Cannabis GMP Compliance: An Operator’s Guide

The Cannabis Operator’s Guide to GMP and Quality Standards

If someone says a cannabis facility is “GMP certified,” the first question should be: certified against what?

In the United States, there is no single cannabis GMP certificate that covers every state, license type, product, and market. New York, Florida, and Ohio, for example, take different approaches to manufacturing requirements and third-party review.

Its standard, scope, auditor, facility address, covered products, and expiration date determine what a certificate actually means.

For operators, cannabis GMP compliance is less about collecting a badge and more about building a production system that can answer basic questions without a scramble: What happened? Who approved it? Which materials went into the batch? Where did the finished lot go? What did the team do when something went wrong?

In this guide:

• What GMP compliance and certification mean

• Food, dietary supplement, and pharmaceutical GMP

• How cannabis quality standards fit together

• Which frameworks fit which product types

• What federal changes could mean for operators

• How state requirements differ

• How to prepare for a GMP audit

• Where ERP supports GMP and where it does not

• Frequently asked questions

What GMP compliance and certification mean

Good Manufacturing Practice is a system of controls intended to ensure consistent production and reduce contamination, mix-ups, errors, and undocumented changes. It covers employee hygiene, facilities, cleaning, equipment, material status, production records, testing, complaints, recalls, and record retention.

Certification is an assessment against a defined standard or program, generally performed by an independent third party. The resulting certificate or audit report identifies the scope assessed.

Certification is not a blanket statement that everything a company makes is compliant everywhere. Before relying on an audit or certificate, an operator should be able to answer six questions:

1. Which regulation, standard, or certification program was used?

2. Which facilities and licensed operations were included?

3. Which product categories and production lines were covered?

4. Who performed the audit?

5. Does the regulator or customer accept that auditor and standard?

6. When is reassessment or renewal required?

The difference between an audit and certification matters too. New York requires applicable adult-use and medical-use cannabis products to be processed according to GMP and generally requires proof of a qualified third-party GMP audit within one year of commencing licensed operations. Its Office of Cannabis Management also publishes guidance and a list of approved auditors. That is a specific regulatory requirement, not a general instruction to purchase any certificate with “GMP” in its name. New York Office of Cannabis Management: Adult-Use GMP

Food, dietary supplement, and pharmaceutical GMP

Cannabis companies often use “GMP” as if it describes one rulebook. It does not.

Food manufacturing: 21 CFR Part 117

21 CFR Part 117 contains current good manufacturing practice requirements for human food, as well as requirements for hazard analysis and risk-based preventive controls. It covers areas such as personnel, facilities, sanitation, equipment, production controls, warehousing, and distribution.

This is a common reference point for ingestible products when a state regulator or auditor adopts it. That does not make marijuana products federally lawful foods; the framework serves as a manufacturing benchmark within the state program.

Under the FDA’s food framework, covered facilities evaluate known or reasonably foreseeable biological, chemical, and physical hazards and establish preventive controls where required. Monitoring, corrective actions, verification, supply-chain controls, and recall planning are also part of the system. FDA: Preventive Controls for Human Food

Dietary supplements: 21 CFR Part 111

21 CFR Part 111 governs manufacturing, packaging, labeling, and holding operations for dietary supplements. It includes written procedures, qualified personnel, sanitation, equipment controls, component specifications, quality-control operations, master manufacturing records, batch production records, and complaint handling.

New York’s cannabis GMP program points processors to Part 111 or Part 117, as applicable. Operators should not choose between them based on which audit appears easier. The applicable framework should be confirmed with the regulator and auditor before the readiness project begins.

Pharmaceutical cGMP: 21 CFR Parts 210 and 211

Pharmaceutical cGMP is a different regulatory framework. 21 CFR Part 210 establishes general drug-manufacturing requirements, while 21 CFR Part 211 covers finished pharmaceuticals. The FDA describes these regulations as minimum requirements for the methods, facilities, and controls used in manufacturing, processing, and packaging drug products. FDA: Drug cGMP Regulations

A state-licensed cannabis processor should not call itself “FDA certified” because it passed a private or state-required food-style GMP audit. FDA approval, FDA inspection, state compliance, and third-party certification are separate things.

