Cannabis Testing Labs Must Navigate State Rules, ISO Accreditation and Evolving Federal Oversight

For cannabis testing laboratories, regulatory compliance is less about following one national rulebook than managing several overlapping systems. Federal law continues to treat marijuana differently from hemp and FDA-approved cannabis-derived medicines, while states establish their own requirements for testing, laboratory licensing, reporting and quality assurance.

The FDA’s cannabis guidance explains that the 2018 Farm Bill removed hemp containing no more than 0.3% delta-9 THC on a dry-weight basis from the federal definition of marijuana, but it preserved the agency’s authority over products containing cannabis-derived compounds. Marijuana remains listed by the DEA as a Schedule I substance, although federal rescheduling proceedings are ongoing. Neither development provides a single, comprehensive federal testing framework for state-licensed cannabis laboratories.

A state-by-state compliance landscape

States with medical or adult-use cannabis markets have therefore created their own systems for ensuring that products are tested before sale. The requirements can differ significantly. Depending on the jurisdiction and product type, laboratories may need to analyze cannabinoid potency, terpenes, residual solvents and processing chemicals, pesticides, heavy metals, microbial impurities, mycotoxins, moisture, water activity and foreign material.

California, for example, requires licensed cannabis testing laboratories to maintain ISO/IEC 17025 accreditation and participate in quality-assurance and proficiency-testing programs. California also requires testing laboratories to issue certificates of analysis and submit results through the state’s tracking system. Its regulations specify accreditation requirements for testing areas including cannabinoids, heavy metals, microbial impurities, mycotoxins, pesticides and residual solvents.

Massachusetts likewise requires independent testing laboratories to meet ISO/IEC 17025 requirements through an approved third-party accrediting body. State law and Cannabis Control Commission protocols address both the analytical scope of testing and safeguards intended to preserve laboratory independence. In 2025, the commission also required licensees generally to submit one representative test package to a single laboratory for a complete compliance panel, rather than dividing required tests among multiple laboratories.

Why ISO/IEC 17025 matters

ISO/IEC 17025 is the international standard for the competence, impartiality and consistent operation of testing and calibration laboratories. It is not simply a general quality badge: accreditation is granted for a defined scope of work, meaning a laboratory must demonstrate competence for particular methods, analytes and testing activities.

For a cannabis laboratory, preparing for accreditation may involve documenting sample receipt and chain of custody, validating or verifying analytical methods, controlling instruments and reference materials, training personnel, managing deviations and corrective actions, conducting internal audits, and participating in proficiency testing. The laboratory must also show that its reported results are technically sound and supported by appropriate records.

Accreditation does not replace state licensing or other legal requirements. A lab may be ISO/IEC 17025-accredited yet still need to satisfy separate rules concerning cannabis handling, security, reporting, sampling, data retention, conflicts of interest and certificate-of-analysis procedures.

GMP is not the same as laboratory accreditation

Good Manufacturing Practice, or GMP, should be treated as a related but distinct framework. FDA’s current GMP regulations primarily establish minimum requirements for the manufacturing, processing, packing and holding of drug products. They are not a universal federal certification requirement for every cannabis testing laboratory.

Manufacturers may pursue GMP certification or implement GMP-based quality systems because of a particular state requirement, a customer expectation, an export strategy or the possibility that future federal rules will impose additional controls. A testing laboratory may also adopt selected GMP practices where they support sample integrity, documentation and quality management. But GMP status should not be presented as a substitute for the ISO/IEC 17025 accreditation that some states specifically require for cannabis testing.

Building a defensible compliance program

Before opening a facility or expanding into a new state, laboratory operators should identify every jurisdiction in which they will test and map the applicable requirements to their intended scope of work. That review should cover:

• laboratory licensing and facility requirements;
• required analytes, product categories and detection limits;
• sampling, transport, chain-of-custody and storage procedures;
• approved or standardized analytical methods;
• method validation, verification and measurement uncertainty;
• instrument calibration, maintenance and quality-control practices;
• proficiency testing and internal-audit obligations;
• certificate-of-analysis content and reporting deadlines;
• data integrity, record-retention and track-and-trace requirements; and
• independence and conflict-of-interest restrictions.

State rules can also change after a laboratory has been licensed. California, for instance, now requires licensed laboratories to use a standardized cannabinoid method for certain dried-flower and pre-roll testing. Maintaining compliance therefore requires regulatory monitoring, controlled updates to standard operating procedures and recurring staff training—not just a one-time accreditation project.

External regulatory or quality consultants can help laboratories conduct a gap assessment, prepare documentation, organize method validation, train personnel and coordinate with an accreditation body. The laboratory remains responsible for the accuracy of its work, however. Consultants cannot replace qualified technical staff, effective quality oversight or a management system that is followed in day-to-day operations.

The most reliable approach is to treat compliance as an ongoing technical and operational program. ISO/IEC 17025 accreditation may provide the foundation for demonstrating laboratory competence, while state licenses, cannabis-specific testing rules and carefully controlled procedures determine whether the facility can legally operate in each market. GMP practices may add value in manufacturing or supply-chain contexts, but they should be evaluated according to their actual regulatory purpose rather than used as a catch-all label for laboratory quality.