Cannabis QMS: Meeting State and GMP Requirements

The cannabis and CBD industry has a compliance problem that most other industries don't face: you're building your quality system to satisfy two bodies of requirements that were never designed to work together.

State cannabis programs were written by state legislators and regulators — often quickly, often without deep GMP expertise — to address licensing, public safety, and track-and-trace. FDA's good manufacturing practice frameworks were written for drugs, dietary supplements, and cosmetics by people who never imagined they'd apply to cannabis. Hemp-derived CBD occupies a strange middle ground where FDA has enforcement authority but no final rules, leaving manufacturers to guess at what "compliant" actually looks like.

In my view, this ambiguity is where most cannabis and CBD quality programs fall apart. Not because the manufacturers aren't trying, but because they're building compliance programs in response to whatever inspection they're most afraid of rather than toward a coherent quality framework.

A well-designed QMS changes that. It gives you one system that can satisfy state requirements, hold up under FDA scrutiny, and scale as the regulatory landscape continues to evolve.

The Regulatory Landscape Isn't What Most People Think It Is

As of 2024, 38 states and the District of Columbia have medical cannabis programs, and 24 states have legalized adult-use cannabis. Each of those programs has its own facility standards, testing requirements, labeling rules, and — increasingly — GMP expectations.

Here's what often gets missed: those state GMP requirements are not uniform. California's manufacturing standards look different from Colorado's, which look different from Illinois's. A multi-state operator building a single quality system has to satisfy several distinct regulatory frameworks simultaneously. A single-state operator has to satisfy one state program now, but that state's requirements will evolve, and expansion means adapting.

Cannabis and CBD manufacturers now face compliance obligations across an average of 3–5 distinct regulatory frameworks simultaneously, including state licensing requirements, state GMP standards, and FDA category-specific regulations — none of which share a common documentation format. That's not an abstract coordination problem. It's an operational one, and it shows up in inspections.

CBD manufacturers face a related but distinct challenge. The 2018 Farm Bill federalized hemp but handed regulatory authority over hemp-derived ingestibles and supplements to FDA — who hasn't issued the final rules. What FDA has done is issue dozens of warning letters to CBD companies since 2019, and the overwhelming majority of those letters cite GMP violations, mislabeling, and unsubstantiated health claims.

The practical implication: FDA is enforcing GMP expectations against CBD companies even without a final rule. The relevant framework they're pointing to is 21 CFR Part 111 (dietary supplement GMPs) for ingestibles, and the Modernization of Cosmetics Regulation Act (MoCRA, effective 2022–2024 phased) for topicals. If your quality program doesn't align with those frameworks, you're exposed.

What State Cannabis Programs Actually Require

Most state cannabis manufacturing programs require some version of the following:

• Facility and equipment standards: Controlled-environment requirements for certain product types, equipment qualification documentation, sanitation protocols
• Track-and-trace: Integration with state-mandated systems (METRC is used in most states) for seed-to-sale tracking of all cannabis-containing material
• Testing requirements: Third-party laboratory testing for potency, residual solvents, pesticides, heavy metals, microbials, and mycotoxins — with state-specific action limits
• Labeling requirements: State-specific label formats, required warnings, QR codes linking to COAs, and child-resistant packaging mandates
• SOPs: Written standard operating procedures for all manufacturing activities, often subject to state inspection
• Recall readiness: The ability to identify and retrieve distributed product by lot number

What's notable is that the SOP requirement and recall readiness requirement are also core QMS requirements. Most states, in other words, are requiring the bones of a quality system — they're just not always calling it that, and they're not providing a coherent framework for building one.

Where FDA GMP Fits In

For hemp-derived CBD companies, the relevant GMP frameworks depend on what you're making.

Ingestibles (oils, gummies, capsules, softgels): FDA treats these as dietary supplements or food depending on the claims made. The dietary supplement GMP rule — 21 CFR Part 111 — applies to companies making supplement claims. This regulation requires comprehensive batch records, supplier qualification, identity testing of incoming ingredients, in-process and finished product testing, a CAPA program, and a formal complaint management system.

Topicals (lotions, balms, salves): These are cosmetics under federal law. MoCRA requires cosmetic facilities to register with FDA, maintain safety records, and implement GMP-aligned procedures. FDA's cosmetic GMP guidance is the reference framework here.

Drug claims: If you're making any claim that your product diagnoses, treats, cures, or prevents a disease, FDA considers your product a drug — and full pharmaceutical GMP requirements (21 CFR Parts 210/211) apply. Most CBD companies aren't there, but warning letters frequently originate from companies making implicit drug claims without realizing they've crossed the line.

