CSQ CERTIFICATION
The CSQ Certification Program and applicable standards were built around ISO/IEC 17067
Oklahoma Medical Marijuana (SQ 788, 2018) · Oklahoma Medical Marijuana Authority · 63 O.S. §427.1 et seq. · OAC Title 442
Oklahoma GMP for Medical Marijuana
Oklahoma licenses and inspects every medical marijuana grower, processor, dispensary, and testing laboratory through the Oklahoma Medical Marijuana Authority (OMMA), and a processor of edibles must meet Oklahoma's own food code (OAC 310:257 and 310:260) and hold a state food-establishment license. Oklahoma does not require a third-party GMP certificate and names no private standard — but in one of the most crowded, fast-tightening markets in the country, CSQ is an accredited, independent way to prove your GMP program.
Oklahoma's Medical Marijuana GMP and Why CSQ Certification Is Worth It
Oklahoma legalized medical marijuana in 2018 (State Question 788) and runs a medical-only program under the Oklahoma Medical Marijuana Authority (OMMA) — there is no adult-use market. For a processor that makes edibles, Oklahoma requires food-safety practices through its own food code and a state food-establishment license, plus mandatory lab testing and a mandatory recall duty — but it requires no third-party GMP certificate and names no private standard, and its rules are Oklahoma's own, not the federal FSMA manufacturing rules (21 CFR 111 or 117). In a market with among the most licensees per capita in the country — now contracting under a licensing moratorium and stepped-up enforcement — CSQ is an accredited, independent way to prove the GMP a buyer, lender, or multi-state partner is looking for. This page explains what Oklahoma actually requires, which CSQ standard fits your license, and where certification with Kiwa ASI adds value.
START HERE
Does Oklahoma Require Medical Marijuana Operators to Be GMP Certified?
No — Oklahoma requires no accredited third-party GMP certificate. But GMP is not optional for a processor: OMMA routes edible makers into Oklahoma's own food code and a state food-establishment license, and layers on mandatory lab testing and a mandatory recall duty. Here is the short version, and why CSQ still matters.
WHO REGULATES WHAT
One regulator: the Medical Marijuana Authority
Oklahoma's medical marijuana program is run by the Oklahoma Medical Marijuana Authority (OMMA), a standalone state agency since November 2022, under OAC Title 442. Growers, processors, dispensaries, and testing laboratories are all OMMA-licensed. Oklahoma is medical-only — there is no adult-use program.
THE REQUIREMENT
Food code + testing + a recall duty, not a GMP certificate
Edible processors must meet Oklahoma's own food code (OAC 310:257 and 310:260) and hold a state food-establishment license (OAC 442:10-5-8), have every product lab-tested (442:10-8), and follow a mandatory recall duty OMMA can enforce (442:10-8-1). No accredited third-party GMP certificate is required, and Oklahoma names no private GMP standard.
WHERE CSQ FITS
Voluntary — accredited proof that stands out
CSQ is an accredited (ISO/IEC 17065) cannabis-specific GMP certification. Oklahoma doesn't require it, but in a market with among the most licensees per capita — now contracting — it gives independent, audit-ready proof of your GMP program, valuable for OMMA readiness, buyer and multi-state diligence, and lender confidence.
What Oklahoma actually requires
Oklahoma runs a medical-only program: State Question 788 (2018) legalized medical marijuana, and the Unity Bill (HB 2612 of 2019), the Oklahoma Medical Marijuana and Patient Protection Act (63 O.S. §427.1 et seq.), built out the framework. There is no adult-use market — the adult-use ballot measure (SQ 820) failed in 2023. The program is administered by the Oklahoma Medical Marijuana Authority (OMMA), which became a standalone state agency in November 2022 (Senate Bill 1543), under the rules at OAC Title 442.
