yet holds a certificate to the current CSQ Version 2.0 standards. Ohio operators who certify now would be among the first in the state on the modern standard.
CSQ auditors need bioscience education (or equivalent work experience), IHA-recognized HACCP training and CSQ lead auditor training, and can’t audit a site they provided consulting to, including delivering training, in the past three years.
CSQ is owned by ASI Global Standards, LLC, which, like ASI Food Safety, LLC, is part of ASI Holdings. CSQ discloses that relationship and publishes an impartiality statement. The same three-year consulting bar applies to auditors, and every report gets an independent technical review before a certificate is issued.
Part of Kiwa, a testing, inspection and certification group operating in more than 30 countries. Kiwa ASI audits and certifies; it doesn’t provide laboratory testing.
No certificate is required, but GMP itself is mandatory. Since January 1, 2026, every licensed cultivator and processor must keep written GMP policies and procedures (OAC 1301:18-4-01), and beginning November 2, 2026 a GMP inspection is a condition of issuing or renewing every processor’s certificate of operation (OAC 1301:18-6-06(B)). Third-party certification such as CSQ stays voluntary: it is independent proof that the program Ohio already requires actually runs.
Written policies and procedures for the safe, sanitary and clean cultivation and manufacturing of cannabis, covering personnel hygiene and handwashing, food-safe sanitizers, pest exclusion, potable water meeting 40 CFR Part 141, stocked handwash sinks, food-grade containers, humidity control, allergen cross-contact control and pH controls for low-acid products. The rule is modeled on FDA food GMP, 21 CFR Part 117, and took effect January 1, 2026. A narrow exemption exists only for facilities that held a certificate of operation before that date and only for immutable structural features.
Four final rules take effect. OAC 1301:18-6-06 makes a GMP inspection a condition of issuing or renewing every processor’s certificate of operation, bans manufacturing potentially hazardous foods at licensed premises except as expressly permitted, and sets the exclusive extraction methods and solvents list: 99 percent minimum solvent purity, with closed-loop systems required for hydrocarbon and CO₂ extraction. OAC 1301:18-6-08 adds a conditional pathway to pull packaged retail cannabis back into extraction. OAC 1301:18-3-18 sets transfer rules for retail-packaged product between licensees. And a replacement definitions rule (OAC 1301:18-1-01) takes effect the same day.
The rule names the Ohio Department of Agriculture “or an equivalent body” and defines the term nowhere; the Division of Cannabis Control determines what evidences compliance. A CSQ audit is not a substitute for the inspection the rule requires; it is a voluntary third-party assessment conducted by an ISO/IEC 17065 accredited certification body. Ask our certification team where CSQ stands on this question, and ask the Division before relying on any route other than the Ohio Department of Agriculture.
Since October 5, 2026, every non-marijuana ingredient needs division approval before use and a licensed, regulated source, and anything in an ingestible product must be GRAS (hemp and botanical terpenes excepted). Nicotine, melatonin, beer, wine and intoxicating liquor, dietary supplements and dietary ingredients are banned outright, and nothing intended for smoking, combustion or vaporization may contain MCT oil or other triglycerides, squalene, squalane, vitamin E acetate or propylene glycol. Receiving labels must capture the ingredient, source, date and allergens, and failing ingredients are quarantined with written notice to the Division (OAC 1301:18-6-07).
Since October 5, 2026: no direct-sale product over 90 percent THC, every package within 90 to 110 percent of its registered THC target, flower capped at one ounce per package, and category limits such as 10 mg THC per serving and 100 mg per package for adult-use edibles (OAC 1301:18-4-06). The universal THC symbol and child-resistant, tamper-evident, division pre-approved packaging have been required since September 11, 2026 (OAC 1301:18-4-04 and 18-4-19 to 18-4-21).
Cultivators use CSQ Cultivation; processors use CSQ Extraction, CSQ Manufacturing or both, and co-located scopes can be audited in the same visit, with each facility scoped individually; dispensaries use CSQ Retail. Cultivation, Extraction and Manufacturing are on Version 2.0; Retail & Deli-Style Retail and Warehousing & Distribution are on Version 1.0. Testing laboratories follow Ohio’s own lane, ISO/IEC 17025 accreditation, which CSQ does not cover.
Ohio sets no level, so the choice is yours. Level 1 (Modules 1 to 3) is a complete GMP and quality management certification. Level 2 adds a HACCP system. On Cultivation, Extraction, Manufacturing and Deli-Style Retail, that means one team member and a back-up certified through an International HACCP Alliance approved course; plain Retail certifies to a basic HACCP module. Level 3 adds advanced quality management, and its onsite audits are unannounced. On the public CSQ registry, every site certified to the Version 2.0 standards holds Level 1 or Level 2 as of October 2026.
