CSQ CERTIFICATION
The CSQ Certification Program and applicable standards were built around ISO/IEC 17067
Utah Code Title 4, Chapter 41a · UDAF R66 rules
Utah GMP for Cannabis
Utah licenses and inspects every cannabis cultivator, processor, and testing lab, and processors that manufacture register with the state's manufactured-food program (R66-2-11). Utah does not require a third-party GMP certificate — but an accredited, cannabis-specific CSQ certification is a voluntary way to prove your GMP program goes beyond the state baseline.
Utah's Cannabis GMP Rules and Why CSQ Certification Is Worth It
Utah regulates medical cannabis production almost like a pharmaceutical: the Department of Agriculture and Food licenses and inspects every cultivator, processor, and testing lab, and processors that manufacture register with the state's manufactured-food program. Utah does not require a third-party GMP certificate but CSQ certification is an independent, accredited way to prove your GMP program. This page explains what Utah actually requires, which CSQ standard fits your license, and where certification with Kiwa ASI adds value.
START HERE
Does Utah Require Cannabis Operators to Be GMP Certified?
No — Utah does not currently mandate third-party GMP certification for cannabis operators. But GMP is not optional: the state licenses and inspects your facility, and processors that manufacture must register with Utah's manufactured-food program. Here is the short version, and why CSQ still matters.
WHO UDAF LICENSES
Cultivation, processing, testing labs
UDAF licenses three production types under Title 4 Ch. 41a: cannabis cultivation, cannabis processing (Tier 1 concentrate/derivative; Tier 2 package-and-label), and independent testing laboratories. The pharmacy and patient side is DHHS — transitioning to UDAF by 2027.
THE REQUIREMENT
State registration + inspection, not a certificate
Processors that manufacture register with UDAF's manufactured-food program (R66-2-11); UDAF inspects the premises before licensure (R66-9) and on an ongoing basis. No accredited third-party GMP certificate is required — GMP is verified by the state.
WHERE CSQ FITS
Voluntary — but a real differentiator
CSQ is an accredited (ISO/IEC 17065) cannabis-specific GMP certification. Utah doesn't require it, but it documents GMP rigor beyond state inspection — valuable for vertical-integration applicants, multi-state operators, and pharmacy/buyer assurance.
What Utah actually requires
Utah's Medical Cannabis Act splits oversight between two agencies. The Department of Agriculture and Food (UDAF) licenses and regulates production — cultivation, processing, and independent testing labs — under Utah Code Title 4, Chapter 41a and the UDAF R66 rules. The patient and pharmacy side sits with the DHHS Center for Medical Cannabis (those duties are scheduled to move to UDAF by 2027). Before UDAF issues a production license it inspects the premises for compliance (R66-9), inspects on an ongoing basis, and can penalize violations (R66-2-18). A processor that manufactures cannabis products must also register with UDAF's Division of Regulatory Services — the state's manufactured-food program (R66-2-11).
What Utah does not do is require an accredited third-party GMP certificate: GMP is verified by the state, not by an outside auditor. (Utah's processing rule historically referenced 21 CFR Part 111 — the cGMP for dietary supplements — but the current R66-2 verifies GMP through registration and inspection and no longer names that standard.) So in Utah, CSQ is voluntary: an accredited, cannabis-specific way to prove your GMP program goes beyond the state baseline.
FIND YOUR PATH
Match Your Utah License to the Right CSQ Standard
CSQ is voluntary in Utah, so this is about which scope fits if you pursue certification. Match your UDAF license to the CSQ standard that fits; operators who hold more than one license (Utah allows limited vertical integration) can combine scopes into one coordinated audit with Kiwa ASI.
Cultivation Facility
4-41a-102(11) · R66-1STANDARD
CSQ Cultivation v2.0.0
MINIMUM LEVEL
Level 1
PREP TIME
6–9 months
AUDIT LENGTH
~1 day onsite + 1 day offsite doc review (initial)
Indoor cultivation — including post-harvest drying, curing, and trimming. Foundation: cGACP (good agricultural and collection practices) plus cGMP. Utah caps cultivation licenses at 5–8 (up to 15 with a market analysis).