For a processor — Oklahoma's name for the maker of edibles, concentrates, and infused products — food-safety practices are the law. Under OMMA's food-safety rule (OAC 442:10-5-8), an edible processor must comply with Oklahoma's own food code (the Oklahoma Food Establishments and Good Manufacturing Practice rules, OAC 310:257 and 310:260) and hold a state food-establishment license. Every product is tested by an OMMA-licensed, ISO/IEC 17025-accredited laboratory (OAC 442:10-8), inventory is tracked in Oklahoma's designated seed-to-sale system, Metrc, and a mandatory recall duty applies — OMMA can order a recall and issue a public recall notice (442:10-8-1). What Oklahoma does not do is require an accredited third-party GMP certificate — its rules name no private standard (no SQF, BRCGS, FSSC, ISO, or CSQ), and the food-safety tie is to Oklahoma's own food code, not the federal FSMA manufacturing rules (21 CFR Part 111 or 117). GMP is verified by OMMA licensing and inspection. So in Oklahoma CSQ is voluntary: accredited, independent proof of the GMP program — the kind of assurance that stands out in a crowded, tightening market.
FIND YOUR PATH
Match Your Oklahoma License to the Right CSQ Standard
CSQ is voluntary in Oklahoma, so this is about which scope fits if you pursue certification. Match your OMMA license to the CSQ standard that fits; an operator that holds grower, processor, and dispensary licenses can combine scopes into one coordinated audit with Kiwa ASI.
Grower
OMMA · 63 O.S. §427.14STANDARD
CSQ Cultivation v2.0.0
MINIMUM LEVEL
Level 1
PREP TIME
6–9 months
AUDIT LENGTH
~1 day onsite + 1 day offsite doc review (initial)
The OMMA commercial grower license. Foundation: cGACP (good agricultural and collection practices) plus cGMP, with mandatory batch testing by an ISO/IEC 17025 lab (OAC 442:10-8) and seed-to-sale tracking in Metrc.
Processor
OAC 442:10-5-8 · OMMASTANDARD
CSQ Extraction / Manufacturing v2.0.0
MINIMUM LEVEL
Level 1
PREP TIME
6–9 months
AUDIT LENGTH
~1 day onsite + 1 day offsite doc review (initial)
The maker of edibles, concentrates, and infused products — and the license where Oklahoma's rules bite hardest. A processor must meet Oklahoma's own food code (OAC 310:257 and 310:260) and hold a state food-establishment license, and this is where CSQ maps most directly, because a state food-establishment license is not a manufacturing GMP program. CSQ items to watch: beverage-grade CO₂ (99.5%) and food-grade non-denatured ethanol for extraction, inhalation-grade ingredients, and the incoming 10 mg-per-serving edible cap (HB 4454, effective November 1, 2026).
Dispensary
OMMA · 63 O.S. §427.14STANDARD
CSQ Retail v1.0.0
MINIMUM LEVEL
Level 1
PREP TIME
4–6 months
AUDIT LENGTH
~1 day onsite + 1 day offsite doc review (initial)
The OMMA dispensary license, serving licensed patients and caregivers. Built on cGHP (good handling practices) — storage, handling, inventory control, Metrc tracking, and recall execution (OMMA's mandatory recall duty, OAC 442:10-8-1).
Testing Laboratory
OAC 442:10-8 · ISO/IEC 17025STANDARD
ISO/IEC 17025
MINIMUM LEVEL
N/A
PREP TIME
Varies
AUDIT LENGTH
Per accreditation body
Oklahoma requires product testing by an OMMA-licensed laboratory accredited to ISO/IEC 17025 (OAC 442:10-8). CSQ does not certify testing labs; it requires them to be ISO/IEC 17025 accredited — which is lab-competence accreditation, not the same as CSQ's ISO/IEC 17065.
OKLAHOMA REQUIRES VS. CSQ GOES FURTHER
What's a State Rule, and What's a CSQ Best Practice?
Oklahoma's regulations are the legal floor, enforced by OMMA licensing and inspection, mandatory lab testing, and a mandatory recall duty. CSQ is a voluntary published standard that documents GMP beyond that floor — and gives accredited, independent proof of the practices Oklahoma requires. Knowing which is which keeps you from over-buying or under-preparing.
