For cannabis, hemp, botanical extract, nutraceutical, food, and wellness-product manufacturers, regulatory compliance is rarely a matter of following one rulebook.
A company may answer to federal agencies, state regulators, local authorities, and sometimes multiple regulatory programs at the same time. The rules may overlap, operate independently, or appear to point in different directions.
That creates a fundamental question for operators:
When state and federal requirements do not align, which rules actually control the business?
The short answer is: it depends on the activity, the product, the jurisdiction, and the specific law involved.
Federal law establishes requirements that can apply across the country. States can impose additional requirements within their own jurisdictions when federal law allows them to do so. In areas such as cannabis, the result can be particularly complicated because state-legal activity can still conflict with federal law.
For manufacturers, understanding that distinction is more than a legal exercise. It affects facility design, licensing, sourcing, testing, labeling, packaging, transportation, quality systems, inventory management, and ultimately whether a product can legally reach the customer.
Federal and State Regulation Are Not the Same Thing
The first mistake businesses make is treating “legal in my state” and “federally legal” as interchangeable.
They are not.
The federal government establishes laws and regulations that apply nationally. State governments establish their own laws and regulatory programs within their jurisdictions.
In some industries, the two systems work together relatively smoothly.
Hemp production provides a useful example. Under the federal hemp framework established by the 2018 Farm Bill and USDA regulations, states and tribes can establish their own hemp production plans subject to USDA approval. USDA explains that state and tribal hemp plans must meet federal requirements, while states can administer their own programs.
That means a hemp producer may have to comply with:
- Federal requirements
- A state hemp program
- Local agricultural requirements
- Testing requirements
- Licensing requirements
- Transportation requirements
- Product-specific regulations
The regulatory structure does not stop at the federal level.
Who Has Authority Over What?
A practical way to understand the system is to separate the business into activities.
Different agencies can have authority over different parts of the same supply chain.
Cultivation
For hemp production, USDA has federal oversight through the Domestic Hemp Production Program. States and tribes can operate USDA-approved production plans.
Extraction and manufacturing
Once agricultural material enters manufacturing, other regulatory systems can become relevant.
The USDA itself states that its hemp authority is focused on hemp production. Once compliant hemp leaves the farm and enters commerce, FDA and state or local authorities may regulate products manufactured for human or animal consumption.
Food and beverages
FDA can become a central regulator because the Federal Food, Drug, and Cosmetic Act governs food, food ingredients, drugs, and other FDA-regulated products.
FDA specifically states that the 2018 Farm Bill did not remove its authority over products containing cannabis or cannabis-derived compounds. A product qualifying as hemp under federal agricultural law is therefore not automatically approved as a food, dietary supplement, drug, or other FDA-regulated product.
Cannabis
Cannabis creates one of the most significant federal-state conflicts.
Many states have established medical or adult-use cannabis markets, while federal controlled-substance law has historically treated marijuana differently. Congressional Research Service reports have documented this continuing federal-state policy gap.
For an operator, the important lesson is simple:
A state license does not automatically make every activity federally lawful.
The Supremacy Clause Does Not Mean States Cannot Regulate
This is where the issue becomes more nuanced.
The U.S. Constitution establishes federal law as supreme when valid federal law conflicts with state law. The legal doctrine of federal preemption can prevent states from imposing requirements that conflict with federal requirements in certain circumstances.
But that does not mean every state regulation that is stricter than a federal regulation is invalid.
In many industries, federal law establishes a baseline while states regulate additional aspects of the business.
Hemp production demonstrates this structure clearly. USDA requires state and tribal plans to meet federal requirements, but states and tribes administer their own programs and can establish additional requirements within the legal framework.
For manufacturers, the practical rule should therefore be:
Do not ask whether state or federal law “wins” in the abstract. Determine which law applies to the specific activity and whether the requirements can legally operate together.
That distinction can prevent expensive compliance mistakes.
