Good Manufacturing Practices (GMP) are guidelines designed to ensure that cannabis products are consistently produced and controlled under strict standards for quality and safety, as established by the U.S. Food and Drug Administration (FDA).

According to sections 123.6 and 113.12 of Title 9 regulations, all cannabis products created for both medical or recreational use must be processed following GMP standards, which must be maintained throughout the duration of the two-year license period. This is a mandatory requirement, with no exceptions.

Additionally, adult-use cannabis licensees and registered organizations must have their extraction and/or manufacturing processes audited by an accredited, third-party certification body and submit proof of this audit to the Office of Cannabis Management (OCM) within one year of commencing licensed operations.

Simply put, embracing GMP standards is essential for cannabis quality control, customer safety, and regulatory success. That's why it's important to follow these guidelines during manufacturing processes and prepare for the required audits.

Do you want to learn more about these specific New York regulatory requirements? From understanding the mandatory audit processes to going over quality control systems, this article breaks down the essentials of GMP compliance for the cannabis business.

Fundamentals of GMP in Cannabis Manufacturing

As established by Title 9 of New York Codes, Rules and Regulations (NYCRR), all cannabis products must be processed in accordance with GMP standards. These guidelines are based on the requirements set in Part 111 or Part 117 of Title 21 of the Code of Federal Regulations.

GMP standards will depend on the type of cannabis product being processed or as determined by the OCM.

The 21 CFR Part 111 and Part 117 go into more detail about the differences between each GMP standard, but the most important one is that the former addresses dietary supplements, while the latter focuses on human food.

Federal regulations define dietary supplements as consumer products that contain vitamins, minerals, herbs or other botanicals, amino acids, substances used to increase total daily intake, and concentrate, metabolite, constituent, and extract, or a combination of these.

Human food, on the other hand, describes products that are consumed by humans and includes raw materials and ingredients, foods, or a combination of these components.

What Does GMP Mean?

As mentioned above, GMP stands for Good Manufacturing Practices and refers to quality control systems that ensure cannabis goods are produced in controlled environments according to FDA regulations, so final products are safe for use.

New York-Specific GMP Requirements

In New York, adult-use cannabis processors and registered organizations are legally required to comply with GMP standards and must validate compliance with health, safety, and sanitation guidelines through a third-party audit or certification.

Both types of businesses are authorized by the OCM to perform certain extraction or processing activities and should establish compliance with GMP standards for each, as applicable, by submitting proof of a qualified third-party audit.

A GMP audit or certification must be conducted by an accredited certification body, which must assess, verify, and attest in writing that the cannabis operator is complying with these standards according to federal regulations.

As explained above, licensees must submit this proof within one year of commencing operations. An updated version is also required each time the license is renewed, which is typically 2 years according to the regulations for cannabis operator licensing in NY.

All of the state's cannabis processors must submit proof of a qualified third-party GMP audit unless their processing activity is limited and they obtain approval for a conditional exemption by the OCM.

Following GMP is mandatory, but Adult-use Cannabis Type 3 processor licensees and microbusinesses can complete a waiver process to request a conditional exception under specific circumstances, such as when their packaging, labeling, and branding activities are limited.

It's important to note that conditional exceptions require prior written approval by the OCM and only apply to the following product types and activities:

Packaging, labeling, and branding whole-flower cannabis without on-site grinding.
Packaging, labeling, and branding pre-ground flowers into non-infused pre-rolls (but the licensee cannot grind the flowers themselves).
Packaging, labeling, and branding kief that may be pressed into pucks with a punch press (but not grinding by the licensee).

Note: Grinding cannabis flowers isn't considered for GMP audits due to safety concerns for employees.

NY Regulatory Framework and Compliance

The OCM is responsible for ensuring that businesses are meeting the New York cannabis industry standards in terms of licensing, product safety and quality, packaging and labeling, tracking, and security.

New York State Requirements

These are the most important regulations for cannabis processing set by the OCM:

