If FDA Takes Control, Will Cannabis Processors Need GMP Certification?

Introduction: Is GMP Compliance the Next Major Challenge for Cannabis Processing?

As the cannabis industry matures, manufacturers face growing pressure to demonstrate that their products are consistent, accurately labeled, properly tested, and produced under controlled conditions. For extraction companies and processors developing consumer products, these expectations extend beyond cannabinoid potency to include contamination prevention, ingredient traceability, sanitation, manufacturing records, packaging integrity, and quality assurance.

This raises an important question: If the U.S. Food and Drug Administration (FDA) assumes a more direct regulatory role over cannabis products, will processors need Good Manufacturing Practice (GMP) certification?

The answer depends on the product being manufactured, its intended use, and the regulatory framework that applies. FDA already has authority over certain cannabis-derived products under existing federal law. Food manufacturers and dietary supplement manufacturers are subject to different GMP requirements, while manufacturers of FDA-regulated drugs must follow pharmaceutical GMP regulations.

However, an important distinction often gets lost in discussions about federal oversight: GMP compliance and GMP certification are not the same thing. Federal regulations can require manufacturers to follow applicable GMP requirements without requiring them to obtain a certificate from a private certification organization.

For cannabis processors, the practical takeaway is clear. Rather than waiting for a new federal framework, manufacturers should begin strengthening their quality systems, facility controls, sanitation programs, documentation, and process validation practices now. These investments can improve product consistency and help facilities prepare for changing regulatory expectations, regardless of how cannabis policy evolves.

What Are Current Good Manufacturing Practices?

Current Good Manufacturing Practices, commonly called cGMPs or GMPs, are requirements and systems designed to help ensure that products are consistently manufactured and controlled according to applicable quality and safety standards.

The word current matters. Manufacturing practices, equipment, analytical methods, scientific knowledge, and recognized controls evolve over time. A procedure that was considered adequate years ago may no longer provide sufficient control of a particular risk.

GMP is not simply a cleanliness standard. It is a comprehensive approach to managing manufacturing operations, from receiving raw materials to releasing finished products.

Depending on the applicable regulatory framework, GMP-related requirements may cover:

• Facility design and maintenance: Appropriate construction, cleanable surfaces, suitable utilities, adequate space, and controls that prevent contamination or product mix-ups.
• Personnel and training: Defined responsibilities, hygiene practices, competency requirements, and documented training.
• Equipment and process controls: Suitable equipment, calibration, maintenance, operating procedures, and controlled manufacturing conditions.
• Materials management: Supplier qualification, incoming material inspection, identity verification, specifications, and traceability.
• Sanitation and contamination prevention: Cleaning procedures, sanitation records, pest control, and measures to prevent cross-contamination.
• Quality control: Defined specifications, sampling plans, laboratory testing, investigation of deviations, and documented product-release decisions.
• Documentation and records: Approved procedures, batch records, equipment logs, laboratory results, and records demonstrating that established procedures were followed.
• Complaints and corrective actions: Systems for investigating product-quality problems, implementing corrective and preventive actions, and managing recalls when necessary.

The exact requirements depend on the type of product and manufacturing activity. A facility producing a topical drug, for example, may face different requirements from one manufacturing a conventional food or a cannabis extract sold as an ingredient.

FDA’s existing regulations provide several distinct frameworks, including 21 CFR Part 117 for human food, Part 111 for dietary supplements, and Parts 210 and 211 for pharmaceutical manufacturing. Manufacturers should not assume that compliance with one framework automatically satisfies another.

Does FDA Already Regulate Cannabis Manufacturing?

Yes. FDA authority over cannabis-derived products is not merely a future possibility. The agency already regulates products within its jurisdiction under the Federal Food, Drug, and Cosmetic Act and other applicable laws.

The 2018 Farm Bill removed qualifying hemp from the federal Controlled Substances Act definition of marijuana, but it did not remove FDA’s authority over hemp-derived ingredients and products. FDA evaluates these products according to the applicable federal requirements for their intended use and product category.