Processing — Tier 1 (Concentrate)
4-41a-102(53) · R66-2STANDARD
CSQ Extraction / Manufacturing v2.0.0
MINIMUM LEVEL
Level 1
PREP TIME
6–9 months
AUDIT LENGTH
~1 day onsite + 1 day offsite doc review (initial)
Tier 1 processors create cannabis concentrate and derivative products (extraction, edibles, vapes, topicals) and package/label. This is where GMP rigor matters most. Tier-1 processing licenses are capped at 18. CSQ items to watch: beverage-grade CO₂ (99.5%), food-grade non-denatured ethanol, and residual-solvent controls.
Processing — Tier 2 (Package/Label)
4-41a-102(54) · R66-2STANDARD
CSQ Manufacturing v2.0.0
MINIMUM LEVEL
Level 1
PREP TIME
4–6 months
AUDIT LENGTH
~1 day onsite + 1 day offsite doc review (initial)
Tier 2 processors package and label plant-product cannabis only (no concentrate manufacturing). A lighter GMP scope focused on handling, packaging, and labeling controls. Tier-2 licenses are not numerically capped.
Medical Cannabis Pharmacy
4-41a-1005 / 1006STANDARD
CSQ Retail v1.0.0
MINIMUM LEVEL
Level 1
PREP TIME
4–6 months
AUDIT LENGTH
~1 day onsite + 1 day offsite doc review (initial)
Utah's dispensing outlets (15 base + 2 rural = 17). Built on cGHP (good handling practices) — storage, handling, inventory, and staff training. The pharmacy side is DHHS-regulated today, transitioning to UDAF by 2027.
Independent Testing Laboratory
4-41a-102(29)STANDARD
OECD GLP + ISO/IEC 17025
MINIMUM LEVEL
N/A
PREP TIME
Varies
AUDIT LENGTH
Per accreditation body
Utah requires independent cannabis testing labs to comply with OECD Good Laboratory Practice. CSQ does not certify testing labs; it requires them to be ISO/IEC 17025 accredited.
UTAH REQUIRES VS. CSQ GOES FURTHER
What's a State Rule, and What's a CSQ Best Practice?
Utah's regulations are the legal floor, and they are enforced by state licensing and inspection. CSQ is a voluntary published standard that documents GMP beyond that floor. Knowing which is which keeps you from over-buying or under-preparing.
What Utah requires (the legal floor)
- UDAF licensing for cultivation, processing, and testing labs — Utah Code Title 4, Chapter 41a
- A state pre-license inspection of the premises, plus ongoing inspection and violation penalties — R66-9; R66-2-18
- Processors that manufacture register with UDAF's Division of Regulatory Services (manufactured-food program) — R66-2-11
- Independent laboratory testing; testing labs must follow OECD Good Laboratory Practice and be ISO/IEC 17025 accredited — UDAF cannabis testing-laboratory rule (the license type is defined at 4-41a-102(29))
- Medicinal-dosage-form, packaging, and labeling requirements — R66-2 (labeling), Title 4 Ch. 41a
- No accredited third-party GMP certificate is required
What CSQ adds (voluntary best practice)
- An accredited (ISO/IEC 17065) cannabis GMP certification — independent, documented proof beyond state inspection
- Built to meet the 21 CFR Part 111 dietary-supplement cGMP principles Utah historically referenced
- A documented internal audit program (Module 1.5) and CAPA system (Module 1.6)
- An annual mock recall (Module 1.8) and verified traceability test
- Cannabinoid and non-cannabinoid waste streams kept completely separated (Module 2A.4 / 2B.4)
- Beverage-grade CO₂ (99.5%) for extraction — medical-grade is not acceptable
- Inhalation-grade ingredients for inhalable products (food-grade/GRAS is not sufficient)
- Support for vertical-integration applications (which require additional supporting factors), multi-state standardization, and pharmacy/buyer assurance
- A HACCP team and certified lead (Level 2 only — not a Utah requirement)
Quick glossary — the terms that show up in a Utah CSQ audit
UDAF
The Utah Department of Agriculture and Food — the production-side regulator for cannabis cultivation, processing, and testing labs (the “Department” in Utah Code 4-41a-102(25)).
