Picture a quality director at an infused-products processor licensed in three states. On a Tuesday morning, a retailer in the second state reports a customer complaint about an infused chocolate. The director pulls the batch record and finds that the process data sits on paper, the inventory movements sit in the state tracking system, and the lab report sits in an email thread.

Then the clocks start. One state expects notice to its regulator within 24 hours of a recall decision. Another wants customers notified inside a defined window. The certificate of analysis on the batch used a test panel that predates a recent revision to the state’s limits. Nobody can say with confidence which state requires what, or whether the lot met the rules in force on its release date.

This scenario is illustrative, but operators in a patchwork market will recognize the shape of it. Cannabis and hemp manufacturers face state-by-state rules, shifting federal law, and customers who increasingly expect pharmaceutical or food-grade discipline. A quality system built to one state’s checklist breaks as soon as the business crosses a border or the rulebook changes.

This article explains how to build a GMP-aligned quality system that holds up across jurisdictions. It covers the regulatory backdrop as of October 2026, what GMP alignment means when no single rulebook exists, and how to control batch documentation, testing, and certificates of analysis. It closes with recall readiness and a plan for tighter oversight. State rules change frequently, so confirm current requirements with counsel and your regulators before acting on any detail here.

The Regulatory Backdrop in October 2026

Federal Law Is Shifting, Not Settled

No federal regulation sets cGMP requirements specifically for state-licensed cannabis. States write the operating rules for licensed businesses, and they differ. Federal change is nonetheless under way on two fronts.

On marijuana, the Department of Justice and DEA issued a final rule in April 2026 that moved two categories from Schedule I to Schedule III: FDA-approved drug products containing marijuana, and marijuana subject to a qualifying state medical marijuana license. Other marijuana remains in Schedule I for now. DEA held an evidentiary hearing on broader rescheduling from June 29 to July 15, 2026, and parties filed final briefs in August. The DEA Administrator makes the final decision, and legal challenges to the April order are pending in the D.C. Circuit.

On hemp, Public Law 119-37, enacted in November 2025, rewrote the federal definition. It measures total THC instead of delta-9 alone, excludes cannabinoids that the plant cannot naturally produce or that are synthesized outside it, and caps finished hemp-derived cannabinoid products at 0.4 milligrams of total THC per container. Reporting indicates the provisions on non-naturally produced cannabinoids take effect November 12, 2026, while Congress pushed the total THC definition and the per-container cap to December 11, 2026. Dates in this area have moved before, so verify the current status.

What This Means for Quality Teams

Neither change writes a GMP rule for cannabis. Both push the industry toward federal expectations, and federal expectations in adjacent sectors are well known. FDA applies 21 CFR Part 117 to food, Part 111 to dietary supplements, and Parts 210 and 211 to drugs. A business that already works to a comparable framework will adapt faster than one that built its system around minimum state compliance.

What GMP Alignment Means Without a Single Rulebook

Choose a Reference Framework

Without a federal cannabis GMP rule, each operation has to select the framework its products resemble. Edibles and beverages point toward 21 CFR Part 117. Products marketed lawfully as dietary supplements point toward Part 111. Pharmaceutical-style products point toward Parts 210 and 211. FDA has long held that CBD cannot lawfully be marketed as a dietary supplement or added to food, so hemp operators should confirm their product pathway before assuming any one framework applies.

Industry standards fill part of the gap. ASTM International’s cannabis committee, D37, has approved a quality management system standard and a companion GMP guidance, ASTM D8557, which addresses edibles, dietary supplements, topicals, and inhaled products. The Association of Food and Drug Officials publishes FOCUS standards, including a cannabis manufacturing standard that calls for testing laboratories certified to ISO/IEC 17025 or equivalent. Some states already reference GMP directly. New York’s Office of Cannabis Management, for example, expects cannabinoid hemp processors to maintain GMP and to hold qualified third-party certification.

Build the Core Elements

Whatever framework you choose, the same core elements recur. Build each one deliberately:

• An independent quality unit. Quality has authority to approve or reject material, batches, and procedures, and it does not report to production.
• Controlled documents. Procedures, specifications, and master batch records have owners, versions, and approval trails.
• Material and supplier controls. Incoming material is identified, tested or verified, and released before use.
• Equipment and sanitation controls. Qualification, calibration, cleaning, and maintenance records show equipment stayed fit for use.
• Deviation, CAPA, and change control. Unplanned events are investigated, and planned changes get assessed before they happen.
• Training and competence. Staff qualify on a task before performing it unsupervised.
• Complaints, recalls, and internal audits. The system detects its own failures and responds to them.

Design to the Strictest, Document the Difference

A multi-state operator cannot maintain a separate quality system for each jurisdiction. Build one baseline system set to the strictest applicable expectations, then keep a requirements matrix that records where each state differs: testing panels, notification clocks, labeling, and record retention. The baseline carries the daily work, and the matrix tells staff when a state-specific step applies.