FDA has approved one cannabis-derived prescription drug, Epidiolex, and three synthetic cannabis-related prescription drugs: Marinol, Syndros, and Cesamet. These approvals do not amount to general approval of cannabis products sold in state-licensed markets. FDA has stated that it has not approved other cannabis, cannabis-derived, or cannabidiol products currently available on the market.

The agency has also maintained that CBD and THC are excluded from the federal dietary supplement definition under the statutory provisions it identifies, subject to the law’s applicable exceptions. It has separately addressed restrictions on adding CBD or THC to conventional foods in interstate commerce.

These distinctions matter because federal oversight does not automatically make every cannabis product a pharmaceutical, nor does a state license establish compliance with every applicable FDA requirement.

For processors, the relevant questions are:

1. What is the product’s intended use?
2. Is it marketed as a food, dietary supplement, cosmetic, drug, or another product category?
3. Which federal, state, and local requirements apply to its ingredients, manufacturing process, labeling, and distribution?
4. Does the facility manufacture multiple product types that may trigger different requirements?

Answering these questions should come before selecting a certification program or redesigning a facility.

Will Cannabis Processors Be Required to Obtain GMP Certification?

There is no single, universal FDA GMP certification requirement that applies to every cannabis processor simply because it handles cannabis.

Instead, manufacturers must identify and comply with the requirements applicable to their specific products and activities. Some businesses may also pursue third-party certification to demonstrate conformity with a recognized standard or satisfy customer and supply-chain expectations.

Three concepts should be distinguished.

1. Regulatory GMP compliance

This means following the legally applicable manufacturing requirements. Depending on the product category, these requirements may address sanitation, process controls, written procedures, personnel qualifications, laboratory controls, recordkeeping, and quality management.

2. Third-party GMP certification

An independent certification organization evaluates a facility or quality system against a defined standard or certification program. The value of the certification depends on the standard’s scope, the certifier’s competence, and what the audit actually covers.

3. Customer or market qualification

A retailer, brand owner, contract manufacturer, distributor, or institutional buyer may require suppliers to demonstrate GMP compliance or maintain a particular certification. Such requirements can be commercially important even when the certification is not independently mandated by FDA regulations.

A facility can therefore face a legal obligation to comply with applicable GMP requirements without being legally required to purchase a particular private certification. Conversely, holding a certificate does not establish that every product, process, or regulatory obligation is compliant.

If federal cannabis legislation or new FDA rules establish additional manufacturing requirements, the details will depend on the final statutory and regulatory language, including the products covered, implementation dates, exemptions, and transition periods.

Processors should avoid assuming that any proposed federal policy automatically establishes a new certification requirement. They should monitor enacted legislation, final rules, official FDA guidance, and applicable state regulations.

Which GMP Framework Could Apply to a Cannabis Processor?

The first step is to classify the product and determine its intended use. The following frameworks illustrate why one-size-fits-all compliance planning can be misleading.

Human food: 21 CFR Part 117

FDA’s current good manufacturing practice requirements for human food are established in 21 CFR Part 117. The regulation also includes hazard analysis and risk-based preventive controls for human food, subject to applicable exemptions and exceptions.

For a facility manufacturing a product that legally qualifies as human food, relevant controls may include sanitation, hygienic practices, equipment suitability, allergen management where applicable, hazard analysis, preventive controls, and food-safety records.

However, compliance with food GMP requirements does not make an otherwise unlawful ingredient or product lawful. Cannabis-derived ingredients must independently meet the applicable requirements for their intended use.

Dietary supplements: 21 CFR Part 111

Part 111 establishes GMP requirements for manufacturing, packaging, labeling, or holding dietary supplements.

These requirements address areas such as specifications, component identity, production controls, quality control, packaging and labeling, product complaints, and recordkeeping.

Cannabis processors considering supplement manufacturing must resolve both questions: whether the ingredient and finished product can lawfully be marketed as a dietary supplement, and which manufacturing requirements apply. CBD and THC products face specific statutory restrictions under FDA’s current interpretation of federal law.

Drugs: 21 CFR Parts 210 and 211

Pharmaceutical manufacturing is governed by drug GMP regulations, including 21 CFR Parts 210 and 211.

