Updated: Mar 24, 2020


The Current State of US Cannabis Regulation

What is GMP for Cannabis?

What is ISO for Cannabis?

ISO 9001 and GMP Supply Chain, Labeling, and Distribution

GMP Compliance Requirements

Differences Between ISO 9001 and GMP

The Quality Management System- Mother of SOPs

Standard Operating Procedures- More than Directions

GMP Variations and Classification of GMP Products

Your Resource for Cannabis GMP and ISO Cannabis Extraction Equipment


In the United States, the CBD and cannabis industries have been operating in a legal and regulatory gray zone that is unlike any other consumable product on the market. Lack of federal reform and harmonization among states is embarrassing when compared to Canada and the European Union (EU). Cannabis and hemp markets are growing at a rapid pace without guidance or consumer safety regulation from the US Food and Drug Administration (FDA).

The most astonishing aspect of this regulatory failure is that systems and certifications already exist that could immediately help create safer products with more transparency and quality requirements. Namely, these systems are ISO 9001 and Good Manufacturing Processes (GMP). These regulations and certifications are beginning to be adopted by some in the cannabis and CBD markets, but are not mandatory for many areas of the cannabis supply chain.

“To be clear, there is no specific GMP certification for cannabis, hemp, or derived products.”


GMP is a manufacturing system that aims to guarantee reproducible product quality and safety. GMP manufacturers have systems and processes in place that ensure the manufacturing process is documented at all steps and that materials used in production and activities performed are traceable. GMP is a mandatory system for producers of pharmaceuticals, medical devices, foods and beverages, dietary supplements, and cosmetics.

Goals of GMP

Assure products are consistently high in quality from batch to batch

Assure products are used for their intended use

Prevent harm from occurring to the end-user

How GMP Achieves Goals

Packaging and labeling requirements

Documentation requirements

Traceability from starting materials to end product

Validation and verification of processes

Standardized operating procedures (SOPs)

Quality system requirements

Sanitation and hygiene requirements

Testing requirements for chemical, physical, and biological contaminants

Cannabis products and hemp products are not required to meet GMP standards in the US because the FDA still considers them to be broadly illegal.

The FDA has yet to create clear standards for CBD and hemp extracts despite federal hemp and hemp product legalization in the 2019 Farm Bill and Industrial Hemp Guidelines. The FDA has sent warning letters to producers based on false marketing claims and inaccurate labeling of ingredients but has been vague in qualifying CBD and hemp products under federal code.

In the US, GMP regulations, also known as Current Good Manufacturing Processes (cGMP) are outlined in Title 21 CFR. While the regulations may seem straightforward, they are subject to interpretation by FDA auditors who are responsible for enforcing the regulations. While some cannabis product manufacturers have glommed on to the use of SOPs, GMP compliance requires much more! Many producers are unaware that GMP is meant to be implemented through the use of a quality management system (QMS). Likewise, the industry widely lacks understanding of the hefty requirements of validations- studies that prove a process is valid, repeatable, and safe.

To be clear, there is no specific GMP certification for cannabis, hemp, or derived products. Some facilities are achieving licensing because they are certifying that their processes meet the requirements of GMP. This is significantly different than the version of GMP applied to pharmaceutical producers who have requirements for proving that their drugs are safe and effective through clinical trials. Cannabis products do not have this requirement for pre-market studies and efficacy testing. Of further concern is that many CBD products are being labelled “GMP compliant” or just “GMP” without actual GMP certification.


“Adaption and certification of ISO standards are voluntary and applicable to products that are not part of GMP regulation.”

The International Organization for Standardization (ISO) is an organization that creates standards for industrial and commercial products and services. ISO differs from GMP in that it focuses on the management of the business firm and how information is reported to ensure issues are responded to. There are several different types of ISO, but some of the most common are:

ISO 9001:2015 is the standard for the requirement of a quality management system

ISO 22000:2018 is specific to the development of a food safety management system

ISO 45001:2018 is a new standard for occupational health and safety that will replace OSHA’s 18001 standard

Adaption and certification of ISO standards are voluntary and applicable to products that are not part of GMP regulation. Many companies choose to implement ISO in addition to GMP because they are advantageous in streamlining processes, increasing quality and productivity, and ensuring product and workplace safety.

Here is an overview of how ISO 9001 creates a process-focused quality management system (QMS) standard:

All quality system processes must be measured, monitored, controlled, and improved

Business and quality objectives must be established for relevant functions at appropriate levels

Business and quality objectives must be measurable

The quality system’s effectiveness is verified by achieving measurable objectives

Top management must review QMS planning and ensure it will be sustainable and effective

Periodic management reviews assess opportunities for improvement and observe the implementation of changes

ISO 9001 goes beyond simply maintaining a well-documented management system and requires objective measurement and improvement


ISO 9001 standards for quality management systems are internationally recognized where GMP varies depending on location. ISO 9001 is more generic than GMP but helps to fill gaps in supply chain compliance when vendors or subcontractors are not FDA regulated. It is important to be aware that the entire supply chain must meet the requirements of the final product for GMP manufacturers.

