Business Management

Navigating Regulations in the Cannabis Industry: Hitting a Moving Target

Navigating Regulations in the Cannabis Industry: Hitting a Moving Target

Knowledge of local laws and adhering to compliance procedures help ensure best practices

The cannabis industry offers a wealth of opportunities for those who understand the challenges.The landscape is varied and constantly changing, with some states having established legal frameworks and other states still evolving. The cultivation, processing, testing, and dispensary sides of the industry each come with state and local regulations that vary by location and municipality. 

Proper licensing and compliance of testing laboratories require significant monetary investments and careful planning in brokering the best chances at success. A sound management plan for any cannabis business should involve research to understand the regulations, proper finances to navigate the costs, and steadfast compliance to mitigate the challenges of maintaining a legal operation. 

Federal regulation of cannabis 

Although cannabis remains illegal at the federal level, a total of 33 states, the District of Columbia, Guam, Puerto Rico, and the US Virgin Islands have approved comprehensive medical marijuana programs. Of these, 14 states and territories have approved adult-use cannabis and an additional 13 states allow use of “low THC, high CBD (cannabidiol)” cannabis for medical reasons. 

The 2018 Farm Bill legalized the cultivation and production of hemp in the US. Among the regulations comes a legal requirement of less than 0.3 percent THC in hemp over the entire production chain, from cultivation and processing to sales and transportation. The USDA has accepted proposed regulated plans from 14 states and 17 tribal communities—numbers that will undoubtedly grow as the USDA’s program continues to expand. 

Although legal parameters have been set in place at the state and—in the case of hemp—at the federal level, regulatory measures around licensing and testing are still somewhat fluid. Firm knowledge of current regulations and awareness of changing policies are absolute necessities to ensure a testing lab achieves and maintains compliance. 

State regulations 

Each state has distinct regulatory requirements, which include processes for licensure, operations, and regulatory enforcement. State laws are put into motion in the wake of federal policy changes, ballot initiatives, and state policy updates. As a result, each state has a roll-out plan and regulatory processes that are unique, with the possibility of adjustments due to changes in policy. The availability and type of licenses is also specific for a given state or territory. If a license is approved, it often comes with conditions regarding where the cannabis testing business can physically operate and details regarding adherence to local regulations. 

State regulatory bodies oversee the implementation of licenses and administration of laws governing access. As an example, Massachusetts enlists the Cannabis Control Commission to oversee the state legal medical and adult use cannabis program. The Cannabis Advisory Board makes recommendations to the control commission regarding regulation and taxation matters. The board consists of various representatives from state services, manufacturing, dispensary sales, laboratory testing, and others with vested interest in cannabis regulatory and commercial matters.

Subcommittees are enacted to advise and develop recommendations on cultivation, processing, manufacturing, transportation, distribution, seed-to-sale tracking, and market stability, among other areas. Together, these entities have the power to enforce the laws and suggest amendments based on the success of operations and regulations, and reflecting changes to public will and market demands. 

Local regulations

During license approval, a cannabis business must also execute an agreement with the local municipality in which it chooses to conduct operations. Upon permission of such business, the municipality will govern the conditions set forth by the local operating agreement. These include: observance of municipal ordinances, enforcements and fines, local taxation, community impact fees, operating fees, and other details. Such cannabis establishments are subject to local zoning and code regulations as well. 

The processes for applying for licensure, renewal, and the costs associated with operating a licensed business can be extensive. Research to understand the governing bodies, the details of state and local regulation, and knowledge of the fees is essential in any management plan. Securing excess capital will not only cover license and operating fees, but will support a financial contingency plan to deal with compliance and enforcement issues. The ability to handle changes in regulations and market fluctuations is good general business management. 

Once licensed, third-party cannabis testing labs must operate under state testing guidelines. Each state is different with respect to testing criteria and enforcement practices. 