Hemp-derived CBD ingestibles sold as dietary supplements fall under 21 CFR Part 111's full cGMP requirements, including identity testing of incoming ingredients, batch record documentation, and a functioning CAPA system — regardless of whether FDA has issued a final rule specifically governing CBD. Companies that treat the absence of a final rule as a compliance holiday are reading the enforcement record wrong.

State vs. FDA GMP: Where They Align and Where They Don't

The gaps are instructive. States generally require strong track-and-trace integration and lab testing, but CAPA programs and supplier qualification are inconsistent. FDA's frameworks are stronger on systematic quality controls but weren't designed to interface with state licensing systems. A good QMS fills both sets of gaps at once.

The Four Pillars of a Cannabis and CBD QMS

Whatever framework you're building against, four components are non-negotiable.

1. Document Control

Every SOP, specification, batch record template, and test method needs a controlled document system. This isn't bureaucracy for its own sake — it's how you demonstrate during an inspection that your processes are defined, current, and actually followed. For cannabis manufacturers, version history shows regulators that you respond to changes appropriately. For CBD companies, it provides the audit trail FDA expects under 21 CFR Part 111.

Document control by spreadsheet — SOPs tracked in shared cloud folders with no version control, no approval workflow, and no read-receipt confirmation — is extremely common and extremely problematic. An inspector asking for your current SOP for extraction should get one document with a clear approval date, not a search through a folder.

2. Batch Record Management

Batch records are the backbone of traceability. For cannabis, they connect to METRC at the lot level. For dietary supplement CBD companies, they need to document every incoming ingredient with COAs, every in-process step, every yield, every deviation, and every test result. A batch record that can't be reconstructed to show exactly what went into a product and where it went is a compliance failure waiting to happen — and a recall you can't execute effectively.

3. CAPA — Corrective and Preventive Action

This is where many cannabis companies have the biggest gap. CAPA is the mechanism that turns problems into improvements: a failed batch triggers an investigation, which identifies a root cause, which drives a corrective action, which gets verified as effective. Without it, you're fixing symptoms instead of problems, and regulators know the difference. FDA inspectors specifically look for CAPA programs, and state regulators are increasingly doing the same.

4. Supplier Qualification

Every ingredient, packaging component, and testing service that touches your product needs to be qualified. For cannabis manufacturers, this includes farms or cultivators supplying biomass, labs supplying test reports, and packaging suppliers whose materials become part of the finished product. For CBD supplement companies, 21 CFR Part 111 requires identity testing of incoming ingredients — you can't simply accept a supplier's COA as verification. The supplier sent you paper. What arrived in the drum might be something different.

The Multi-State Complexity Problem

If you're operating in more than one state, or thinking about it, the QMS challenge multiplies. Each state has different required test panels, different action limits for contaminants, different label formats, and different documentation requirements. A QMS built around one state's requirements will need significant rework to accommodate a second.

The answer isn't to build multiple parallel systems. That path leads to document version confusion, training failures, and inspection findings where the inspector is reviewing the wrong SOP.

In my view, the right design is a core QMS with state-specific overlays: a common foundation for document control, CAPA, batch records, and supplier qualification, with configurable state-specific layers for labeling requirements, testing panels, and METRC integration. This is harder to build than a single-state system, but it's the only approach that scales.

Multi-state cannabis operators that rely on state-specific standalone quality systems rather than a unified QMS with configurable overlays face an estimated 40–60% higher documentation burden per audit cycle, compounding as they enter each additional state. The cost isn't just administrative — it's the inconsistency that emerges when the same product is documented differently across facilities.

What makes this tractable now is software. AI-powered QMS platforms can maintain state-specific requirement libraries, flag when a batch record doesn't satisfy a particular state's testing requirements, and generate state-specific documentation automatically from a common batch record. That's the direction the better cannabis QMS tools are heading, and it addresses a real operational pain point.

Where Cannabis Quality Programs Commonly Fail

There are failure patterns that show up repeatedly.

The compliance-first trap. Companies build their quality programs entirely around their state's inspection checklist. They pass the inspection but have no system that catches problems before they reach the regulator. When something goes wrong — a contaminated batch, a mislabeled product, a failed re-test — they have no CAPA system, no deviation management, no escalation protocol. The inspection-driven QMS is a floor, not a ceiling.