If CBD tincture is made in a GMP facility, using ISO 9001 compliant packaging, but then distributed by someone who is not following GMP, the product loses its integrity and cannot be considered “GMP.” While some take sneaky steps with their marketing in order to use GMP symbols on their packaging, it is very unwise to make GMP claims without actual certification of the entire supply chain.

“GMP Compliant”

This product manufacturer is claiming to follow GMP but is not certified.

“GMP Manufactured”

This product was manufactured under GMP but may lack control in storage and distribution which can deteriorate product safety and quality.

“GMP Certified”

This product is truly GMP from starting materials through distribution. They have passed certifications and are subject to audits by the FDA, provided they have properly registered as a GMP facility with the agency.

ISO label claims are often vague as well. Many manufacturers are placing ISO and GMP logos on their packaging in an effort to appear trustworthy. Consumers are not faced with an easy task in figuring out which component of the product has been manufactured under ISO or GMP, and finding out what certifications a product actually holds is a cumbersome task.

“Many manufacturers are placing ISO and GMP logos on their packaging in an effort to appear trustworthy.”

Ironic as it may be, GMP and ISO were created in response to the public’s outrage over manufacturing methods and lack of safety testing in food and drugs. The battle for transparency in manufacturing has been a tough uphill battle that goes back to the 1900s.


GMP requirements differ slightly between US GMP, EU GMP, and WHO GMP. Among the different parts of the world that have their own codes, there are many common requirements. These requirements provide guidance for manufacturing, testing, and quality assurance in order to ensure products are safe for human use and/or consumption.

Manufacturing areas must be clean and hygienic.

Manufacturers must prevent cross-contamination, adulteration, and allergens by maintaining a controlled environment.

Manufacturing processes must be controlled and have defined specifications.

Critical manufacturing processes must be validated to ensure consistency and compliance.

If processes are changed, changes must be evaluated and may require further validation.

Good Documentation Practices (GDP) must be adhered to and procedures must be written in clear and unambiguous language.

Staff must have documented training.

Records must be made and retained to document that procedures were performed properly.

Records of manufacturing must document a complete and traceable history of the batch.

If a deviation from a standard procedure occurs, it must be investigated and documented.

Products must be stored, transported, and distributed in a manner that minimizes risk to product quality.

Manufacturers must have a system in place for recalling their products and handling complaints.

GMP guidelines are not instructions. They are principles to be observed during manufacturing. A GMP standard operating procedure (SOP) describes how the principles are observed along with how a process is performed. SOPs should contain quality criteria that are observable, measurable, and verifiable to ensure a process is performed correctly.


The first major difference between ISO 9001 and GMP regulations is different in that GMP is written to be applied to specific industries and products. ISO 9001 is not industry or product-specific. Another key difference between GMP and ISO 9001 is that GMP regulations are enforceable by law. The US federal government does not require certain types of products or industries to comply with ISO 9001.

When it comes to enforcement of GMP, federal FDA agents administer and audit the proper application and interpretation of the GMP standards. With GMP, companies must register annually. ISO 9001 companies are granted certifications for three years between renewal. To maintain their certification, companies must pay for annual ISO audits that are conducted by registrars qualified by ISO.

Requirements for validations and process controls also differ between ISO and GMP. ISO 9001 does not list as many requirements for process controls, facilities, and equipment. GMP requirements for validating processes are also described in greater detail than in ISO 9001. GMP 21 CFR Part 11 requires validation for equipment, facilities, methods, cleaning, software, and electronic systems.

As far as management oversight is concerned, ISO 9001 and GMP both require management oversight. ISO 9001 describes more detailed and specific requirements for a management review than GMP. Conversely, ISO 9001 requires that a management representative oversee the quality management system but doesn’t specify a quality control unit. In GMP, the quality assurance or quality control department has its own management with the responsibility and authority to approve or reject the final product.

GMP differs from ISO 9001 in that ISO 9001 requires measurement of the effectiveness of the quality system and customer satisfaction. GMP focuses more narrowly and measures the effectiveness of the quality system based on its ability to ensure the final product is pure and safe. Customer satisfaction is not considered in GMP. GMP emphasizes a quality system that contains written procedures, documentation and corrective actions when there are deviations from those procedures, record keeping, production, and process controls.

When it comes to ISO 9001, there are very specific requirements for facilities with regard to size, ease of cleaning and maintenance, contamination prevention, filtration, ventilation, heating and cooling, control of penicillin, lighting, plumbing, sewage and refuse, washing and toilet facilities, and general sanitation. ISO 9001 also has stringent requirements for equipment such as reactivity of surfaces that must not alter the safety, identity, strength, quality, or purity of the product. GMP compliance provides manufacturers with the tools to meet ISO 9001. However, ISO 9001 does not make GMP compliance easier. It is possible for an ISO 9001 certified company to not comply with GMP.