What Oklahoma requires (the legal floor)
- An OMMA license for each operator — State Question 788 (2018); the Oklahoma Medical Marijuana and Patient Protection Act (63 O.S. §427.1 et seq.); rules at OAC Title 442
- For edible processors: compliance with Oklahoma's own food code and a state food-establishment license — OAC 442:10-5-8, incorporating OAC 310:257 and OAC 310:260
- Food-labeling rules (21 CFR Part 101) apply to edibles; HACCP (21 CFR Part 120) is encouraged but not required — OAC 442:10-5-8(d), (e)
- Batch testing by an OMMA-licensed, ISO/IEC 17025-accredited laboratory — OAC 442:10-8
- The Oklahoma THC Universal Symbol on packaging — a red “CONTAINS THC / NOT SAFE FOR KIDS OR PETS” badge, not a diamond — OAC 442:10-7-1(e)
- Edible THC limits: 10 mg per serving, 100 mg per package (beverages 20 mg per serving), effective November 1, 2026 — HB 4454
- Child-resistant packaging; no products or packaging that appeal to children (a shape/packaging ban takes effect November 1, 2026) — OAC 442:10-7-1; HB 4454
- A mandatory recall duty — OMMA can embargo product and order a recall, and may issue a public recall notice — OAC 442:10-8-1
- Seed-to-sale tracking in Oklahoma's designated system, Metrc — 63 O.S. §427.13
- No accredited third-party GMP certificate is required — Oklahoma names no private GMP standard
What CSQ adds (voluntary best practice)
- An accredited (ISO/IEC 17065) cannabis GMP certification — independent, audit-ready proof beyond OMMA inspection
- A manufacturing GMP program — the layer Oklahoma's state food-establishment license does not reach
- Built to meet the food-safety practices Oklahoma requires of a processor (OAC 442:10-5-8; OAC 310:257 and 310:260)
- A documented internal audit program (Section 1.5) and CAPA system (Section 1.6)
- An annual mock recall (Section 1.8) and verified traceability test — supporting the mandatory recall duty Oklahoma enforces (OAC 442:10-8-1) and Metrc tracking
- Cannabinoid and non-cannabinoid waste streams kept completely separated (Section 2A.4 / 2B.4)
- Beverage-grade CO₂ (99.5%) for extraction — medical-grade is not acceptable
- Inhalation-grade ingredients for inhalable products (food-grade/GRAS is not sufficient)
- A market differentiator — accredited GMP that stands out for buyers, lenders, and multi-state partners in a crowded, contracting market
- A HACCP team and certified lead (Level 2 only — Oklahoma encourages HACCP but does not require it)
- What CSQ does not replace: OMMA licensing and inspection, the state food-establishment license, mandatory lab testing, and OMMA's recall authority remain the operator's duty
Quick glossary — the terms that show up in an Oklahoma CSQ audit
State Question 788
The 2018 ballot measure that legalized medical marijuana in Oklahoma. Oklahoma is medical-only — the adult-use measure (SQ 820) failed in 2023.
Oklahoma Medical Marijuana and Patient Protection Act
The Unity Bill (HB 2612 of 2019), 63 O.S. §427.1 et seq. — the statute that built out Oklahoma's medical marijuana licensing framework.
OMMA
The Oklahoma Medical Marijuana Authority — the regulator. It became a standalone state agency in November 2022 (Senate Bill 1543); its rules are at OAC Title 442. Previously it sat within the Oklahoma State Department of Health.
Processor
Oklahoma's commercial license (an OMMA medical marijuana business license) for making edibles, concentrates, and infused products — the license where the food-safety rules apply most directly. (Oklahoma calls the maker a “processor,” not a “manufacturer.”)
OAC 442:10-5-8
OMMA's “Food safety standards for processors” rule. It routes edible processors to Oklahoma's own food code (OAC 310:257 and 310:260) and a state food-establishment license; it applies federal food-labeling rules (21 CFR Part 101) and encourages, but does not require, HACCP (21 CFR Part 120).
Oklahoma THC Universal Symbol
Oklahoma's required warning mark (OAC 442:10-7-1(e)): a red rounded-rectangle badge with an exclamation mark and a cannabis leaf and the text “CONTAINS THC / NOT SAFE FOR KIDS OR PETS.” It goes on the package. It is not Colorado's red diamond and not a triangle.
