US Cannabis State GMP: a Baseline for Multi-State Operators
In the absence of federal legalisation, US cannabis manufacturers operate under a patchwork of state rules that converge on a recognisable GMP baseline drawn from FOCUS (Foundation of Cannabis Unified Standards), ASTM Committee D37, AHPA cannabis standards, and increasingly from FDA 21 CFR 111 (dietary supplements) and 21 CFR 117 (food) as states harmonise with federal frameworks they cannot legally invoke directly.
In Short
- State cannabis regulators write rules in the language of pharma GMP (Colorado MED, Oregon OLCC, Massachusetts CCC, New York OCM) or food safety (California DCC), but…
- Almost every regulated US cannabis market uses METRC or a near-equivalent as the state track-and-trace system, identifying every plant, every harvest lot, every…
- State rules require certificate-of-analysis testing for cannabinoid content, pesticides, heavy metals, microbial contaminants, residual solvents, mycotoxins and…
This guide walks the GMP elements every multi-state operator should already meet in 2026, the seed-to-sale traceability backbone, the testing and recall obligations, and a practical path to a programme that survives both routine state inspection and the federal regulator that arrives the day after federal rescheduling.
The state baseline and where FOCUS, ASTM and AHPA fit
State cannabis regulators write rules in the language of pharma GMP (Colorado MED, Oregon OLCC, Massachusetts CCC, New York OCM) or food safety (California DCC), but the underlying requirements converge: written master formulas, batch records, in-process controls, finished-product specifications, release testing, retained samples, deviation handling, complaint and recall procedures, and trained personnel. Industry references such as FOCUS standards, documents from ASTM Committee D37 on Cannabis and AHPA Recommendations for Regulators can help structure a programme, but they do not replace the rules of the state that licenses you; check which documents, if any, your regulator references.
(Correction, 2 Oct 2026: an earlier version cited ASTM D8434 as a cannabis safety standard. ASTM D8434 is a specification for an unleaded aviation gasoline test fuel, withdrawn in 2026, and is unrelated to cannabis — source: store.astm.org/d8434-21.html.)
Seed-to-sale, METRC and the genealogy obligation
Almost every regulated US cannabis market uses METRC or a near-equivalent as the state track-and-trace system, identifying every plant, every harvest lot, every package and every transfer with a state-issued tag. The seed-to-sale obligation goes beyond regulatory reporting — it is the genealogy backbone the operator relies on for recall scope, potency reconciliation, yield variance investigation and label-claim defence.
More on seed-to-sale, METRC and the genealogy obligation
A genealogy that is complete in METRC but partial in the internal QMS leaves the operator unable to answer recall scope questions inside the legal window.
Testing, COA reconciliation and the lab-shopping problem
State rules require certificate-of-analysis testing for cannabinoid content, pesticides, heavy metals, microbial contaminants, residual solvents, mycotoxins and (increasingly) foreign matter and water activity. The 2023–2025 inspection cycle has focused hard on lab-shopping (re-testing at a second lab after a first lab fails the sample) and on potency-COA inflation.
More on testing, COA reconciliation and the lab-shopping problem
A defensible programme runs a single primary lab per market, retains the failed-sample COA in the same file as the passing COA, and documents the investigation and disposition decision rather than walking the sample to a softer lab.
Recall, complaint and adverse-event handling under state rule
State rules typically require notification to the regulator within 24 to 72 hours of a confirmed recall trigger, with a written recall plan rehearsed annually. Complaint handling and adverse-event reporting are increasingly modelled on dietary supplement rules (21 CFR 111 and the SAERA serious adverse event reporting framework) — track every complaint, trend it, escalate any event meeting serious-adverse-event criteria.
More on recall, complaint and adverse-event handling under state rule
A recall executed from the GMP batch record and the seed-to-sale genealogy together completes in hours; a recall executed from spreadsheets and goodwill takes days, and is the modal regulatory escalation in 2025–2026.
A 60-day readiness path and the federal-rescheduling preparation
- Days 1–15
GMP gap assessment against your state rules, using industry references such as FOCUS, ASTM D37 documents or AHPA where helpful across cultivation, manufacturing and packaging; close the obvious gaps.
- Days 16–30
METRC-to-internal-record reconciliation across the last 60 days of production; close genealogy gaps.
- Days 31–45
COA programme review with attention to lab-shopping risk and potency reconciliation; tighten the disposition workflow.
- Days 46–60
recall rehearsal end-to-end, complaint and AE programme refresh, internal audit covering the full GMP/seed-to-sale/testing/recall loop. The same readiness work positions the operator for FDA inspection the day after federal rescheduling — there is no separate pre-FDA readiness programme to run.
Questions
Does FDA already inspect cannabis facilities?
FDA inspects facilities producing FDA-regulated articles containing cannabinoids (hemp-derived ingredients in dietary supplements, food and cosmetics within FDA's legal scope; epidiolex and other approved drug products). State-licensed THC cannabis manufacturers are not currently subject to FDA inspection, but operators in the 2024–2026 multi-state cohort routinely run their programmes against an FDA-inspectable bar to be ready for federal rescheduling.
How do FOCUS, ASTM and AHPA differ?
FOCUS publishes a comprehensive certification standard; ASTM D37 publishes consensus technical standards (cultivation, processing, security, laboratory); AHPA publishes regulator-facing recommendations on cannabis quality and safety. The three overlap heavily and a programme built to one will largely satisfy the others.
Is METRC the only state track-and-trace system?
No — METRC is dominant but not universal. Oregon uses CTS, some states have built bespoke systems, and a few markets are between vendors. The genealogy obligation is the same regardless of the vendor.
What happens to state rules if cannabis is federally rescheduled?
State rules remain in force; federal frameworks (FDA, USDA, FTC, TTB) will reach in where they apply to the article and the use. The state-licensed operator running a GMP programme aligned with FOCUS / ASTM / AHPA is in a far better position to absorb a federal overlay than an operator running to state minimums.
Practical orientation, not legal advice. Rules differ by jurisdiction; your quality and compliance team decides what applies.
The Cannabis and Hemp Guide
Authorised inputs. Tested batches. Packs that meet your market's rules.
- Which rules reach your product
- Supplier to vault
- Extract, formulate, test, approve
- Pack, trace and respond
Plus Evidence map and four worksheets.
Get the cannabis and hemp guideWe ask for your name and email so we can handle this request. The full guide then opens on this site, ready to translate, print or save. Privacy policy. Practical orientation, not legal advice; your quality unit decides which rules apply.
UltimateFree guide
The Cannabis and Hemp Guide
Authorised inputs. Tested batches. Packs that meet your market's rules.
Keep reading
- Global Cannabis Quality & Compliance Readiness Guide
Cannabis Labelling and Child-Resistant Packaging Readiness
Cannabis Laboratory Testing and CoA Readiness Guide
Cannabis Traceability and Recall Readiness: Lots, Labs and State Systems
EU GMP for Medicinal Cannabis: GACP, Annex 7 and Herbal Starting Materials
Canada Cannabis Regulations (SOR/2018-144): GPP, Testing, Recall and Labels