Similarities between ISO 9001 and GMP

Require record generation and documentation of procedures

Require SOPs

Require defined job duties that correspond to training

Require properly maintained work environments

Require customer complaints and nonconformances are addressed through corrective actions are taken to prevent a recurrence

Require equipment to be maintained and calibrated

Require products to be properly identified throughout the manufacturing cycle

Require procedures for product release, analysis of the product, and conformance to specifications prior to release

Require segregated storage spaces and quarantine procedures to control the approval and release of product and inventory

Require the application of good scientific principles and statistical techniques in analyzing data


The quality management system (QMS) is described in a manufacturer’s Quality Manual. This critical document lays out which regulations and laws are applicable to the manufacturer and describes which processes have been designed to ensure adherence. The Quality Manual also describes how processes are designed under a structured system that applies principles and industry standards like risk assessment and HACCP (Hazard Analysis and Critical Control Points).

Without a meaningful QMS in place, SOPs fail to be SOPs in the sense of compliance. That is, there must be a system for managing standardization in order for processes to be standardized. Meaningful quality control points can only exist if there is a standard to compare them to. Validations are an important way to evaluate what the critical control points are in a process. Without them, it is hard to say there is evidence to support the criteria for failure or acceptance of a particular criterion. When an SOP is provided or purchased, it should always be customized to the actual business and appear in a standardized format. Template SOPs from cannabis consultants and equipment manufacturers are great starting material but bear in mind that that template should not be the final SOP.

Without a meaningful QMS in place, SOPs fail to be SOPs in the sense of compliance. That is, there must be a system for managing standardization in order for processes to be standardized. Meaningful quality control points can only exist if there is a standard to compare them to.


Many confuse SOPs with work instructions (WIs) which are specific instructions on how to perform an aspect of a process described within an SOP. An example of an SOP would be “Short Path CBD Distillation.” This example SOP may have associated work instructions such as “How to Clean Equipment for Short Path CBD Distillation,” or “How to Assemble Short Path Distillation Equipment for CBD.”

SOPs also have associated forms and logs which are used to create records of the activity. The example SOP for short path CBD distillation would have a batch record where employees would record that steps were performed as directed. They would fill the document out as each step is performed and may be required to have another employee make verifications at critical process steps such as weighing and labeling. There would also be logs to add the extract to an inventory record, keep track of which materials were used, and track which equipment was used.


As previously mentioned, there are different versions of GMP depending on location. The US version of GMP that is regulated by the FDA under Title 21 CFR is often referred to as cGMP (Current Good Manufacturing Practices). Different portions of cGMP are applied based on the type of manufacturer. For example, pharmaceutical cGMP is much more stringent than the portions of Title 21 CFR that are applied to cosmetics and dietary supplements. For this reason, many in the cannabis and CBD industry are hopeful that the FDA will classify hemp-derived products like CBD tinctures as dietary supplements. While the FDA has hinted that they would like CBD, especially in isolate form, to be classified as pharmaceutical, there is much pressure on them to hold it to a less burdensome standard.

The World Health Organization (WHO) has a version of GMP that is utilized primarily in developing nations but spans about one hundred countries. The European Union (EU) also has its own version of GMP for member countries. Both WHO GMP and EU GMP are very similar to the US FDA’s GMP standard. In the United Kingdom, the Medicines Act’s Rules and Guidance for Pharmaceutical Manufacturers and Distributors or “The Orange Guide” is the governing document for GMP-like guidance. ISO is internationally recognized so there is not any variation based on location.

In Canada, the Cannabis Act has paved the way for federal marijuana legalization like none other. Their federal cannabis regulations are called Good Production Practices (GPP) and are enforced through Health Canada. In addition to GPP, Canadian cannabis growers are preparing for the potential of international cannabis trade by pre-adapting EU GMP guidelines. While Canada blazes the way and offers funding to bolster its cannabis industry, the US is far from prepared for international cannabis trade or federal legalization.

In addition to GMP and ISO 9001 for cannabis, there are other FDA regulatory systems for cannabis extractors to be aware of:

Good Agricultural Practices

Good Agricultural Practices (GAP) are farming guidelines aimed at food safety and purity. GAP is voluntary, but GAP cannabis producers will follow sanitation practices and have contamination protection measures that are not guaranteed from a non-GAP farm. GAP is very easy and cost-effective for cannabis farmers to achieve and will help ensure the safest and best cannabis or hemp possible.

Good Laboratory Practices

Good Laboratory Practices (GLP) are laboratory guidelines that conduct non-clinical testing. While GLP certification is not being widely adopted by cannabis testing labs, it is a credential to look for. Historically, GLP laboratories perform microbial testing and validations for the biotech industry. While many cannabis-specific labs are popping up, it may be better to reach out to established GLP laboratories that have been long-serving the biotech industry.


If you are looking for more guidance on GMP for cannabis or ISO 9001 quality standards, Green Machine Labs has the answers! Maybe you are not ready to hire a cannabis consultant but are looking for some general direction? Feel free to shoot us an email or give us a call. We are always excited to help new and experienced cannabis extractors achieve their goals.

1,455 views0 comments

Recent Posts

See All

Recent Posts

Featured Products

No product

GRM-ND Remediation Resin

GRM-ND Remediation Resin

4in Dewaxing Column

4in Dewaxing Column


Related Posts


Office: 41571 Corning Pl. STE 104

Murrieta, CA 92562

Phone: (951) 261-9890


Sign up to our newsletter to receive updates and promotions