ISO/IEC 17025
The competence standard for testing laboratories. Oklahoma requires its OMMA-licensed testing laboratories to hold ISO/IEC 17025 accreditation (OAC 442:10-8). CSQ requires the labs it relies on to hold the same — it is not the same as ISO/IEC 17065.
ISO/IEC 17065
The accreditation standard for bodies that certify products and processes. CSQ is delivered by ASI Food Safety as an ISO/IEC 17065-accredited certification body — the basis for an independent, accredited GMP certificate.
THE AUDIT
What a CSQ Audit Actually Looks Like
An Oklahoma CSQ audit is an onsite review of your quality management system against the standard that fits each activity you perform. Here is how scoring, findings, and timing work — followed by the technical mapping table for the people who want it.
Scoring (100-point scale)
How CSQ scores you and what it means for your certificate
| Score | Outcome | Surveillance Cycle |
|---|---|---|
| 80–100 | Certificate issued | Annual surveillance audit |
| 70–79 | Certificate issued | 6-month surveillance audit |
| Below 70 | No certificate | 6-month wait before re-audit |
Findings categories
CRITICAL · –100 POINTS
Auto-fail finding
Regulatory non-compliance, product safety risk, or foundational QMS breakdown. A single Critical finding fails the audit regardless of other scores.
MAJOR · –10 POINTS
Significant gap
Systemic failures or significant deviations from CSQ requirements — not an immediate safety risk but requires corrective action.
MINOR · –1 POINT
Isolated finding
Documentation gap, single-occurrence lapse, or correctable deviation that is not systemic.
Audit timing & certificate validity
What to expect onsite and on the calendar
| Item | Detail |
|---|---|
| Level 1 audit | 1 day onsite + 0.5 day report time |
| Level 2 audit | 1.5 days onsite + 1 day report time |
| Level 3 audit | 2 days onsite + 1 day report time (unannounced window) |
| Initial audit add-on | +1 day for offsite documentation evaluation (all levels) |
| Corrective action window | 30 days to close nonconformities |
| Certificate validity | 1 year + 45 days from audit date |
| Provisional certificate | Available for new operations (valid 6 months) |
| Dietary Supplement Addendum | 4-hour minimum · Pass/Fail · separate report within 72 hours |
For consultants, internal compliance leads, and operators who want the section-by-section map between Oklahoma's regulations and CSQ 2.0:
Oklahoma medical marijuana rules and corresponding CSQ 2.0 sections
| Requirement | Citation | CSQ Coverage |
|---|---|---|
| OMMA licensing (grower, processor, dispensary, lab) | SQ 788 (2018); 63 O.S. §427.1 et seq.; OAC Title 442 | Module 1 (CSQMS) + Section 1.3 (Regulatory Compliance) |
| Oklahoma food code + state food-establishment license | OAC 442:10-5-8 (+ OAC 310:257, 310:260) | Module 2A (cGMP) + Section 3C (formulated / ingestible product controls) |
| Food labeling (21 CFR 101); HACCP (21 CFR 120) encouraged | OAC 442:10-5-8(d), (e) | Module 2A (cGMP) + Section 2A.3 (Cleaning and Sanitation) + Section 2A.13 (Personnel Requirements) |
| Edible THC caps; child-appeal shape/packaging ban | HB 4454 (eff. Nov 1, 2026); OAC 442:10-7-1 | Section 3C (formulated / ingestible product controls) |
| Oklahoma THC Universal Symbol; labeling | OAC 442:10-7-1(e) | Section 2A.12.8 / 2B.11.6 (Product Labeling and Packaging) |
| Batch testing by an ISO/IEC 17025 lab | OAC 442:10-8 | Section 2A.12.9 / 2B.11.7 (Product Sampling and Testing) — CSQ requires ISO/IEC 17025 labs |
| Mandatory recall (OMMA can order / embargo) | OAC 442:10-8-1 | Section 1.8 (Product Recalls and Withdrawals) + Section 1.6 (CAPA) |
| Seed-to-sale tracking (Oklahoma's designated system) | 63 O.S. §427.13 (Metrc) | Section 2A.10.1 / 2B.9.1 (Identification and Traceability) |
How to Prepare | A Realistic Path to CSQ Certification
Because CSQ is voluntary in Oklahoma, step one is deciding whether it earns its place for you. If it does, most operators need 4 to 9 months, depending on license type and scope, to be ready for an initial audit. Here is a sequence that works.