How cannabis quality standards fit together

Several standards can sit alongside a state GMP requirement. They do not solve the same problem, and one should not be presented as a substitute for another.

HACCP, SQF, and ISO 22000 are most directly relevant to ingestible manufacturing. ISO 22000:2018 incorporates HACCP principles, while the SQF Food Safety Program uses a HACCP-based approach designed for certification.

ISO 9001 is broader. It addresses responsibilities, documented processes, performance review, and continual improvement. As of this update, ISO 9001:2015 remains current, with a replacement under publication. Certification is optional.

ISO/IEC 17025 applies to laboratories, not cultivators or manufacturers. Operators do not inherit a lab’s accreditation. They should confirm that the lab’s scope covers the relevant methods and that the COA matches the material tested. ISO/IEC 17025 overview

FOCUS published cannabis-specific operational standards, including a cultivation standard covering management, contamination prevention, testing, security, and inventory. The publicly available document linked here is FOCUS Cultivation Standard Version 1.0. Because that document is versioned and older, it should not be described as a current certification requirement unless FOCUS and the relevant regulator or customer confirm the program, version, and acceptance in writing.

ASTM Committee D37 develops cannabis- and hemp-specific standards. Its work spans areas including cultivation, processing, testing, quality management, security, and terminology. An ASTM standard becomes binding only when a regulator, contract, or certification program adopts it.

EU GMP belongs in a separate category. The European Medicines Agency states that manufacturers of medicines intended for the EU market, including those located outside the EU, must comply with EU GMP. Authorities issue GMP certificates following inspection and record them in EudraGMDP. That matters to businesses pursuing authorized European medicinal supply chains. It is not shorthand for “higher quality” in a domestic recreational market. EMA: Good Manufacturing Practice.

Which frameworks fit which product types

Product form changes the risk profile and often changes the appropriate standard.

Edibles and beverages are the clearest fit for food-safety systems. Ingredient controls, allergen management, pathogen risks, water activity, pH, sanitation, shelf stability, and preventive controls may all be relevant. Part 117, HACCP, SQF, and ISO 22000 can provide a useful structure when the governing rule or audit program adopts them.

Topicals need careful classification. Depending on formulation, labeling, claims, and jurisdiction, a topical may be treated as a cosmetic, drug, or state-specific cannabis product. A food-style framework may provide useful controls or be included in a cannabis audit program, but it does not automatically apply. The FDA publishes separate cosmetic GMP guidelines, and therapeutic claims can change a product’s status.

Flowers and inhalable concentrates are not food. Food-safety certification should not be stretched to imply coverage of cultivation, extraction, or inhalation hazards outside its audit scope. These operations still need sanitation, contamination prevention, supplier controls, testing, traceability, and documented production. The governing state rules and any cannabis-specific standards should drive the program.

The practical rule is simple: begin with the product, process, license, and jurisdiction. Then identify the framework that actually governs or has been accepted for that scope.

What federal changes could mean for operators?

Federal scheduling and FDA product approval are related to cannabis policy, but they are not the same process.

As of August 11, 2026, the DEA states that the Justice Department has published a final rule placing two defined categories in Schedule III: FDA-approved medical products containing marijuana and medical marijuana products regulated by a state medical marijuana license. DEA also reports that a broader proposal to transfer marijuana from Schedule I to Schedule III has proceeded through a formal evidentiary process. These actions should not be described as blanket federal legalization or FDA approval of all state-licensed products. DEA: Marijuana Rescheduling Regulatory Actions.