Treating batch records as accounting documents. Operators who came up through the unregulated market sometimes treat batch records as inventory reconciliation tools — their primary purpose being to satisfy METRC, not to document quality decisions. These batch records pass the track-and-trace audit but fail the product quality audit. They don't capture deviation narratives, they don't document yield reconciliation reasoning, and they don't support a recall.

No incoming testing for raw materials. CBD supplement companies frequently accept supplier COAs without any independent verification. This is a 21 CFR Part 111 violation and a real quality risk. Identity testing at receipt isn't optional under the supplement GMP rule — and suppliers, even reliable ones, occasionally send material that doesn't match the COA.

What a Modern QMS Should Do for This Industry

A QMS built for cannabis and CBD needs to handle things that general-purpose quality systems weren't designed for.

It needs to interface with METRC, or at minimum generate METRC-compatible records without manual re-entry. Re-keying batch data from a QMS into METRC is a transcription error waiting to happen.

It needs to maintain state-specific requirements as a living library, not a static checklist. State programs update their testing requirements, add new contaminant categories, and revise labeling standards regularly. A QMS that requires manual updates every time a state rule changes is a QMS that will eventually be out of date.

It needs to support product-type-specific workflows. The quality controls for a CBD isolate tincture are different from those for a THC-infused edible, which are different again from a topical. A good QMS knows which controls apply to which product types and doesn't let you skip steps.

And it needs to generate inspection-ready documentation. When a state inspector or FDA investigator asks for your batch record for lot 2024-0517, you should be able to produce a complete, legible, auditable document in minutes — not spend three days reconstructing it from disparate sources.

You can learn more about how Nova QMS approaches compliance documentation for regulated manufacturers and what that looks like in practice.

The Bigger Picture

Cannabis and CBD manufacturing is one of the few industries where companies simultaneously have to satisfy active state enforcement, anticipate federal regulatory development, and build something that will hold up as the rules evolve. That's a genuinely hard compliance problem, and it deserves a more serious quality systems response than most companies are giving it.

A QMS isn't a compliance checkbox. For a cannabis or CBD manufacturer, it's the infrastructure that lets you know your product is safe, demonstrate that to regulators, respond to problems before they become recalls, and build the kind of documented quality history that survives both a state audit and an FDA investigation.

The companies that figure this out early — before a warning letter, before a recall, before a state license suspension — will be in a fundamentally different position than the ones still scrambling to backfill documentation when an inspector shows up.

Frequently Asked Questions

Do cannabis companies need to follow FDA GMP requirements?

For THC cannabis, FDA doesn't currently have direct authority — cannabis remains Schedule I federally — so there's no federal GMP mandate. However, state cannabis programs increasingly incorporate GMP language, and multi-state operators often voluntarily adopt FDA-aligned frameworks to maintain consistency. For hemp-derived CBD products, FDA GMP frameworks apply directly: 21 CFR Part 111 for supplement ingestibles, and MoCRA for topicals.

What's the difference between state cannabis GMP requirements and FDA cGMP?

State cannabis programs generally focus on facility standards, track-and-trace integration, and product testing. FDA cGMP frameworks — particularly 21 CFR Part 111 — are more comprehensive, requiring systematic supplier qualification, identity testing of incoming ingredients, formal CAPA programs, and complaint handling systems. Most state programs require the outputs of a good quality system without prescribing the system itself. FDA prescribes the system.

Can one QMS cover multiple states?

Yes, but it requires deliberate design. The core QMS components — document control, batch records, CAPA, supplier qualification — are common across states. State-specific requirements (testing panels, action limits, label formats, METRC integration) should be maintained as configurable overlays rather than hardcoded into the system. That's the design pattern that scales for multi-state operators without multiplying documentation burden.

What do FDA warning letters to CBD companies typically cite?

Most FDA warning letters to CBD companies cite one or more of three issues: unauthorized health claims that imply drug effects, failure to comply with dietary supplement or food labeling requirements, or GMP violations including inadequate batch records, lack of identity testing for incoming ingredients, and insufficient quality controls. Warning letters are public record and available on FDA's website — reading a few is instructive.

How does a CBD topical manufacturer comply with MoCRA?

MoCRA requires cosmetic facility registration with FDA, product listing, safety records for ingredients, and implementation of GMP-aligned procedures. Facilities with less than $1 million in average annual net sales have an extended compliance timeline, but registration requirements and safety substantiation apply broadly. FDA's draft cosmetic GMP guidance is the primary reference for what GMP-aligned means in practice for this product category.

Last updated: 2026-06-29

Jared Clark is the founder of Nova QMS, building AI-powered quality management systems that make compliance accessible for organizations of all sizes.