01
Decide whether CSQ is right for you
Oklahoma doesn't require it, so weigh the value: OMMA inspection readiness, buyer and multi-state due diligence, and lender confidence — which matter more, not less, in a crowded market that is contracting under a licensing moratorium and stepped-up enforcement. Because Oklahoma requires a state food-establishment footing rather than a manufacturing GMP program, CSQ closes a real gap and helps you stand out.
02
Confirm your CSQ standard and level
Match your OMMA license — grower, processor, or dispensary — to its CSQ standard, and decide whether Level 1 is enough or you want Level 2/3. Write the answer down; it drives every other step.
03
Run a gap analysis
Compare your current state to the CSQ standard, mapped against Oklahoma's rules (the food-safety standards for processors of OAC 442:10-5-8 and the Oklahoma food code, OAC 310:257 and 310:260). ASI Training and Consulting, LLC can deliver a structured gap analysis as a separate engagement from the certification body.
04
Build the QMS documentation
Extend the controls Oklahoma already requires — food-safety practices, testing, and your recall procedures — into a full CSQ quality management system with SOPs, CAPA, internal audit, document control, and recall/traceability (supporting the mandatory recall duty OMMA enforces under OAC 442:10-8-1 and Metrc tracking).
05
Address the cannabis-specific Critical items
The findings most likely to fail a first audit: CO₂ purity, ethanol grade, inhalation-grade ingredients, waste-stream separation, and route-of-administration risk assessments — plus, for edibles, the incoming 10 mg-per-serving cap and the Oklahoma THC Universal Symbol on packaging. Confirm your extraction and formulation controls are documented before the auditor arrives.
06
Train your team and run internal audits
Deliver competency-based, role-specific training on GMP, hygiene, PPE, allergen handling, and traceability. Then conduct a documented internal audit and an annual mock recall, and close nonconformities through CAPA.
07
Schedule your CSQ audit with Kiwa ASI
Schedule through Kiwa ASI in the CSQ Database. Allow time for the offsite documentation evaluation (1 day) plus the onsite audit (1–2 days depending on level). Request a quote to start.
Why Oklahoma Operators Choose Kiwa ASI
Kiwa ASI brings nearly a century of food safety expertise and the global Kiwa network's footprint in 30+ countries to Oklahoma — one of the largest U.S. medical-marijuana markets by license count, now consolidating, where accredited GMP is a growing point of difference.
Accredited
ISO/IEC 17065 + CSQ-Licensed
Audits and certificates are issued by ASI Food Safety, LLC — an ISO/IEC 17065-accredited certification body licensed by CSQ.
Expertise
Food-grade rigor for cannabis
Our auditors are credentialed food safety, GMP, and HACCP professionals with cannabis-specific qualifications. Cannabis is being regulated like food. We've been doing food for decades.
Efficiency
Direct scheduling, no surprises
Pre-audit scoping clarifies level, scope, and Module 3 requirements before you're onsite. Audit reports are turned around inside the standard CSQ timeline.
Comprehensive
Training and consulting available
Pre-assessments and gap analyses are delivered by ASI Training and Consulting, LLC, a separate legal entity, kept structurally separate from the certification body to safeguard impartiality under ISO/IEC 17065.
Continuity
Surveillance, recertification, transfer
If you're already CSQ-certified through another body and the relationship isn't working, we accept transfer audits. Continuity matters as much as the initial certificate.
Partnership
Global Kiwa network
Operations in 30+ countries. Useful when an Oklahoma operator expands into other state markets or builds an international supply chain.