DHHS Center for Medical Cannabis
The Utah Department of Health and Human Services division that regulates medical cannabis cards, patients, and pharmacies — scheduled to transition to UDAF by 2027.
Title 4 Ch. 41a / R66
Utah's cannabis production statute and UDAF's current rule series (R66-1 cultivation, R66-2 processing, R66-5 pharmacy, R66-9 licensing); the older R68 rules were repealed.
Cannabis production establishment
A cultivation facility, processing facility, or independent testing laboratory (Utah Code 4-41a-102(18)) — the three UDAF-licensed production types.
Tier 1 / Tier 2 processing
Tier 1 creates concentrate/derivative products and packages/labels (capped at 18); Tier 2 packages and labels plant product only (uncapped).
21 CFR Part 111
The federal Current Good Manufacturing Practice for dietary supplements. Utah's processing rule referenced it historically; treat it as an industry benchmark CSQ is built to meet, not a current Utah mandate.
OECD GLP
OECD Good Laboratory Practice — the lab-quality standard Utah requires of independent cannabis testing laboratories (distinct from processor GMP).
cGMP / cGHP / cGDP
Current Good Manufacturing / Handling / Distribution Practices — the CSQ foundations for facilities that make product, dispense, and distribute.
THE AUDIT
What a CSQ Audit Actually Looks Like
A Utah CSQ audit is an onsite review of your quality management system against the standard that fits each activity you perform. Here is how scoring, findings, and timing work — followed by the technical mapping table for the people who want it.
Scoring (100-point scale)
How CSQ scores you and what it means for your certificate
| Score | Outcome | Surveillance Cycle |
|---|---|---|
| 80–100 | Certificate issued | Annual surveillance audit |
| 70–79 | Certificate issued | 6-month surveillance audit |
| Below 70 | No certificate | 6-month wait before re-audit |
Findings categories
CRITICAL · –100 POINTS
Auto-fail finding
Regulatory non-compliance, product safety risk, or foundational QMS breakdown. A single Critical finding fails the audit regardless of other scores.
MAJOR · –10 POINTS
Significant gap
Systemic failures or significant deviations from CSQ requirements — not an immediate safety risk but requires corrective action.
MINOR · –1 POINT
Isolated finding
Documentation gap, single-occurrence lapse, or correctable deviation that is not systemic.