Licensing: All cannabis operators must obtain a license from the OCM and renew it as required to operate legally in New York.
Processing activities: Processors must obtain cannabis from licensed cultivators and can only engage in those activities authorized by their license type.
Product safety and quality: Cannabis processors must ensure products are high quality and safe for consumption by following GMP standards and completing required tests, which must be conducted by independent laboratories.
Software: Cannabis businesses should use seed-to-sale tracking software to monitor plants and products throughout the lifecycle, and this solution should integrate with the state-mandated tracking system BioTrack.
Labeling and packaging: Cannabis products must be properly packaged in tamper-evident, child-resistant containers and labeled with key information, such as ingredients, potency, and warnings.
Lot identification and traceability: Cannabis processors must assign a unique lot identifier for traceability to each batch of cannabis or cannabis products to monitor safety and manage necessary recalls.
Record-keeping: Cannabis businesses must maintain detailed records of all their operations, including inventory and sales.
Sanitation and facility management: All processing areas must be kept in optimal conditions according to general sanitary practices. Additionally, equipment must be regularly maintained and ingredients must be properly stored before use.
SOPs and documentation: Cannabis processors are required to implement Standard Operating Procedures (SOPs) to cover all key aspects of the manufacturing process and maintain the required documentation for proper traceability.
Advertising: Cannabis businesses are prohibited from using false or misleading claims and statements, such as potential health benefits, to advertise cannabis.
Security: Cannabis processors must implement security measures to protect their manufacturing facilities and products from theft and diversion.

Recent Changes to New York Cannabis Regulations

New York cannabis regulations have also undergone significant changes in recent years. For example, the state's potency tax was replaced by a 9% flat excise tax in 2024 and the medical tax was reduced from 7% to 3.5%. Plus, Governor Kathy Hochul unveiled plans to crack down on unlicensed cannabis operations to safeguard the integrity of the legal market.

On August 27th, 2024, the OCM announced the launch of a new tool, the Adult-Use Cannabis Licensee Amendment Request Survey, which allows cannabis operators to submit requests to amend their license records (officially change information associated with their licenses).

Through the Adult-Use Licensee Amendment Request Survey, licensees can amend the following sections:

License overview (Entity Legal Name, Doing Business As (DBA) name, business website, business entity (only for sole proprietors).
Contact information
Location (operating address)
Notification of Ownership and True Party of Interest (TPI)*

*Note: No amendments to TPIs are currently accepted through this survey. This section is only used to receive notifications when the option is available. Licensees should refer to the Interim Guidance for True Parties of Interest Changes for this process.

In the last couple of years, the OCM also revised some regulations and restrictions on the ownership of registered organizations, changed some definitions, such as "True Parties of Interest" and "Passive Investors," announced the implementation of the NY STST Tracking System (BioTrack), and set a new requirement: use an inventory tracking software that integrates with the newly adopted platform starting January 17th, 2025, and notify about this election as soon as possible.

Regulatory Changes and GMP Guidelines for Hemp Processors

The OCM authorizes marijuana and cannabinoid hemp processing under two different license types according to the Adult-Use Cannabis Program and the Cannabinoid Hemp Program, respectively.

GMP guidelines for hemp processors are similar, as these operators must obtain an audit of their facilities. However, both types of businesses may be subject to different regulations.

For example, in November 2023, Part 114 of Title 9 of NYCRR was amended to preserve the public health, safety, and welfare of consumers in New York and protect people from intoxication with cannabinoid hemp products.

The most significant changes addressed the tetrahydrocannabinol (THC) limit for cannabinoid hemp products, setting it at 0.3%, and the need to complete third-party laboratory testing for each. Some definitions were added or revised, too.

For more information about the GMP guidelines for hemp processors, refer to the OCM's audit guidance.

Required Documentation for Cannabis Operators

As mentioned, record-keeping, SOPs implementation, tracking, and reporting are key in this industry. Therefore, cannabis operators should maintain detailed records and documentation, including the following:

Licensing:

Application for a processor license
Business plan
Financial statements
Background checks of key personnel
Local zoning and land use approvals
Official license certificate

Product Safety and Quality:

SOPs for the required activities, such as cultivation, processing, and testing
Certificates of Analysis (COAs) from independent laboratories
Tracking and documentation of THC
Product formulation records
Ingredient lists and specifications
Testing results of samples from lots or batches of products

Labeling and Packaging:

Label designs and proofs
Packaging materials specifications

Lot Identification and Traceability:

Inventory records
Lot numbers and tracking records
Chain of custody documents

SOPs and Documentation:

Detailed SOPs for all processing activities
Quality control procedures and documentation
Employee training records

Advertising:

Advertising and marketing plans
Compliance with advertising regulations

Security:

Security plan
Security system documentation
Controlled access procedures
Security logs

This list isn't exhaustive and may not include all required documentation. For complete, up-to-date information, refer to the official OCM regulations and the relevant subparts of 21 CFR Part 111 and Part 117.

GMP Audit Process

As explained above, this audit is a thorough examination of a cannabis business's operations. Its purpose is to ensure the operator complies with GMP standards.