Most operations need several months to build the system and collect records; CSQ recommends about 60 days of records before attempting certification. The audit itself is a 1-day offsite documentation evaluation, up to six months before the onsite visit, plus at least 1 day onsite at Level 1, 1.5 days at Level 2 or 2 days at Level 3. Corrective actions close within 30 days, and the final report and certificate follow within about 45 days. CSQ also has a provisional six-month certificate route for sites that must be audited before beginning operations; ask our certification team whether it fits your situation.
There’s no single price. Audit time drives the fee: your CSQ level (1, 1.5 or 2 days onsite minimum), the standards in scope, the number of employees and product types, the 1-day documentation evaluation on initial audits, the number of sites and travel. Request a quote for your Ohio scope.
Once a year. A CSQ certificate is valid for one year plus 45 days, so the annual certification audit keeps it current. A score of 70–79 adds a surveillance audit about six months later, and a score of 79 or below on that audit suspends the certificate. Every certified site also gets an unannounced audit at least once every three years.
A score below 70, or any critical finding, means no certificate and a six-month wait before reapplying, so plan for one solid attempt well clear of your renewal window. A score of 70–79 still earns a certificate with a surveillance audit six months later. Corrective actions from any audit must be approved and closed within 30 calendar days of the closing meeting.
No. The inspection required at issuance and renewal (OAC 1301:18-6-06(B), from November 2, 2026) is its own obligation, and the Division of Cannabis Control determines what evidences compliance. What a CSQ certificate does is put a documented, independently audited GMP system behind everything the inspector walks through, and give buyers and partners standing, independent proof between inspections.
No. Ohio requires its testing laboratories to be accredited to ISO/IEC 17025 within two years of provisional licensure, by an accreditation body that is an ILAC MRA signatory (OAC 1301:18-7-04), and the testing panel still runs under OAC 3796:4-2-04 while the Division’s replacement testing rules remain pending. CSQ publishes no laboratory standard; what CSQ requires of certified operations is that finished-product compliance testing run through ISO/IEC 17025 accredited laboratories (2A.12.9). Kiwa ASI does not provide laboratory testing.
As tightly as marijuana. A processor may use a hemp-derived ingredient only if it meets Ohio’s definition of hemp (a total tetrahydrocannabinols concentration, including tetrahydrocannabinolic acid, of not more than three-tenths percent on a dry weight basis). The ingredient must also arrive solely in final extracted form, be tracked in the state inventory system categorized as hemp, and carry an accredited-lab certificate of analysis to the Division’s state-required testing standards (replacement testing rules still pending), or be submitted to an Ohio-licensed testing laboratory within 48 hours of receipt, with compliance confirmed before use. Failed hemp ingredients cannot be remediated or re-tested (OAC 1301:18-6-07(I)).
Because Ohio’s non-medical market is growing and the state is regulating at the same time. Non-medical sales reached 836 million dollars in 2025, the program’s first full calendar year, and had already topped 895 million dollars in 2026 by mid-October (Division of Cannabis Control sales data, as of October 10, 2026). As of the Division’s October 26, 2026 update, 37 licensed cultivators, 45 processors and 233 operating dispensaries were competing. The compliance stack finished building the same year, and Ohio logged six product recalls in 2026, including two April recalls for undisclosed allergens. In that market, an independent certificate is how operators stand out on trust while the rules keep arriving.
Not for Ohio compliance. Ohio’s ingredient rule bars dietary supplements and dietary ingredients from licensed cannabis products (OAC 1301:18-6-07(E)), and Ohio’s food-safety framework points to FDA human-food GMP, 21 CFR Part 117. The Dietary Supplement Addendum is built on 21 CFR Part 111 and serves operators in states or markets that call for supplement cGMP; it attaches only to a Level 2 or Level 3 CSQ Cultivation, Extraction or Manufacturing certification. Multi-state operators who need a Part 111 lane elsewhere can ask our certification team about adding it.
CSQ certificates are issued by ASI Food Safety, LLC, the company behind the Kiwa ASI brand and CSQ’s licensed certification body, which is accredited to ISO/IEC 17065. CSQ itself is a standard, so it isn’t accredited, and it isn’t GFSI-benchmarked. Certificates are listed on CSQ’s public registry, where anyone can verify them.
Tell us your license type, what you grow or make, and your renewal date. We’ll recommend a CSQ standard and level, quote your audit and tell you the earliest audit dates we can offer against your calendar.
ASI Food Safety, LLC (Kiwa ASI) is currently CSQ's licensed certification body and is accredited to ISO/IEC 17065. CSQ is a standard, so it isn't itself accredited, and it isn't GFSI-benchmarked. Ohio mandates GMP implementation and, for processors from November 2, 2026, a GMP inspection at issuance and renewal; it approves no certification scheme, and the inspection rule’s “equivalent body” language is the Division of Cannabis Control’s to interpret. CSQ is owned by ASI Global Standards, LLC, which, like ASI Food Safety, is part of ASI Holdings (see CSQ’s program oversight and impartiality statement). Kiwa ASI training is delivered separately from certification.