No operator should assume that pharmaceutical cGMP automatically applies to every state-licensed cannabis product because of a scheduling change. FDA says it has not approved a general marketing application for cannabis to treat a disease or condition and distinguishes approved drug products from the wider market of unapproved cannabis and cannabis-derived products. FDA: Cannabis Research and Drug Approval.

If a future federal framework brings more cannabis products under FDA-administered manufacturing requirements, existing food and drug rules suggest the areas regulators would likely examine. This is an inference, not a statement of a finalized cannabis rule. Those areas include:

• Defined product specifications and approved suppliers

• Controlled master records and complete batch histories

• Facility, sanitation, and equipment controls

• Employee qualifications and documented training

• Testing methods, sample identity, and laboratory oversight

• Deviations, investigations, corrective action, and change control

• Complaint handling, distribution records, and recall capability

Operators do not need to predict the final rule to improve these controls. Better records and quality governance help with inspections, customer audits, recalls, and regulatory change.

How state requirements differ

State rules show why cannabis GMP compliance must begin with jurisdiction and license type, not a certification sales page.

Sources: New York OCM; Florida Statutes §381.986; Ohio Administrative Code Chapter 1301:18-4; Arizona Adult-Use Marijuana Rules, effective July 1, 2026; Minnesota general operations rules; and Minnesota inventory rules.

This is a five-state snapshot, not a 50-state legal survey. Regulators amend rules, issue guidance, approve auditors, and interpret the scope of licenses. Before scheduling an audit, get written confirmation of the standard, facility scope, evidence, and deadline that your regulator expects.

How to prepare for a GMP audit

The certificate comes at the end. The work starts earlier.

1. Define the scope

List the facility, licensed activities, products, production lines, storage areas, and outsourced steps. Map the applicable rules to each. A gummy line, an extraction room, a topical line, and a cultivation site do not pose the same hazards.

2. Assign authority

Identify who approves materials, releases batches, investigates deviations, authorizes rework, and initiates a recall. Training records should identify the procedure and version, the date, the trainer, the employees, and any competency checks.

3. Control incoming materials

Cannabis inputs, ingredients, packaging, labels, and processing aids need an identity and status. Connect each material to its supplier, received quantity, lot or batch, receipt date, inspection or test result, storage location, and disposition.

A COA can support supplier approval, but a PDF alone does not prove that the sample matches the received lot or that the test method falls within the laboratory’s accredited scope.

4. Make batch records match production

The batch record should connect approved inputs, quantities, equipment, operators, dates, in-process checks, yields, waste, deviations, testing, packaging, labels, and release status. If employees routinely work around the record because it does not match the floor, fix the process or the document.

5. Control deviations and changes

Define what counts as a deviation, who reviews it, how affected material is placed on hold, how the cause is investigated, and when corrective and preventive action is required. Keep the original record intact. Corrections should preserve who changed what, when, and why.

6. Test traceability with a mock recall

Choose a finished lot and trace it backward to every cannabis and non-cannabis input. Then choose an input lot and trace it forward through intermediate materials, finished goods, inventory locations, transfers, and customers.

Reconcile what was received or produced against what remains, was consumed, shipped, returned, destroyed, sampled, or otherwise documented. Record the time, gaps, and corrective-action owners.

Published operator experience shows why this matters. At Pioneer Plant Tech, state inspectors selected plants during an audit and scanned their QR tags; the corresponding records were available without a manual search. Read the Pioneer Plant Tech case study

High End Processing uses discrete manufacturing runs to retain batch lineage through grinding, extraction, winterization, distillation, and formulation. In its case study, the operator said, “Flourish makes it easy to track every step of production without slowing us down.” Read the High End Processing case study.

Neither example replaces a GMP audit. They show the operational evidence that quality teams and auditors need.

7. Run an internal audit before the external one

Use the same criteria that the external auditor will use. Sample real records, interview employees, inspect material status and storage, and follow at least one batch from receipt through distribution. Close findings with evidence rather than mark them as complete just because a document was created.

