Guide

Global Cannabis Quality and Compliance: One Operating Model Across US, Canada and EU

A multi-jurisdiction cannabis operator runs at least four overlapping regulatory frameworks at once: US state-level GMP and seed-to-sale traceability (METRC, BioTrack), USDA Domestic Hemp Production Program (7 CFR Part 990) for hemp, Health Canada's Cannabis Act and Cannabis Regulations for the Canadian market, and EU-GMP (Volume 4 Part I/II, Annex 7) for medicinal cannabis exported into Germany, the UK and other EU-aligned markets. Running these as four separate quality systems produces four times the documentation, four times the audit pain and inconsistent risk control across the same products. This hub walks the unified operating model — a single QMS spine with jurisdiction-specific overlays — that defensible multi-state and multi-national operators actually use.

Start free trial Free trial, no credit card, onboard in days, not months.

The four frameworks and where they overlap

US state cannabis GMP varies by state but converges on a common core (sanitation, batch records, recall, testing, labeling). USDA 7 CFR Part 990 governs hemp THC compliance (0.3% delta-9 limit, DEA-registered labs, sampling). Health Canada Cannabis Regulations impose Good Production Practices (GPP), security clearances and CTLS reporting. EU-GMP applies to medicinal cannabis with QP batch certification. Roughly 70% of the underlying controls — document control, training, deviation/CAPA, environmental monitoring, recall — are common across all four; the remaining 30% is jurisdiction-specific overlay (state CoA action limits, Health Canada CTLS fields, EU QP dossier, USDA sampling windows).

Seed-to-sale traceability as the spine

Every cannabis framework demands traceability — state systems (METRC, BioTrack, Leaf), Health Canada lot/batch records, EU-GMP batch genealogy, USDA hemp lot tracking. The defensible architecture binds the state-issued plant tag to the internal batch record, in-process records, packaging records and finished CoA, with bidirectional queries (tag → customer, customer → tag) returning in seconds. See the [traceability and recall guide](/guides/cannabis-traceability-recall-readiness) for the recall trigger matrix, ASTM D8434 categorisation and mock-recall capability.

Lab testing, labeling and packaging as the three trip-wires

Most cannabis enforcement actions across jurisdictions trace back to three areas: (1) lab testing — out-of-specification potency, pesticide or microbial result that was not actioned; (2) labeling — wrong potency on the panel, missing warning, missing universal symbol; (3) packaging — failed child-resistant closure on a regulated product. See the [laboratory testing and CoA guide](/guides/cannabis-laboratory-testing-coa-readiness) and the [labeling and child-resistant packaging guide](/guides/cannabis-labeling-packaging-child-resistant-readiness) for the operating-level detail.

Jurisdiction-specific overlays

Health Canada operators add GPP-specific controls, security clearances and CTLS monthly reporting — see the [Health Canada cannabis guide](/guides/health-canada-cannabis-regulations-readiness). EU-GMP-certified sites add QP batch certification and Annex 7 herbal medicinal product expectations — see the [EU-GMP medicinal cannabis guide](/guides/eu-gmp-medicinal-cannabis-readiness). Hemp operators add USDA 7 CFR 990 sampling, 0.3% delta-9 testing and disposal/remediation pathways — see the [USDA hemp THC compliance guide](/guides/usda-hemp-thc-compliance-readiness). State GMP operators harmonise across markets — see the [state GMP guide](/guides/cannabis-state-gmp-readiness).

A 90-day path to a unified operating model

Days 1–20: map the existing QMS to the common core; identify the four overlays in use. Days 21–40: consolidate document control, training, deviation, CAPA and environmental monitoring onto the common core; eliminate duplicate procedures. Days 41–60: align labeling, packaging and CoA action limits to the strictest applicable market (typically Health Canada or EU); accept the small loss of market-specific flexibility for the large gain in consistency. Days 61–80: traceability reconciliation across state systems, internal QMS and ERP. Days 81–90: integrated mock audit covering all active overlays in a single exercise.

Standards covered in this guide

Each standard, retailer code or assurance scheme referenced above has its own deep-dive page with scope, audit detail and common pitfalls.

Where this lives in V5 Ultimate

The clauses above aren't theoretical — every one maps to a shipped module and an industry profile. Jump to the parts of the product that turn this guide into evidence on a Monday morning.

Modules that do the work

Multi-jurisdiction cannabis QMS

One spine, four overlays.

Seed-to-sale batch record

Tag bound to batch, bidirectional trace.

Cannabis label engine

Per-jurisdiction label content enforcement.

Industries this hits hardest

Cannabis

Frequently asked

Can a single facility serve US state, Canadian and EU markets simultaneously?

Rarely in practice. US state THC cannabis cannot cross federal borders. Health Canada licensed sites can export to EU-GMP-aligned markets only if the site holds the EU-GMP certification. A single facility serving multiple markets is almost always Canada-based and EU-GMP-certified; US operators run separate corporate entities and facilities per market.

Which framework has the strictest testing requirements?

Health Canada and EU-GMP are generally the strictest; California, Colorado and Massachusetts are the strictest US state regimes. An operator aligned to Health Canada's testing panel typically meets or exceeds every US state requirement.

Is ISO 9001 useful in cannabis?

ISO 9001 alignment helps demonstrate QMS maturity but does not substitute for any regulatory framework. EU-GMP and Health Canada GPP are not satisfied by ISO 9001. The framework is most useful as a structural scaffold underneath the regulatory overlays.

How do hemp and cannabis programs interact?

USDA hemp (≤0.3% delta-9 THC) and state cannabis (>0.3% THC) are legally distinct in the US. A single corporate group operating both must keep facilities, traceability systems and supply chains segregated — co-mingling is a recurring enforcement finding.

See it on your shop floor.

Free trial, no credit card, onboard in days, not months.

Start free trial See pricing →Browse all resources →