Hemp & Cannabis Compliance

Hemp and cannabis compliance is not a single standard or one certificate you can point to. It is the whole set of rules, systems, and records that let you operate legally, keep your license, and prove your products are safe. Because this is one of the most heavily regulated industries in the country, compliance means bringing together several things at once: state licensing requirements, mandated product testing, seed-to-sale tracking, labeling rules, and the good-practice systems that customers and regulators increasingly expect.

The legal picture is genuinely split, and it is worth stating plainly. Under the 2018 Farm Bill, hemp was federally legalized and defined as cannabis containing no more than 0.3% delta-9 THC on a dry-weight basis. Cannabis above that threshold, often called marijuana, remains federally controlled even in states that have legalized it for medical or adult use. On top of that federal baseline, every state sets its own rules, and those rules vary significantly by jurisdiction and by product type. What is required of a cultivator in one state can look quite different from what is required of an ingestible manufacturer in another.

Because the rules differ so much from place to place and change often, the practical work of compliance is about building systems that fit your specific state or states, your license type, and the products you make. That is the lens we bring: not legal advice, but the quality systems, documentation, and audit readiness that let you meet the requirements wherever you operate.

Compliance touches every operator across the hemp and cannabis supply chain, though the specific obligations shift depending on where you sit in that chain. The higher the risk to the consumer and the more your product is ingested or applied to the body, the more rigorous the systems regulators and buyers expect.

• Cultivators and growers managing propagation, crop inputs, testing at harvest, and traceability from seed or clone forward
• Extractors and processors turning raw plant material into oils, distillates, and concentrates, where solvent handling and contaminant control matter a great deal
• Manufacturers of ingestibles and consumables, including edibles, tinctures, capsules, and beverages, who are most often expected to work to Good Manufacturing Practices
• Manufacturers of topicals and other applied products, who face their own labeling and safety expectations
• Testing laboratories performing potency and contaminant analysis, who are frequently required or expected to hold accreditation
• Distributors and retailers responsible for chain-of-custody, storage, and accurate labeling at the point of sale

Whether you are a single-state operator or planning to expand across several markets, the first step is the same: understand exactly which rules apply to your license type and products, then build systems that satisfy them. That mapping is different for a grower than for an edibles maker, and getting it right early saves a great deal of rework later.

A compliant operation usually draws on several recognized frameworks rather than one. The exact mix depends on your product type and your state, but the building blocks are consistent across the industry.

• Good Manufacturing Practices (GMP), especially for ingestible and consumable products, covering facility design, sanitation, process controls, and batch records
• ISO 9001 for an overarching quality management system that brings structure and consistency to how you run the operation
• ISO/IEC 17025 for testing laboratories, which is the recognized basis for demonstrating that test results are technically valid and competently produced
• State licensing requirements, which set the baseline conditions for legal operation and vary by jurisdiction
• Seed-to-sale track-and-trace, so every batch can be followed from origin through to the final sale
• Mandated product testing for potency and for contaminants such as pesticides, heavy metals, microbials, and residual solvents
• Labeling requirements covering content claims, warnings, and the information your state requires on the package
• Recall readiness, so you can identify, isolate, and withdraw affected product quickly if something goes wrong

Underneath all of these sits the same foundation that makes any quality system work: clear standard operating procedures and disciplined record-keeping. SOPs describe how the work is actually done, and records prove it was done that way. When an inspector or auditor arrives, this is what they look at first. A system that lives in a binder nobody uses will not survive that scrutiny, which is why we build documentation your team can genuinely follow day to day.

It is worth remembering that these requirements interlock. Your testing program feeds your labeling, your traceability supports your recall plan, and your SOPs tie the whole thing together. Treating them as one connected system, rather than a pile of separate obligations, is what turns compliance from a burden into something manageable.

The most immediate reason is simple: legal operation and keeping your license. In this industry a lapse in compliance is not a paperwork problem, it can mean fines, holds, product destruction, or losing the license your whole business depends on. Regulators inspect, and they expect to see systems that work, not promises.

Consumer safety is the reason those rules exist. Cannabis and hemp products are consumed, applied, and inhaled, and the testing regime for pesticides, heavy metals, microbials, and residual solvents is there to keep unsafe product off the shelf. A strong quality system is how you consistently earn a clean test result rather than hoping for one, and how you catch a problem before it reaches a customer.

Beyond the regulators, your reputation with the people you sell to increasingly rides on this. As the industry matures, retailers, investors, and partners expect GMP and ISO-grade systems as a condition of doing business, not a nice-to-have. If you are planning to expand into new states or supply larger buyers, being able to show a credible, audited quality system is often what separates the operators who scale from the ones who stall. Passing state inspections and third-party audits cleanly, the first time, protects both your license and the relationships that grow your business.

For more than 30 years we have helped organizations build quality systems that pass audits and keep passing them. More than 900 organizations have earned certification with our help, and they have passed the certification audit the first time, giving us a 100% first-time pass rate. We bring that same discipline to hemp and cannabis operators who need systems that hold up to state inspection and third-party scrutiny.

We start by assessing your operation against the rules that actually apply to you, your specific state or states, your license type, and the products you make, alongside the relevant standards such as GMP, ISO 9001, and ISO/IEC 17025. From there our proven 10-Step Approach carries you through gap assessment, planning, documentation, training, implementation, and internal auditing, then supports you through the inspection or audit itself. If you run a testing laboratory, we prepare you specifically for ISO/IEC 17025. If you make ingestibles, we focus on getting your GMP systems inspection-ready.

Two things set the work apart. First, we adapt everything to your jurisdiction and product type rather than handing you a generic template, because a one-size template is exactly what fails in a state-by-state industry. Second, we keep the system lean. Our single-level documentation typically stays under 200 pages, one clear, usable level rather than the towering stack of manuals other consultants leave behind. That is what lets your people actually run the system, and it is a big part of why our clients pass the first time. We work shoulder to shoulder with your team so the system is genuinely yours long after we finish.

• Treating one state's rules as universal. Requirements vary significantly by jurisdiction and by product type. We map the specific rules that apply to your license and markets before you build anything.
• Confusing hemp and cannabis obligations. Hemp under the 0.3% delta-9 THC threshold and federally controlled cannabis sit in different legal positions. We make sure your systems reflect what your product and jurisdiction actually require.
• Weak or missing SOPs. A system that lives only in people's heads collapses under inspection. We document how the work is really done, in language your team will use.
• Testing and labeling that do not line up. When test data and package claims drift apart, you fail inspection. We connect your testing, labeling, and records into one consistent flow.
• No recall readiness. Operators who cannot trace and withdraw a batch quickly face far worse consequences when something goes wrong. We build and test a workable recall plan with you.
• Documentation overload. Bloated multi-tier manuals nobody reads are as risky as having none. We keep it to one lean, usable level under 200 pages.
• Building for today only. Systems that ignore multi-state expansion get rebuilt from scratch later. We design with your growth and additional standards in mind.