Cannabis Creates the Most Difficult Regulatory Conflict
Cannabis operators face a particularly unusual situation.
A state may establish a licensing system that permits cultivation, processing, manufacturing, distribution, and retail sales.
From the state’s perspective, the business may be fully licensed and operating legally.
Federal law can nevertheless impose separate restrictions.
Congressional Research Service analysis explains that state legalization does not itself eliminate federal Controlled Substances Act restrictions. In other words, state legalization and federal legalization are separate legal questions.
This creates operational consequences.
A cannabis manufacturer cannot evaluate compliance solely by asking:
“Do I have a state license?”
The company must also evaluate:
- Federal controlled-substance requirements
- Banking relationships
- Transportation
- Insurance
- Federal contracts
- Interstate commerce
- Facility access
- Employee requirements
- Product claims
- Advertising
- Financial reporting
- Tax treatment
- Supply-chain relationships
The regulatory risk therefore extends well beyond the production floor.
FDA Rules Can Apply Even When a State Allows the Product
Hemp-derived products provide another important example.
A company may legally cultivate hemp under an approved production program and then manufacture a consumer product containing a hemp-derived ingredient.
That does not automatically make the finished product legal under FDA law.
FDA states that it regulates cannabis and cannabis-derived products under the same statutory framework applicable to other FDA-regulated products.
For food manufacturers, this distinction is especially important.
A product developer may be thinking about:
“Does this ingredient come from legal hemp?”
The regulatory team also needs to ask:
“Is this ingredient lawful for this intended use in this food?”
Those are different questions.
FDA has specifically addressed the regulatory status of CBD and other cannabis-derived compounds in foods and dietary supplements. It has also taken enforcement action involving cannabis-derived products, including delta-8 THC products.
A Product Can Pass One Compliance Test and Fail Another
This is one of the most important concepts for operators.
Consider a hypothetical hemp-derived beverage.
The manufacturer might establish that:
- The hemp was produced under an appropriate hemp program.
- The raw material passed cannabinoid testing.
- The extraction process was documented.
- The finished product meets a state hemp requirement.
- The manufacturing facility is properly licensed.
The company could still face another regulatory question concerning whether the ingredient and intended use comply with federal food law.
That means compliance should be structured as a chain, not a single checkpoint.
Regulatory chain
Raw material → extraction → intermediate → formulation → manufacturing → testing → packaging → labeling → distribution → sale
Every link can introduce a different requirement.
A strong compliance program evaluates the entire chain.
State Requirements Can Also Create Manufacturing Challenges
Even when state requirements are legally permissible, they can create substantial operational differences between markets.
One state might require:
- Specific cannabinoid testing
- A particular laboratory accreditation
- Child-resistant packaging
- Universal symbols
- Batch numbers
- QR-code traceability
- Age verification
- Specific warning statements
- Product registration
Another state may use different requirements.
For a national brand, this creates a manufacturing question:
Do we produce one national SKU or create state-specific SKUs?
The answer affects production planning, packaging inventory, labeling systems and warehouse management.
The Packaging Problem
Packaging is one area where regulatory differences can become expensive very quickly.
Suppose a brand sells a cannabinoid topical in 20 states.
If every state accepts the same package, the manufacturer can operate one packaging specification.
But if several states require different:
- Warning statements
- Symbols
- Net contents declarations
- Cannabinoid disclosures
- Child-resistant features
- Ingredient statements
- Batch information
the company may need multiple packaging configurations.
That introduces additional SKUs and additional opportunities for errors.
A quality system should therefore control packaging artwork with the same discipline applied to a manufacturing formula.
A regulatory change to a label should trigger:
review → approval → version control → obsolete-material control → production release
rather than simply sending a new PDF to the printer.
Testing Is Another Area Where Rules Can Diverge
Testing requirements can also differ between jurisdictions.
One jurisdiction may require a particular cannabinoid panel. Another may require additional contaminants or specific laboratory credentials.
For manufacturers, the challenge is not simply ordering more tests.