Batch Documentation That Survives Scrutiny

Many states require a seed-to-sale tracking system, and many use platforms such as METRC or BioTrack. Those systems track inventory, packages, and transfers. They do not record how a batch was made. A quality system needs the second record, and the two must reconcile.

A complete batch record shows the master formula and the executed batch side by side. It captures every input lot, including the tracking identifiers for cannabis and hemp inputs, the equipment used, in-process checks, yields, deviations, sanitation steps, and the signatures of the people who did and reviewed the work. Quality reviews the whole record before release.

Record quality depends on the principles known as ALCOA+. Entries should be attributable, legible, contemporaneous, original, and accurate, and the record should also be complete, consistent, enduring, and available. A batch sheet filled in at the end of the shift fails the test even when every number is right.

Yield reconciliation deserves particular attention. Compare the material that entered a batch with the product, waste, and retained samples that left it, and investigate unexplained variance. Reconciliation in the quality record should also agree with the figures in the state tracking system. A mismatch signals a documentation error, a diversion risk, or an unrecorded loss, and a regulator will treat any of them seriously.

Supplier, Ingredient, and Process Controls

Product quality starts with what enters the building. Cannabis and hemp operations buy flower, biomass, distillate, extraction solvents, excipients, and packaging, and each input carries its own risk. Qualify suppliers before first purchase, record the approval status and scope in an approved supplier list, and verify each incoming lot against a specification. For cannabis inputs, that includes confirming the supplier’s license status and the tracking records that accompany the transfer.

The stakes are concrete. New York’s Office of Cannabis Management expanded a 2025 recall after finding that a licensee had used cannabis from an unlicensed, out-of-state source to produce and sell its products. A supplier check that never examined the source would have caught the problem before the product reached shelves.

Process controls matter as much as input controls. Extraction and infusion steps create hazards that final-product testing detects only after the fact. Residual solvent risk, for example, depends on how well the process removes solvent, so qualify the equipment, validate the cleaning procedure between product runs, calibrate scales and temperature controls, and set in-process checks that catch drift before a lot fails. Changes to solvents, equipment, or formulations should pass through change control, because each one can alter the test panel and the hazard profile.

Testing and COA Control

Expect Variation and Plan for It

States require compliance testing at licensed or accredited laboratories, and their rules diverge. A published comparison of 37 jurisdictions found wide variation in the number of regulated pesticides, inorganics, solvents, microbes, and mycotoxins. Individual states keep revising their rules, and a few examples show the range:

• Oklahoma requires testing for microbials, mycotoxins, residual solvents, pesticides, cannabinoid and terpenoid content, heavy metals, foreign materials, and water activity and moisture, and it requires retesting after a batch is remediated.
• Minnesota’s technical standards call for microbiological, mycotoxin, heavy metals, pesticide, residual solvent, and foreign material testing, with product-specific variations.
• New York revised its testing limits in February 2026, adding a residual solvent limit of 1,000 ppm for HFC-134a.
• Washington allows remediation of failed lots under conditions, including disclosure of the method, while treating heavy metal and pesticide failures as grounds for destruction.

The point is not to memorize these rules. It is to build a process that tracks them.

Treat the COA as Evidence, Not Paperwork

A certificate of analysis supports a release decision only after someone verifies it. Check that the laboratory holds the accreditation your state requires and that its scope covers the methods and analytes reported. Confirm that the limit of quantitation sits below the state action limit, because a method that cannot see the limit cannot prove compliance. Match the sample identifiers, lot numbers, and dates to your batch record, and confirm the sample came from the lot you are releasing through a documented sampling plan.

Regulators and industry observers have raised concerns about laboratory shopping and inflated potency results. Qualify laboratories the way you qualify suppliers. Audit them, review their proficiency testing performance, and compare results through periodic split samples. Keep a current copy of each laboratory’s accreditation and scope in your supplier file.

Handle Failures Without Shortcuts

Write the out-of-specification procedure before the first failure. It should require an investigation, a documented decision on remediation or destruction under the state’s rules, retesting only as the rules allow, and quality approval before any disposition. Retesting until a result passes is not an investigation, and an auditor will read the pattern in your records.

For hemp products, add total THC control. Under the new federal definition, total THC includes THCA, and finished products face a per-container cap. Verify the cannabinoid content of every incoming ingredient, such as distillate, and calculate container totals before release.

Recall Readiness Across Jurisdictions

State recall rules share a structure but differ on details. New York requires licensees to maintain written procedures, notify the Office of Cannabis Management within 24 hours of initiating a recall, hold recalled product in quarantine until the Office authorizes further action, and submit weekly status reports during a recall. New Mexico requires written recall procedures and notice to its division within 24 hours of initiating a recall, and it lets the division order an immediate recall. California requires voluntary recall plans and notice to the Department of Cannabis Control within 24 hours of a licensee-initiated recall. Colorado’s guidance sets a 48-hour window for notifying licensees on the distribution list and calls for recall effectiveness checks, and it recommends testing the plan through random mock recalls.