These requirements establish controls for drug manufacturing, processing, packaging, and holding, including facility and equipment suitability, component controls, production procedures, laboratory controls, batch records, and quality oversight.

A cannabis-derived drug product cannot be treated as an ordinary consumer product simply because its active ingredient comes from a botanical source. Drug development and marketing must satisfy the applicable statutory approval and manufacturing requirements.

Cosmetics and topical products

Cosmetics are subject to applicable requirements under federal law, including prohibitions against adulterated or misbranded products. Additional requirements under the Modernization of Cosmetics Regulation Act of 2022 (MoCRA) may apply, including facility registration and product listing, subject to statutory exemptions.

A topical cannabis product’s classification depends on its intended use and claims. A product marketed only to moisturize or improve appearance may be treated differently from one intended to diagnose, treat, mitigate, or prevent disease, or to affect the structure or function of the body.

Manufacturers should not assume that calling a product a cosmetic, balm, or wellness product determines its legal classification.

The central lesson is that GMP planning should follow product classification, not the other way around.

What Cannabis Processors Should Do Now

Even without a new, industry-wide FDA certification mandate, processors can take practical steps to improve compliance readiness. The objective is not to implement every possible regulatory control at once. It is to identify the requirements that apply, close the most significant gaps, and build a quality system that can scale as the business grows.

1. Conduct a Regulatory and GMP Gap Assessment

Begin by documenting the facility’s current operations, product categories, markets, and applicable regulatory obligations.

Review existing procedures against the relevant regulations and identify where documented practices are missing, incomplete, or inconsistently followed.

The assessment should cover:

• Product classification and intended-use claims.
• Applicable federal, state, and local requirements.
• Facility registration and licensing obligations, where applicable.
• Sanitation and contamination controls.
• Equipment maintenance and calibration.
• Raw material and supplier qualification.
• Batch production and laboratory records.
• Product specifications, labeling, and release procedures.
• Complaint investigations, recalls, and corrective actions.

Prioritize gaps according to their potential effect on consumer safety, product quality, legal compliance, and business continuity.

A written assessment with assigned responsibilities and completion dates provides management with a practical roadmap. It also establishes a baseline for measuring progress.

2. Build a Documented Quality Management System

A quality management system (QMS) establishes how a facility defines, monitors, and improves the activities that affect product quality.

At a minimum, manufacturers should evaluate the need for controlled standard operating procedures (SOPs), document management, training records, deviation investigations, corrective and preventive actions (CAPA), supplier controls, change management, and product complaint procedures.

The system should identify who is responsible for approving procedures, investigating problems, authorizing changes, and determining whether a batch can be released.

Documentation must reflect actual operations. A procedure that exists on paper but is not followed provides little assurance of control.

Management should also ensure that employees can report deviations without pressure to conceal problems to meet production targets.

3. Improve Facility Design and Environmental Controls

Facility design directly affects the ability to maintain sanitation, prevent contamination, and control manufacturing conditions.

Cannabis extraction and processing facilities may handle concentrated ingredients, volatile solvents, oils, powders, edible products, and finished formulations. Each material can introduce different hazards and handling requirements.

Processors should review whether their facilities provide:

• Appropriate separation of receiving, storage, processing, packaging, and finished-product areas.
• Adequate space for personnel movement, cleaning, maintenance, and material handling.
• Cleanable floors, walls, work surfaces, and equipment.
• Suitable ventilation, temperature, and humidity controls where required by the process.
• Effective pest prevention and waste-management arrangements.
• Secure, clearly identified storage for chemicals, solvents, and controlled materials.
• Appropriate separation or scheduling to prevent cross-contamination between products.

The required controls depend on the operation. A facility producing shelf-stable gummies may have different hygienic zoning and environmental-control needs from a botanical extraction facility or a manufacturer of a water-based topical.

Construction and renovation projects should incorporate applicable safety, building, fire, ventilation, and process requirements at the design stage. Retrofitting a facility after production begins can be more disruptive and expensive than planning for compliance before construction.

4. Establish Strong Raw Material and Supplier Controls

Finished-product quality begins with incoming materials.