Where ERP supports GMP and where it does not

GMP depends on controlled processes and trustworthy records. ERP can support that foundation when it is configured around the operator’s procedures.

Flourish can connect cannabis and non-cannabis lots to manufacturing inputs and outputs, preserve production lineage, maintain inventory and order status, record lab results, and store COA documents. Its recall reporting can trace a lot forward through downstream products and sales or backward to recorded inputs. Flourish Lot Recall and Trace Report.

For incoming materials, Flourish purchase orders connect receipts with vendors, quantities, costs, lot codes, locations, attachments, and a purchase-order audit log. Flourish inbound inventory documentation.

Operators can also record test results against a package or lot and upload the associated COA. Flourish COA documentation.

That does not make Flourish a quality management system, certification body, or substitute for an auditor.

A formal GMP program still needs quality governance: document approval, training control, deviation and CAPA workflows, change control, internal audits, management review, and any other controls required by the selected standard. Depending on the scope, an operator may need a dedicated QMS, an experienced quality lead, a consultant, and an approved independent auditor in addition to ERP.

The division is straightforward: the quality system defines what must happen and who has authority. The ERP records the material and production activities that help prove what happened.

What to do next

Start with the rule that applies to the license, facility, process, and product, not the certificate someone wants to sell.

1. Confirm the governing regulation and accepted audit standard with the regulator.

2. Define the facility, processes, and products included in scope.

3. Run a gap assessment against the exact audit criteria.

4. Assign owners and align procedures with actual production work.

5. Clean up master data, lot controls, batch records, COAs, and supplier records.

6. Complete a timed mock recall and reconcile quantities.

7. Close findings before scheduling the regulatory or certification audit.

If your team needs connected records for batch, inventory, testing, and recall to support its compliance work, Book a Flourish demo.

Frequently asked questions

Is there one official cannabis GMP certification in the United States?

No. A single cannabis GMP credential does not apply universally across U.S. states, license types, facilities, and product categories. The accepted standard and evidence depend on the regulator, market, product, and audit scope.

Is a GMP audit the same as GMP certification?

Not always. An audit is an assessment activity. Certification is a formal statement issued under a defined certification program after conformity has been evaluated. A regulator may require an audit report, a certificate, or another form of evidence. Follow the wording in the current rule and guidance.

Does GMP certification make a cannabis product FDA-approved?

No. A private or state-required GMP audit does not grant FDA approval. FDA drug approval and compliance with federal drug cGMP are separate regulatory matters.

Which GMP standard applies to cannabis edibles?

It depends on the jurisdiction. Food cGMP and food-safety frameworks are common reference points. New York directs applicable processors to 21 CFR Parts 111 or 117, while Florida requires edible producers to hold a food-establishment permit in addition to its processing-facility inspection requirement. Confirm the framework with the regulator and auditor before preparing.

Do food-safety standards apply to cannabis topicals?

Not automatically. A topical’s appropriate framework depends on its formulation, claims, jurisdiction, and audit scope. Food-style systems may provide useful controls or be adopted by a cannabis audit program, but a topical may instead fall within cosmetic, drug, or state-specific requirements.

Do flower and concentrate operators need HACCP?

HACCP is most directly associated with food production. Its hazard-analysis method may be adapted to other processes, but an operator should not assume a food HACCP certificate covers cultivation, flower, extraction, or inhalable products. Use the framework required for the actual product and process.

Can ERP software make a facility GMP-compliant?

No. ERP can support traceability, batch and lot records, COA management, inventory status, audit trails, and recall execution. Compliance also depends on facility conditions, trained personnel, following procedures, quality oversight, and an acceptable audit or inspection.

Take the scramble out of cannabis compliance.

Speak with a Flourish Specialist to see our compliance and batch-tracking software in action.

Editorial note: This article provides general operational information, not legal or certification advice. Requirements can change and may differ by product, license type, facility, and jurisdiction. Confirm current obligations with your regulator and qualified quality or legal counsel.