Other states add their own elements, such as designated recall coordinators and communication plans for patients and caregivers.

A multi-state operator should build one recall procedure keyed to the shortest clock, with a state-by-state appendix that lists each regulator, contact, and form. Connect the procedure to batch genealogy so the team can name every affected lot, customer, and unit quickly. Then test it. A mock recall that starts from a finished lot and ends with a complete list of affected customers and a reconciled quantity shows whether the genealogy works. The same discipline food manufacturers use for recall readiness applies here without modification.

Where Cannabis Quality Systems Break Down

Operations that fail inspections or recalls tend to share these weaknesses:

• Seed-to-sale stands in for a quality system. The tracking platform records movement but not process control, deviations, or release decisions.
• The state requirements matrix goes stale. Teams build it once, and limits, panels, and clocks change without a trigger to update it.
• Batch records get completed after the fact. Operators reconstruct entries from memory, and the record loses its evidential value.
• COAs get filed, not verified. Nobody checks accreditation scope, limits of quantitation, or sample identity.
• Failed tests get a re-sample instead of a root cause. The same contaminant returns, and the pattern appears in the records.
• Changes skip assessment. A new extraction solvent, supplier, or formulation alters the test panel or the hazard profile without a documented review.
• Quality reports to production. Pressure to ship overrides release decisions, and no one can reject a batch without a fight.
• Temporary staff work without qualification. Seasonal and short-term workers perform critical steps before completing training.
• Internal audits never happen. The system has no way to find its own gaps before a regulator does.

Each weakness traces back to a missing control, and each of those controls is a basic GMP expectation in every other regulated sector.

Preparing for Tighter Oversight

Every regulated industry has moved from a patchwork of local expectations toward harmonized ones, and cannabis and hemp are following the same path. Rescheduling, the redefinition of hemp, state testing revisions, and consensus standards from ASTM and AFDO all point in one direction. The operators who build GMP-style systems now will face less rework later.

A practical preparation plan has five parts:

• Map your products to a reference framework. Decide which of Parts 117, 111, or 211, or the ASTM guidance, best fits each product line, and document the reasoning.
• Monitor regulatory change as a process. Assign an owner, subscribe to regulator notices, and review changes on a fixed schedule. Route each change through change control so procedures, panels, and labels update together.
• Run mock inspections. Use an internal or third-party audit to test records, release decisions, and recall readiness against your chosen framework, and treat findings as CAPA.
• Consider third-party certification. Programs aligned to ASTM, ISO, and GMP expectations give customers and regulators independent evidence of system maturity.
• Qualify your electronic systems. Controls for access, audit trails, and signatures matter more as regulators and customers expect pharmaceutical-style records.

Running One Quality System Across Many Jurisdictions

A state tracking system and a quality system do different jobs, and a multi-state operation needs both. The tracking system reports to the regulator. The quality system governs how the work gets done, who approves it, and how the organization learns from failure.

Workflows that pharmaceutical and food manufacturers already use apply directly: document control, deviation and CAPA management, change control, training, audits, and recall traceability. The eLeaP pharmaceutical QMS page describes deviation and CAPA workflows with effectiveness tracking, change control with documented impact assessments, and integrated training completion metrics. For edible and beverage products, the eLeaP food safety QMS shows how specification deviations link to HACCP and CAPA workflows. The eLeaP eQMS guide covers how traceability supports rapid identification of affected products and customers during a recall, and its overview of eQMS software explains how document control and audit management support electronic records.

Software will not tell you which state limit applies or whether a laboratory’s scope is adequate. It can enforce the workflow once the team defines it, keep the record complete, and let the quality unit show an inspector the full chain of evidence in minutes.

Measuring Whether the System Works

Bring a short set of measures to management review:

• Batch record right-first-time rate. What percentage of batch records reach quality review without corrections?
• Release cycle time. How long does a batch wait between production completion and quality release?
• COA verification completion. What share of certificates received a documented accreditation, method, and sample identity check?
• Out-of-specification rate and root cause closure. How many failures closed with a verified root cause and an effective corrective action?
• Requirements matrix currency. When did the team last review each state’s testing, labeling, and recall requirements against the source regulation?
• Mock recall performance. How long does it take to identify every affected lot, customer, and unit, and does the quantity reconcile?
• Training currency. Does every operator performing a critical step hold a current qualification?

The Underlying Test

Every control in this article answers one question: can the operation show, with records, that a product met the rules in force when it shipped? The underlying test is practical. Pick one batch released last quarter in your strictest state. Produce the executed batch record, every input lot, the test results against the limits in force on the release date, the laboratory’s accreditation scope, the quality release signature, and the destination of every unit.

If the team can assemble that evidence quickly and the pieces agree, the system works. If it cannot, the gaps show where the next inspection or recall will start. Build the system so the answer holds in every state you operate in, and tighter oversight becomes a matter of updating the matrix instead of rebuilding the program.