Cannabis biomass, extracted ingredients, carriers, flavorings, excipients, packaging components, and other inputs can introduce variability or contamination. Supplier documentation alone may not be sufficient to establish that a material meets every specification.

A risk-based supplier program should define approval criteria, material specifications, required documentation, incoming inspections, and verification testing where appropriate.

Depending on the material and intended use, testing may address cannabinoid identity and potency, microbial contamination, pesticides, heavy metals, residual solvents, or other relevant contaminants.

Manufacturers should also establish procedures for rejecting, quarantining, investigating, and disposing of materials that fail acceptance criteria.

Supplier changes should trigger a documented assessment of potential effects on product quality, processing performance, and regulatory compliance.

5. Validate Critical Manufacturing Processes

Process validation provides evidence that a manufacturing process can consistently produce results meeting established requirements.

For cannabis processors, relevant activities may include extraction, solvent removal, filtration, decarboxylation, blending, emulsification, homogenization, filling, and packaging.

The precise validation requirements depend on the applicable regulations and process risks. Nevertheless, manufacturers should understand which process variables can affect the finished product and establish appropriate controls.

For example, a manufacturer developing a cannabinoid-infused beverage may need to evaluate ingredient dispersion, dose uniformity, stability, microbial risks, and packaging compatibility. A gummy manufacturer may need to assess mixing uniformity, filling accuracy, moisture control, and the consistency of cannabinoid distribution.

Process changes should be evaluated before implementation, with supporting records demonstrating that the revised operation continues to meet its specifications.

6. Strengthen Laboratory Testing and Batch Release

A certificate of analysis (COA) is useful, but it should not be treated as a complete quality system.

Processors need documented specifications, appropriate sampling procedures, reliable laboratory methods, and a defined process for evaluating results.

Testing programs should reflect product type, process hazards, intended use, and applicable legal requirements. Depending on the product, they may include potency, identity, microbial limits, contaminants, residual solvents, stability, or other characteristics.

Manufacturers should investigate out-of-specification results rather than simply repeating tests until a passing result appears. Investigations should evaluate sampling issues, analytical variability, manufacturing deviations, equipment performance, and potential effects on other batches.

Batch-release decisions should be documented and made by appropriately authorized personnel using defined acceptance criteria.

7. Make Traceability and Recall Readiness a Priority

Traceability allows manufacturers to connect incoming ingredients with production batches, laboratory results, packaging records, and distribution information.

A robust system should make it possible to determine which materials went into a particular batch and which customers or distribution channels received the resulting products.

Processors should test their traceability systems through periodic mock recalls. These exercises can reveal missing supplier records, incomplete batch documentation, inventory discrepancies, and delays in identifying affected products.

A written recall procedure should define decision-making authority, communication responsibilities, product identification, inventory reconciliation, and documentation of the response.

For manufacturers supplying multiple brands or operating as contract processors, clear agreements are particularly important. Responsibilities for investigations, regulatory notifications, customer communication, and product retrieval should be established before a problem occurs.

A Practical GMP Readiness Roadmap

Processors do not need to transform their entire operation overnight. A phased approach can help management allocate resources according to risk.

Phase 1: Assess and prioritize

First 30 days

Identify product classifications, applicable requirements, existing controls, major compliance gaps, and immediate safety concerns. Assign accountable owners and document priorities.

Phase 2: Standardize procedures

Days 30–60

Develop or update SOPs, training records, supplier controls, sanitation schedules, batch documentation, deviation handling, and quality responsibilities.

Phase 3: Verify operational controls

Days 60–90

Review equipment and facility controls, evaluate critical processes, strengthen testing and release procedures, and conduct traceability or mock-recall exercises.

Phase 4: Audit and improve continuously

Ongoing

Conduct internal audits, close corrective actions, retrain personnel when needed, monitor regulatory developments, and reassess the system after significant process or product changes.

This timeline is an illustrative planning framework, not an FDA-mandated deadline or a guarantee of compliance. Facilities with significant deficiencies, complex manufacturing operations, or drug-related obligations may require a different schedule.

What Could Change Under Expanded Federal Oversight?