The GMP audit process typically involves the following steps:

Pre-audit meeting: The third-party accredited certification body's auditor and the cannabis business's designated representative meet to discuss the scope of the audit, schedule, and any specific requirements.
Document review: The third-party accredited certification body reviews the cannabis business's SOPs, training records, and other relevant documentation.
Facility inspection: The third-party accredited certification body inspects the cannabis business's facility, including production and storage areas, paying attention to key factors, such as manufacturing practices, hygiene, risk management, and recall processes.
Interviews: The third-party accredited certification body's auditor interviews employees at various levels to assess their understanding of GMP guidelines and their roles in ensuring compliance with such requirements.
Audit report: The third-party accredited certification body prepares a detailed report of its findings, including any deviation in key processes, non-conformances, or areas for improvement.
Corrective and preventive actions: The cannabis business develops and implements corrective and preventive actions to address any identified issues.
Follow-up audit: If necessary, the third-party accredited certification body conducts a follow-up audit to verify that the corrective and preventive actions have been implemented effectively.

How to Prepare for Third-Party Audits

To successfully prepare for a GMP audit, it's important to:

Evaluate the processing facility: Make sure the processing area meets FDA requirements before proceeding with GMP guidelines.
Choose an accredited certification body: Work with a third-party auditor that has been duly accredited by an official body accepted by the OCM.
Review processes and operations: Assess all key procedures and activities to make sure they follow regulatory guidelines and industry standards.
Develop and implement comprehensive SOPs: Ensure that SOPs cover all required activities or operational aspects and are up-to-date, accurate, and followed consistently.
Train employees on GMP requirements: Conduct regular training sessions and encourage employees to participate to ensure all of them understand their roles in maintaining GMP compliance.
Inspect labels and packaging: Check the packaging and labeling of each product, batch, or lot that is processed to ensure it's compliant.
Maintain accurate records: Keep detailed records of all production processes, testing results, and other relevant activities.
Conduct internal audits: Plan and perform regular internal audits to identify and address potential non-compliance issues before the third-party audit.
Build a strong and collaborative relationship with the auditor: Communicate openly and honestly with the third-party accredited certification body throughout the audit process.

Common Compliance Issues Found During Audits

For reference, these are the most common compliance issues found during GMP audits:

Non-compliance with key cannabis regulations and industry standards
Inadequate documentation and missing or incomplete records of key activities, inspections, and mandatory protocols
Deviation in manufacturing processes or steps
Insufficient or inadequate employee training on key topics, such as regulations, policies, procedures, and how to identify and report compliance issues
Poor sanitation and hygiene practices
Outdated or ineffective policies and procedures
Incorrect labeling and packaging
Lack of proper oversight and supervision
Weak or ineffective internal controls
Inadequate testing procedures
Lack of traceability and accountability

Required Documentation for Audits

The specific documentation required for GMP audits will vary depending on the type of cannabis business and the scope of the audit. However, some common documents include:

SOPs
Training records
Production records
Testing results
Equipment calibration and inspection records
Sanitation logs
Pest control records
Procedures for product disposal or recall

Timeline for Audit Preparation

The timeline for audit preparation will vary depending on the size and complexity of the cannabis business, too. However, it's generally recommended to start preparing at least six months in advance of the audit to have sufficient time to identify and address any potential issues.

After that, audits should be updated every time the license is renewed, which depends on the license type but is generally two years in this state.

Tips for Successful GMP Audit Completion

Do you want to complete your GMP audit successfully? Consider the following tips:

Start early: Begin preparing for the audit well in advance to ensure you have enough time to address any potential issues.
Use past inspections to your advantage: Review and analyze reports from past inspections or audits, including internal ones, to identify potential issues and areas for improvement.
Be proactive: Address potential issues or non-conformances as soon as possible and double-check before the audit.
Rely on a checklist: Use a comprehensive checklist for GMP compliance to make sure all guidelines and requirements are covered during the audit.
Leverage audits: View GMP audits as valuable opportunities to identify and address weaknesses and issues that can potentially affect your products, operations, and reputation.
Maintain thorough and accurate records: Document all your work before, during, and after the audit, including findings, corrective actions, and preventive measures.
Make quality, safety, and compliance your business' top priorities: Foster a proactive and collaborative approach to compliance, encouraging all your employees to contribute to product quality and safety by following strict GMP guidelines.
Seek professional help: If you're unsure about any aspect of the audit process, get assistance from a qualified consultant.