Frequently Asked Questions About Oklahoma Medical Marijuana GMP & CSQ Certification
No. Oklahoma does not mandate an accredited third-party GMP certificate, and it names no private GMP standard. But food-safety practices are required of a processor: it must meet Oklahoma's own food code (OAC 310:257 and 310:260) and hold a state food-establishment license (OAC 442:10-5-8), have every product lab-tested (OAC 442:10-8), and follow a mandatory recall duty OMMA can enforce (OAC 442:10-8-1). CSQ certification is voluntary: accredited, independent proof of that program.
Medical only. Oklahoma legalized medical marijuana with State Question 788 in 2018; there is no operational adult-use / recreational program. The adult-use ballot measure (State Question 820) failed at a March 2023 special election, and a 2026 follow-on measure did not make the ballot.
The Oklahoma Medical Marijuana Authority (OMMA), under the rules at OAC Title 442. OMMA became a standalone state agency in November 2022 (Senate Bill 1543); before that it sat within the Oklahoma State Department of Health. Its rules should be cited to Title 442, not the retired health-department chapter.
Yes — as practices, not a certificate. A processor of edibles must comply with Oklahoma's own food code (OAC 310:257 and 310:260) and hold a state food-establishment license (OAC 442:10-5-8), and have every product tested. Oklahoma verifies this through OMMA licensing, inspection, and lab testing — and its tie is to Oklahoma's food code, not the federal FSMA manufacturing rules (21 CFR Part 111 or 117). Oklahoma does apply federal food-labeling rules (21 CFR Part 101) and encourages, but does not require, HACCP (21 CFR Part 120).
No. GMP compliance is verified through OMMA licensing, inspection, and mandatory lab testing — not by a required outside auditor. The testing laboratory tests the product; it does not certify the processor's GMP program. A CSQ certificate is voluntary and does not replace OMMA inspection or lab testing.
No. The OMMA rules name no private food-safety or GMP standard for processors — not CSQ, SQF, BRCGS, FSSC, or ISO 22000/22716. The only ISO standard Oklahoma requires (ISO/IEC 17025) applies to testing laboratories. CSQ is a voluntary, accredited option delivered by ASI Food Safety; it is built to meet — not to satisfy or replace — Oklahoma's rules.
Oklahoma requires its THC Universal Symbol (OAC 442:10-7-1(e)) — a red rounded-rectangle badge with an exclamation mark and a cannabis leaf and the text “CONTAINS THC / NOT SAFE FOR KIDS OR PETS.” It is not Colorado's red diamond and not a triangle, and it goes on the package (there is no per-serving stamp requirement). The color, font, and language may not be changed.
Effective November 1, 2026, Oklahoma caps medical-marijuana edibles at 10 mg of THC per serving and 100 mg per package (no more than 10 servings), with beverages up to 20 mg per serving, and adds a ban on child-appealing product shapes and packaging (HB 4454). Before that date, the only numeric control was a label-accuracy tolerance (a label is inaccurate if the THC claim is more than 15% off the lab result), not a potency cap.
A grower uses CSQ Cultivation v2.0.0; a processor (edibles, concentrates, infused products) uses CSQ Extraction or Manufacturing v2.0.0; a dispensary uses CSQ Retail v1.0.0. Testing laboratories follow ISO/IEC 17025 (CSQ does not certify labs but requires ISO/IEC 17025). Kiwa ASI can combine scopes into one coordinated audit.
Because it turns the food-safety practices Oklahoma already requires into accredited, independent proof — and it stands out. Oklahoma requires a state food-establishment footing rather than a manufacturing GMP program, so CSQ closes that gap; and in a market with among the most licensees per capita, now contracting under a licensing moratorium and stepped-up enforcement, accredited GMP is a real differentiator. The highest-value cases: OMMA inspection readiness, buyer and multi-state standardization (including a harder-posture state like New York, which mandates a third-party GMP audit), and lender or investor diligence — plus records that support the mandatory recall duty OMMA enforces.
Yes — but as separate legal entities to safeguard certification-body independence. CSQ certification audits are delivered by ASI Food Safety, LLC (the accredited certification body, ISO/IEC 17065 accredited and CSQ-licensed). Pre-assessments, gap analyses, training, and consulting are delivered by ASI Training and Consulting, LLC. The two operate independently to comply with ISO/IEC 17065 impartiality rules.