A more comprehensive federal framework could affect cannabis processors in several ways, although the precise requirements would depend on future legislation and rulemaking.

More formalized quality systems

Manufacturers could face more detailed expectations for written procedures, quality oversight, batch documentation, deviation investigations, and product-release decisions. Facilities that currently rely on informal practices may need to formalize their operations.

Greater scrutiny of facility conditions

Facility construction, equipment suitability, sanitation, contamination prevention, and environmental controls could receive greater attention where relevant to product safety and the applicable regulatory framework.

More demanding testing and traceability

Manufacturers may need to demonstrate that testing programs are scientifically appropriate, that results are reviewed before release, and that products can be traced through the supply chain. Testing alone would not replace the need for controlled manufacturing processes.

Higher costs and potential market differentiation

Implementing quality systems can require investment in personnel, equipment, laboratory services, facility improvements, training, and documentation. Smaller processors may find these costs particularly challenging.

However, stronger manufacturing controls can also reduce waste, prevent batch failures, improve consistency, and make it easier to qualify for contracts with established consumer packaged goods companies.

These are potential operational implications, not a prediction that FDA will impose identical requirements across the cannabis industry. Businesses should base capital spending on current obligations and documented risks while preparing for plausible regulatory changes.

Common GMP Mistakes to Avoid

Processors preparing for more rigorous oversight should pay particular attention to several recurring weaknesses.

Treating certification as a substitute for compliance. A certificate does not automatically demonstrate compliance with every applicable law or product-specific requirement.

Purchasing testing without establishing process controls. Finished-product testing cannot reliably compensate for poorly controlled manufacturing, inadequate sanitation, or inconsistent raw materials.

Using procedures that do not reflect actual operations. Documentation must match how employees perform their work, and records must accurately reflect what happened.

Ignoring facility limitations. If a room layout, ventilation system, equipment configuration, or material flow creates an avoidable contamination risk, additional paperwork will not resolve the underlying problem.

Failing to investigate deviations. Repeated process failures should trigger documented investigations and effective corrective actions rather than routine acceptance of recurring problems.

Assuming state licensing settles federal questions. State cannabis authorization and compliance with federal product requirements are separate matters. Manufacturers should evaluate both where applicable.

How Facility Planning Supports GMP Readiness

GMP preparation is not solely a quality department responsibility. It requires coordination among facility designers, process engineers, production teams, quality personnel, and company leadership.

Before building a new facility or expanding an existing one, operators should translate product requirements and process risks into clear design criteria. These may include equipment footprints, personnel and material flows, cleaning access, utility capacity, ventilation, storage requirements, and separation between incompatible operations.

For existing facilities, a technical assessment can identify which deficiencies require physical modifications and which can be addressed through improved procedures, maintenance, training, or scheduling.

The most effective approach combines facility design with process engineering and quality management. This helps prevent businesses from investing in infrastructure that is expensive to modify later or unsuitable for their intended products.

For growing processors, a well-planned facility can also provide room for additional production capacity, new formulations, improved testing capabilities, and more structured quality oversight.

Conclusion: Prepare for Compliance, Not Just Certification

Will cannabis processors need GMP certification if FDA takes a more direct role in regulating cannabis? There is no universal answer that applies to every facility, and federal oversight does not automatically create a single certification requirement for the entire industry.

What is already clear is that FDA regulates products within its jurisdiction and that applicable food, dietary supplement, cosmetic, and pharmaceutical frameworks impose different obligations. Product classification, intended use, and the specific activities performed at a facility determine which requirements apply.

Cannabis processors should therefore focus on building the capabilities that support sustained compliance: appropriate facility design, qualified suppliers, documented procedures, reliable testing, controlled manufacturing processes, traceability, and an effective quality management system.

The immediate priority is to identify current legal obligations and close existing operational gaps. Third-party certification may be useful where a particular standard, customer, or market requires it, but it should follow a clear understanding of the applicable requirements rather than replace it.

For manufacturers planning long-term growth, GMP readiness is best treated as an ongoing operational discipline. Facilities that establish sound controls early will be better positioned to respond to regulatory developments, demonstrate product quality, and meet the expectations of increasingly demanding business partners.