The testing program needs to be connected to:
- Raw-material specifications
- Supplier qualification
- Sampling procedures
- Laboratory qualification
- Analytical methods
- Finished-product specifications
- Certificate-of-analysis review
- Batch release
- Deviation management
- Retention samples
A sophisticated testing program should answer one basic question:
Can we demonstrate that every batch meets the requirements of every market in which we intend to sell it?
If the answer is no, the company may have a distribution problem even when its manufacturing process itself is sound.
GMP and HACCP Do Not Replace Regulatory Compliance
Good Manufacturing Practices and HACCP programs are essential tools, but they are not substitutes for legal compliance.
GMP controls help establish consistent manufacturing practices.
HACCP identifies and controls food-safety hazards.
Neither system automatically determines whether a cannabinoid ingredient is legally permitted in a particular product or jurisdiction.
The strongest compliance programs connect these systems.
For example:
Regulatory requirement: A finished product must remain within a specified cannabinoid limit.
Process control: Formulation must use a validated dosing procedure.
Quality control: Each batch receives appropriate analytical testing.
Documentation: Results are reviewed before release.
Corrective action: Out-of-specification results trigger investigation and disposition procedures.
This converts a regulatory requirement into an operational control.
That is where regulatory compliance becomes manufacturing quality.
Facility Design Must Account for the Regulatory Map
Regulatory differences should be considered before facility construction begins.
A facility designed for one regulatory pathway may become difficult to adapt if the company later enters another product category.
Facility planners should consider:
Material segregation
Can hemp biomass, extracts, ingredients and finished products be clearly separated?
Personnel flow
Can employee movement be controlled between manufacturing, storage, laboratory and administrative areas?
Sanitation
Are surfaces, equipment and rooms appropriate for the intended product categories?
Environmental controls
Can temperature, humidity and other environmental conditions be controlled where necessary?
Storage
Can regulated materials, ingredients, finished goods and rejected materials be segregated?
Sampling
Is there an appropriate location for representative sampling without compromising product integrity?
Documentation
Can the facility support traceability from incoming material through finished-product release?
Future flexibility
Can rooms and equipment be adapted if the company adds different products or enters another regulatory market?
These questions become particularly important for companies investing millions of dollars in new manufacturing facilities.
Interstate Commerce Creates Another Layer
A business selling locally and a business distributing nationally can face very different compliance challenges.
A state may authorize a product for sale inside its borders.
That does not necessarily mean the product can simply be shipped nationwide.
For cannabis, the distinction can be especially important because state-legal cannabis systems generally operate within state-specific regulatory frameworks while federal law remains relevant.
For hemp and hemp-derived products, interstate commerce questions can also involve the interaction between federal requirements and state-specific product regulations.
A company should therefore map its physical supply chain, not just its sales territory.
Ask:
- Where is the biomass grown?
- Where is extraction performed?
- Where is formulation performed?
- Where is packaging performed?
- Where is inventory stored?
- Who owns the material at each stage?
- Which states does the product cross?
- Where is the finished product sold?
The regulatory answer can change depending on the movement of the material.
Build a Regulatory Matrix Before Scaling
One of the most useful tools for a multi-state manufacturer is a regulatory matrix.
At minimum, track:
| Compliance Area | Federal | State | Local | Responsible Team |
| Cultivation | ✓ | ✓ | Possible | Agriculture |
| Extraction | Possible | ✓ | Possible | Operations |
| Manufacturing | ✓ | ✓ | ✓ | Operations/QA |
| Testing | ✓ | ✓ | Possible | Quality |
| Packaging | ✓ | ✓ | Possible | Regulatory |
| Labeling | ✓ | ✓ | Possible | Regulatory |
| Advertising | ✓ | ✓ | Possible | Marketing/Legal |
| Distribution | ✓ | ✓ | ✓ | Logistics |
| Facility | ✓ | ✓ | ✓ | Engineering |
| Worker safety | ✓ | ✓ | ✓ | EHS/HR |
The exact requirements will depend on the product and jurisdiction.