Third-Party Audit Requirements

Cannabis businesses must select an accredited certification body to conduct their GMP audits. Below are some examples:

The selected party must be accredited by a recognized accreditation body accepted by the OCM. Some examples include the American National Standards Institute (ANSI), the International Standards Organization (ISO), and the ANSI-ASQ National Accreditation Board (ANAB).

If you want to propose an alternate accreditation body, you should email the OCM at compliance@ocm.ny.gov or hemp@ocm.ny.gov, as applicable.

Key Audit Categories

GMP standards focus on four core principles: consistency, quality control, documentation, and safety. As such, these guidelines are divided into six major sections:

Management Commitment
Risk Management
Quality Management Systems
Site & Facility Management
Product Controls
Staff Training

The OCM says that, typically, GMP audits must include these technical requirements:

Complaint Management
Allergen Management
Regulatory Compliance
Product Testing
Hazard Analysis Critical Control Point (HACCP)
Environmental Monitoring
Document Control and Record-Keeping
Internal Audits
Hold and Release Controls
Storage and Distribution Controls
Product Identification and Traceability
Equipment and Utensils
Recall Program
Water Safety and Quality Management
Corrective Actions and Preventative Actions
Air Safety and Quality Management
Risk-based Preventative Controls
Waste Management
Verification and Validation
Pest control
Crisis Management
Cleaning and Sanitation Controls/Operations
Packaging and Labeling Controls
Chemical Controls
Supplier Controls
Employee Training
Personnel Practices (cGMP/cGAP)

Quality Control Systems

Quality control systems are designed to ensure that all processes, from cultivation and extraction to packaging and labeling, adhere to strict industry standards and regulations, so they're crucial components of GMP guidelines.

Required Testing Procedures

In New York, adult-use and medical cannabis products should be tested for the following:

Phytocannabinoids: To determine the amount of THC and CBD in the product.
Pesticides: To ensure that the product is free of harmful substances.
Heavy metals: To verify that the product doesn't contain excessive levels of potentially toxic metallic elements, such as lead, mercury, and arsenic.
Microorganisms and microbial impurities: To ensure the product is free of dangerous pathogens.
Residual solvents: To ensure the product doesn't contain residual solvents from the extraction process.
Moisture content and water activity: To assess the quality and preservation of the product.
Foreign material: To examine the product for unwanted substances that can potentially lead to contamination.
Mycotoxins: To examine cannabis for secondary metabolites of certain fungi and molds that can be highly toxic.
Terpenoids: To ensure the product has the desired terpene profile and is consistent, high-quality, and safe for consumption.

Safety Protocols

Cannabis processors should also have strict safety protocols in place to protect customers, their employees, and the environment, such as:

Using personal protective equipment (PPE), including gloves, safety glasses, respirators, lab coats or coveralls, and hair nets or caps.
Training employees on safety procedures, such as handling chemicals or equipment.
Installing adequate ventilation systems to remove hazardous fumes from processing facilities.
Implementing robust security measures, such as cameras and alarm systems, to protect processing facilities against vandalism, theft, and unauthorized access.
Properly managing and disposing of hazardous waste to prevent contamination.
Implementing emergency procedures for an adequate response in case of accidents.

Documentation Systems

Moreover, cannabis processors should maintain detailed records of all their activities and efforts to maintain product quality, which can be done with a robust documentation system that includes:

Chain of custody (CoC) records
Testing results
Seed-to-sale tracking software
Inventory management systems
Quality control documentation
Maintenance records
Waste management records

Quality Assurance Measures

Cannabis processors must also implement quality assurance (QA) measures to ensure their products are safe for consumption.

To learn more about these requirements, check our guide titled Quality is King: A Guide to Cannabis QA, Remediation, and CRC and the OCM regulations.

Product Standards

Cannabis products must meet certain standards to be sold in New York. These standards include:

Potency: The product must contain the labeled amount of THC and CBD.
Safety: The product must be free of harmful contaminants.
Packaging: The product must be packaged in a child-resistant, tamper-evident, and fully enclosed container.
Labeling: The product must be labeled with accurate information, including the amount of THC and CBD, ingredients, warnings, and other relevant information.

For more information and FAQs about cannabis labeling and packaging, refer to the OCM's Packaging and Labeling & Marketing and Advertising Guidance for Adult-Use Licensees.

Operational Compliance

To legally operate in this industry and ensure ongoing compliance, cannabis processors should get a license, comply with GMP guidelines, and follow other standards on a day-to-day basis. Here's more information:

Requirements for Cannabis Operator Licensing in NY

Below are the most important aspects of obtaining a cannabis processing license in NY.