Testing standards

The creation of nationwide cannabis testing standards has been limited by the lack of federal oversight and the void in understanding which levels are safe for consumption, whether those be cannabinoids, pesticides, residual solvents, or other contaminants. Until this point, state regulators have deferred to resources such as United States Pharmacopeia and the American Herbal Pharmacopoeia documents in deciding on testing methods, specifications, and standards. Food testing standards set by the USDA for pesticides and heavy metals limits have been adapted by some state cannabis testing regulators. 

More recently, organizations such as the Association of Official Analytical Chemists (AOAC) have taken a prominent role in establishing testing standards through the Official Methods of Analysis program. AOAC’s Cannabis Analytical Science Program is a forum where cannabis and hemp analysis is discussed among participating labs, and standards and methods are established. The program aims to develop standard method performance requirements for cannabis and hemp based on results from working group members. Expert review panels then evaluate and deliver consensus-based First Action and Final Action Official Methods. The goal is creation of universal testing guidelines for use at the state, and ultimately, the federal levels. 

Lab accreditation

A major component of testing lab regulation is assessment of performance. While many states perform their own lab assessments, a growing number of states rely on ISO/IEC 17025 accreditation from an ILAC-recognized accreditation body. Use of these third-party assessments helps instill a high level of performance and diligence in testing lab evaluation. 

“ISO/IEC 17025 accreditation involves a range of evaluations, from organizational structure and personnel, to internal audits and management reviews,” explains Anna Williams, head of the cannabis program at A2LA, a leading internationally-recognized accreditation body providing ISO/IEC 17025 accreditation for cannabis testing laboratories. “Method validation and performance, results reporting, and measurement uncertainty are key metrics for lab performance. 

Some states, such as Maryland, require ISO/IEC 17025 accreditation for testing laboratories providing testing on cannabis. They will provide a provisional or temporary license to allow the laboratory to begin testing for clients while they work on obtaining initial accreditation. Other states, such as Massachusetts, require ISO/IEC 17025 accreditation to be obtained prior to being licensed to test cannabis. There are also some states, such as Oregon, who maintain their own state-run oversight programs.”

Proficiency testing

Many labs perform proficiency testing using well-established protocols for testing. Participation of labs around the world through Inter-Laboratory Comparison gives the laboratories a way to demonstrate their competence and gives their customers confidence in the accuracy of results generated by the laboratories. “ISO/IEC 17025 requires laboratories to participate in external proficiency testing or inter-laboratory comparisons. We have come a long way in this industry and there are now several external proficiency testing providers for cannabis laboratories to chose from,” says Williams.

Accreditation preparation and renewal

“There are not many true performance metrics laid out in ISO/IEC 17025 when it comes to accreditation as the name of the game is to demonstrate competence to perform specific tasks. Laboratories create and comply with their own metrics laid out in their processes and procedures in order to ensure competency of staff and the test methods that they run. In order to be prepared for an assessment and check their conformance with ISO/IEC 17025 and their own processes and procedures, it is also recommended by A2LA that laboratories audit their laboratory to ISO/IEC 17025 before they are assessed by an accreditation body as this can help them to find and resolve gaps prior to an external assessment,” states Williams.

“For states that rely on ISO/IEC 17025 accreditation, they allow accreditation bodies to assess on their own cycle that is compliant with ISO/ IEC 17011. A2LA operates on a two-year cycle. After initial accreditation, there is a surveillance assessment in the second year that is used to follow up on previous deficiencies and do a management system review. A2LA then conducts a full renewal assessment the following year and continues to go on-site every other year. Sometimes, laboratories require on-site interim assessments to facilitate the addition of a new technology to their scope. This most often occurs for cannabis laboratories when a state adds additional testing requirements to their legislation,” adds Williams.

Operating a testing laboratory in an industry devoid of universal standards can be challenging, as licensing and regulatory requirements vary from state to state and can change abruptly with updates in state policies. Federal oversight will foster the creation of universal testing laboratory standards. In the meantime, best business practices include knowledge of state and local laws and strict adherence to performance and compliance procedures.