The point is not to create a universal checklist.
The point is to identify which authority controls each part of the operation.
What Operators Should Do When Rules Conflict
When a state requirement appears to conflict with a federal requirement, management should resist the temptation to simply follow whichever rule is stricter.
Instead, the company should:
- Identify the exact legal requirement
Do not rely on a social-media post, supplier statement or informal industry interpretation.
- Determine the regulated activity
Is the issue cultivation, extraction, manufacturing, food use, labeling, transportation, possession or sale?
- Identify the responsible agency
USDA, FDA, DEA, state agriculture departments, state cannabis agencies, health departments and local authorities may have different roles.
- Determine whether the federal rule preempts state law
This is a legal question, not an operational assumption.
- Determine whether both requirements can be satisfied
In many cases, the safest operational solution is to comply with both.
- Document the interpretation
A written regulatory determination is far more valuable than an undocumented verbal assumption.
- Translate the requirement into a process control
Update SOPs, specifications, training, testing, labels, equipment settings or release procedures as necessary.
- Monitor for regulatory changes
Regulatory compliance is not a one-time project.
The Real Answer: Nobody Regulates the Entire Business Alone
So, who really controls your business?
Usually, no single regulator does.
USDA may control aspects of hemp production. FDA can regulate food, dietary supplements, drugs and other products within its jurisdiction. State agencies may regulate cultivation, processing, licensing, testing, packaging or retail activities. Local governments may impose zoning, building, fire, wastewater and other requirements.
And federal controlled-substance law can create an additional layer for cannabis businesses.
USDA itself makes the division clear: its hemp authority concerns hemp production, while FDA and state or local governments can regulate hemp-based products after production.
For manufacturers, the most effective approach is therefore not to think in terms of state versus federal.
Think in terms of a regulatory stack.
Federal law establishes the national framework.
State law establishes additional jurisdiction-specific requirements.
Local requirements govern the physical operation.
Product-specific agencies govern particular categories.
Your quality system turns those requirements into daily manufacturing controls.
That is the system an operator actually has to manage.
Building a Compliance Strategy That Can Survive Regulatory Change
The companies best positioned for regulatory change are not necessarily those with the largest compliance departments.
They are the companies that have connected regulatory requirements to their actual operations.
That means knowing:
- What enters the facility
- Where every material comes from
- What happens to it during processing
- What specifications apply
- Which tests are required
- Which markets accept the finished product
- Which labels belong on which SKU
- Which licenses apply to each facility
- Which employees are responsible for each control
- What documentation proves compliance
This approach also makes facility expansion easier.
When regulatory requirements are integrated into process design, quality management and documentation, a company can respond to changes without rebuilding its entire operating model.
For extraction and consumer-product manufacturers, that flexibility is becoming increasingly important.
Key Takeaways for Operators
Federal compliance does not automatically satisfy state requirements.
State authorization does not automatically eliminate federal obligations.
USDA, FDA, state agencies and local authorities can have different roles in the same supply chain.
Hemp production and hemp-derived consumer products can be subject to different regulatory frameworks.
Cannabis remains a particularly complex area because state legalization and federal controlled-substance law can diverge.
GMP and HACCP programs should translate regulatory requirements into documented manufacturing controls.
Testing, labeling, packaging and traceability should be managed at the SKU and market level.
Facility design should account for current requirements and potential regulatory changes.
When laws appear to conflict, businesses should obtain a jurisdiction-specific legal determination rather than relying on assumptions.
The most important question is therefore not simply “Is our business legal?”
A better question is:
“Which rules apply to each activity in our supply chain, who enforces them, and how do we prove that our operation satisfies them?”
For companies operating in cannabis, hemp, extraction, nutraceuticals, functional foods and other regulated consumer-product markets, that question should be answered before a product reaches the production floor—not after a regulator, customer or distributor raises it.