Application Process:

These are the common steps:

Obtain a processor license application from the OCM.
Complete the application thoroughly, including detailed information about:some text
- Business structure and ownership
- Proposed processing location and facility details (including security measures)
- Processing activities, methods, and intended products
- Quality control procedures
- Security plan
- Finances and funding
Submit the completed application with the required fees and supporting documentation, such as:some text
- Business plan
- Background checks for owners and key employees
- Proof of local zoning and permits
- Financial statements
- Security plan details
Wait for the OCM to review the application and conduct a site inspection to assess compliance with regulations.
Receive the cannabis processing license and initiate operations under strict compliance with all licensing conditions and regulations.
Maintenance Requirements:
This is what cannabis processors should do to keep this license:
Maintain accurate and up-to-date records of all business activities, including:some text
- Cannabis inventory
- Production records (including batch numbers, dates, and processing methods)
- Testing results
- Sales records
- Employee records
Comply with all applicable laws and regulations, including those related to:some text
- Taxation
- Labeling and packaging
- Security
- Environmental protection
Ensure the business operates in a safe and responsible manner, prioritizing public health and safety.
Maintain the licensed premises in a clean and orderly condition, adhering to strict sanitation and hygiene standards.
Report any changes to the business, such as ownership changes or changes in operations, to the OCM within the specified timeframe.

Renewal Procedures:

These are the steps to renew a cannabis processing license in NY:

Submit a renewal application to the OCM before the expiration date of the current license, which is typically two years.
Pay required renewal fees.
Receive the renewed license if approved.

Daily Operations

Below is what cannabis processors should focus on to streamline operations and remain compliant with NY's regulations:

Standard Operating Procedures (SOPs)

As mentioned, cannabis processors are required to develop and implement comprehensive written SOPs for all aspects of processing operations, including:

Material handling and storage
Cannabis extraction methods (both solvent-based and solventless extraction)
Infusion
Formulation (such as edibles, concentrates, and tinctures)
Packaging and labeling
Quality control procedures
Facility sanitation and maintenance
Product testing
Waste management and disposal
Security protocols
Employee training procedures
Recall procedures
Document control and record-keeping
Internal audits

All employees should be thoroughly trained on and adhere to these procedures. Moreover, cannabis operators should regularly review and update SOPs to reflect changes in regulations, industry best practices, and business needs.

Record-Keeping Requirements:

Cannabis processors should also maintain detailed and accurate records of all processing activities. These are some examples:

Batch records (including inputs, outputs, and processing parameters)
Testing results (potency, purity, contaminants)
Inventory records (tracking cannabis material from receipt to finished product)
Employee training records
Maintenance records for equipment
Security logs

Plus, operators should retain those records for the timeframes specified by the OCM regulations (typically several years) and ensure they're easily accessible and auditable.

Employee Training Standards:

Cannabis processors should provide comprehensive training to all employees on key topics, such as:

Cannabis product knowledge
Safety procedures (such as chemical handling, fire safety, and personal protective equipment use)
Quality control procedures
Security protocols
Compliance with OCM regulations
Age verification procedures (if applicable)

It's important to maintain records of this training, including dates, topics covered, and employee attendance. Besides that, cannabis operators should conduct regular refresher training to ensure employees stay updated on regulations, best practices, and new product developments.

Facility Maintenance:

Cannabis processors are required to ensure processing facilities are in optimal condition to minimize contamination, maintain product integrity, prevent hazards, and meet the strictest GMP standards. Therefore, it's mandatory to:

Regularly clean and organize the processing facility, adhering to strict sanitation and hygiene standards.
Ensure the facility has proper ventilation and temperature control systems within each processing area.
Maintain and calibrate all processing equipment regularly.
Implement and maintain a pest control program.
Address any issues that require maintenance or repair promptly.

Quality Control Procedures:

As explained above, cannabis processors must implement a robust quality control program to ensure the safety, purity, and potency of all finished products. Therefore, it's important to:

Conduct rigorous testing at various stages of the processing process.
Rely on accredited testing laboratories for all required analyses.
Investigate and address any quality issues promptly through corrective and preventive actions.

Final Thoughts

GMP standards are essential for ensuring the safety, quality, and consistency of cannabis products in New York. If you adhere to these standards, you can protect public health, build consumer trust, enhance your brand reputation, and contribute to the development of a safe and thriving cannabis industry.

At Distru, we encourage all New York cannabis operators to prioritize GMP compliance. To learn more about these standards and how to implement them in your operations, please check our additional resources:

‍

Understanding GMP Standards for New York Cannabis Operators