Audit timing & certificate validity
What to expect onsite and on the calendar
| Item | Detail |
|---|---|
| Level 1 audit | 1 day onsite + 0.5 day report time |
| Level 2 audit | 1.5 days onsite + 1 day report time |
| Level 3 audit | 2 days onsite + 1 day report time (unannounced window) |
| Initial audit add-on | +1 day for offsite documentation evaluation (all levels) |
| Corrective action window | 30 days to close nonconformities |
| Certificate validity | 1 year + 45 days from audit date |
| Initial certification blackout | No initial certifications scheduled in November or December |
| Provisional certificate | Available for new operations (valid 6 months) |
| Dietary Supplement Addendum | 4-hour minimum · Pass/Fail · separate report within 72 hours |
For consultants, internal compliance leads, and operators who want the section-by-section map between Utah's regulations and CSQ 2.0:
Utah cannabis rules and corresponding CSQ 2.0 sections
| Missouri Requirement | Citation | CSQ Coverage |
|---|---|---|
| UDAF licensing of production establishments | 4-41a-201 / R66-9 | Module 1 (CSQMS) + Section 1.3 (Regulatory Compliance) |
| State pre-license premises inspection (+ ongoing) | R66-9 | Section 2A.1 (Facility Construction & Design) + Module 1 |
| Processor registration with UDAF food-safety program | R66-2-11 | Module 2A (cGMP) + Section 2A.3 (Cleaning & Sanitation) |
| Dietary-supplement cGMP principles the rule referenced | 21 CFR 111 (historical) | Module 2A (cGMP) + Section 3C (formulated / ingestible product controls) |
| Independent testing lab; OECD Good Laboratory Practice | UDAF testing-lab rule (def. 4-41a-102(29)) | Section 2A.12.9 / 2B.11.7 (Product Sampling and Testing) — CSQ requires ISO/IEC 17025 labs |
| Packaging, labeling, and medicinal-dosage-form rules | R66-2 (labeling) | Section 2A.12.8 / 2B.11.6 (Product Labeling and Packaging) |
| Violation categories and enforcement | R66-2-18 | Section 2A.3 (Cleaning & Sanitation) + Module 2A.4 (Waste) + Section 1.6 (CAPA) |
How to Prepare | A Realistic Path to CSQ Certification
Because CSQ is voluntary in Utah, step one is deciding whether it earns its place for you. If it does, most operators need 6 to 9 months to be ready for an initial audit. Here is a sequence that works.
01
Decide whether CSQ is right for you
Utah doesn't require it, so weigh the value: a vertical-integration application (which needs additional supporting factors), multi-state standardization, pharmacy or buyer assurance, and audit-ready documentation beyond state inspection. If those matter, CSQ is worth pursuing.
02
Confirm your CSQ standard and level
Match your UDAF license — cultivation, Tier 1/Tier 2 processing, pharmacy — to its CSQ standard, and decide whether Level 1 is enough or you want Level 2/3. Write the answer down; it drives every other step.
03
Run a gap analysis
Compare your current state to the CSQ standard (built to meet 21 CFR Part 111 dietary-supplement cGMP principles). ASI Training and Consulting, LLC can deliver a structured gap analysis as a separate engagement from the certification body.
04
Build the QMS documentation
Author or update SOPs for sanitation, process flow, cross-contamination, allergens, environmental monitoring, waste, traceability, and product release. Stand up your CAPA, internal audit, and document-control systems — the same records that make a state inspection go smoothly.
05
Address the cannabis-specific Critical items
The findings most likely to fail a first audit: CO₂ purity, ethanol grade, inhalation-grade ingredients, waste-stream separation, and route-of-administration risk assessments. Verify these before the auditor arrives.
06
Train your team and run internal audits
Deliver competency-based, role-specific training on GMP, hygiene, PPE, allergen handling, and traceability. Then conduct a documented internal audit and an annual mock recall, and close nonconformities through CAPA.
07
Schedule your CSQ audit with Kiwa ASI
Schedule through Kiwa ASI in the CSQ Database. Allow time for the offsite documentation evaluation (1 day) plus the onsite audit (1–2 days depending on level). Request a quote to start.
Why Utah Operators Choose Kiwa ASI
Kiwa ASI brings nearly a century of food safety expertise and the global Kiwa network's footprint in 30+ countries to Utah's medical cannabis market — where production is regulated almost like a pharmaceutical.
Accredited
ISO/IEC 17065 + CSQ-Licensed
Audits and certificates are issued by ASI Food Safety, LLC — an ISO/IEC 17065-accredited certification body licensed by CSQ.
Expertise
Food-grade rigor for cannabis
Our auditors are credentialed food safety, GMP, and HACCP professionals with cannabis-specific qualifications. Cannabis is being regulated like food. We've been doing food for decades.
Efficiency
Direct scheduling, no surprises
Pre-audit scoping clarifies level, scope, and Module 3 requirements before you're onsite. Audit reports are turned around inside the standard CSQ timeline.
Comprehensive
Training and consulting available
Pre-assessments and gap analyses are delivered by ASI Training and Consulting, LLC, a separate legal entity, kept structurally separate from the certification body to safeguard impartiality under ISO/IEC 17065.
Continuity
Surveillance, recertification, transfer
If you're already CSQ-certified through another body and the relationship isn't working, we accept transfer audits. Continuity matters as much as the initial certificate.
Partnership
Global Kiwa network
Operations in 30+ countries. Useful when a Utah operator expands into other state markets or builds an international supply chain.
Frequently Asked Questions About Utah Cannabis GMP & CSQ Certification
No. Utah does not mandate an accredited third-party GMP certificate. GMP is still enforced — UDAF licenses and inspects every cultivator, processor, and testing lab (R66-9), and a processor that manufactures cannabis products must register with UDAF's Division of Regulatory Services, the state's manufactured-food program (R66-2-11). CSQ certification is voluntary: an independent, accredited way to prove your GMP program beyond the state baseline.
Yes. Utah is a medical-only cannabis state — there is no adult-use program. Voters passed Proposition 2 in November 2018, which the Legislature replaced with the Utah Medical Cannabis Act (H.B. 3001, December 2018). Access is limited to registered patients with a qualifying condition and a state medical cannabis card.
Two agencies. The Department of Agriculture and Food (UDAF) regulates production — cultivation, processing, and independent testing labs — under Utah Code Title 4, Chapter 41a and the R66 rules. The DHHS Center for Medical Cannabis regulates cards, patients, and pharmacies under Title 26B; those duties are scheduled to transition to UDAF by 2027.
It's nuanced. Utah's processing rule historically referenced 21 CFR Part 111 — the Current Good Manufacturing Practice for dietary supplements — but the current rule (R66-2) verifies GMP through state registration and inspection rather than naming that standard. Treat 21 CFR Part 111 as an industry benchmark CSQ is built to meet, not a current Utah mandate.
No. GMP compliance is verified by the state — UDAF licensing, a pre-license premises inspection, ongoing inspection, and violation penalties — not by an accredited outside auditor. A CSQ certificate is voluntary and does not replace UDAF licensing or inspection.
No. Utah's statute and rules do not name CSQ or any private certification scheme. CSQ is one accredited, cannabis-specific option, delivered by ASI Food Safety as an ISO/IEC 17065-accredited certification body and built to meet the dietary-supplement cGMP principles Utah historically referenced. It is a voluntary differentiator, not a legal requirement.
Cultivation facilities use CSQ Cultivation v2.0.0; Tier 1 processors (concentrate/derivative) use CSQ Extraction or Manufacturing v2.0.0; Tier 2 processors (package/label) use CSQ Manufacturing; medical cannabis pharmacies use CSQ Retail v1.0.0. Independent testing labs follow OECD Good Laboratory Practice and, for CSQ purposes, ISO/IEC 17025 (CSQ does not certify labs). Kiwa ASI can combine scopes into one coordinated audit.
Because it proves GMP rigor that state inspection alone doesn't document. The highest-value cases: a vertical-integration application (a cultivator seeking a pharmacy license must show additional supporting factors), a multi-state operator standardizing GMP across programs, and pharmacy or buyer assurance — plus audit-ready records that make state inspections and recalls smoother.
There is no single published price: cost depends on which CSQ standards apply, which level you pursue, facility size and complexity, whether it is your initial audit (which adds an offsite documentation day), and whether you combine multiple facility scopes. Most operations need 6 to 9 months to prepare; a Level 1 audit is roughly 1 onsite day plus report time. Request a quote for a Utah-specific scope.
Yes — but as separate legal entities to safeguard certification-body independence. CSQ certification audits are delivered by ASI Food Safety, LLC (the accredited certification body, ISO/IEC 17065 accredited and CSQ-licensed). Pre-assessments, gap analyses, training, and consulting are delivered by ASI Training and Consulting, LLC. The two operate independently to comply with ISO/IEC 17065 impartiality rules.