Cannabis Testing Requirements: A Procurement and Compliance Guide

Cannabis and hemp testing requirements are not a single national standard — they are a patchwork of state-level cannabis programs, a separate federal hemp framework administered by USDA, and a set of voluntary consensus standards (ISO/IEC 17025, AOAC International methods, ASTM D37, and an emerging USP cannabis compendium) that labs use to demonstrate competence within whichever regulation applies to them. For a lab manager, procurement officer, or compliance lead, the practical question is rarely “what does the law say” in the abstract — it is “which panel does my product need, which method will a regulator accept as valid, and how do I verify that a testing lab (in-house or third-party) can actually deliver defensible results.” This guide is organized around that decision.

What “cannabis testing requirements” actually cover

Nearly every state-regulated cannabis program and the federal hemp program converge on the same core set of test categories, even though the specific action limits, sampling protocols, and accepted methods differ by jurisdiction. Understanding this shared structure is the starting point for any procurement decision, because it tells you what capability a lab needs to demonstrate regardless of which state you operate in:

• Potency / cannabinoid profile — quantifying THC, THCA, CBD, CBDA and other cannabinoids, almost always by HPLC (high-performance liquid chromatography). This is the panel that determines legal classification (hemp vs. marijuana) and label claims.
• Pesticide residues — screening against a state-specific target-analyte list, typically by LC-MS/MS or GC-MS/MS given the low action limits involved.
• Heavy metals — arsenic, cadmium, lead, and mercury, typically by ICP-MS (inductively coupled plasma mass spectrometry).
• Residual solvents — relevant for extracted/concentrate products, tested by headspace GC-MS.
• Microbial contaminants — total yeast and mold, E. coli, Salmonella, and (in some states) Aspergillus species, by plating/culture or qPCR methods.
• Mycotoxins — aflatoxins and ochratoxin A, usually by LC-MS/MS, required in a subset of state programs.
• Water activity and moisture content — a proxy for microbial and mold risk in flower product, required in most programs as a pass/fail gate ahead of full microbial testing.

A related guide on this site covers the pesticide and microbial panels in procurement/method-selection depth: Cannabis Pesticide Testing: A Procurement and Method-Selection Guide.

Cannabis testing standards and methods: what regulators actually accept

Because cannabis remains a Schedule I substance federally, there is no single federal reference-method body playing the role FDA/EPA methods play for food or environmental testing. Three standards-development efforts fill that gap, and procurement decisions increasingly hinge on whether a candidate lab tracks them:

• AOAC INTERNATIONAL’s Cannabis Analytical Science Program (CASP) develops and validates standard method performance requirements (SMPRs) and first-action official methods for cannabis potency, pesticides, and other analytes — the closest thing the industry has to an AOAC Official Methods program for this matrix.
• ASTM International Committee D37 on Cannabis publishes consensus standards covering laboratory quality systems, sampling, and terminology (for example ASTM D8196 on quality management systems for cannabis testing labs), which several states reference directly in their regulations.
• USP (U.S. Pharmacopeia) has an active Cannabis Expert Panel developing quality monographs and general chapters, aimed primarily at cannabis used in medical/pharmaceutical contexts.

When evaluating a lab or a proposed in-house method, ask which of these frameworks the method is validated against, and whether the validation documentation (accuracy, precision, limit of detection/quantitation, matrix-specific recovery studies) is available for review — not just a certificate of accreditation scope.

State cannabis testing requirements: why “it depends on the state” is the correct answer

Every state that has legalized medical or adult-use cannabis operates its own regulatory testing program, run by a cannabis control agency (for example California’s Department of Cannabis Control, Colorado’s Marijuana Enforcement Division, Massachusetts’s Cannabis Control Commission, Michigan’s Cannabis Regulatory Agency, or Oregon’s Health Authority/Liquor and Cannabis Commission). Each publishes its own required test battery, action limits, sampling protocol, and list of state-certified or state-licensed laboratories. There is no reciprocity: a lab accredited and licensed to test cannabis in one state generally cannot rely on that status to test product in another state without separately meeting that state’s licensing and accreditation requirements.

Because tracking every state’s specific limits is a moving target, the Association of Food and Drug Officials (AFDO) maintains a “Laboratory Guidance for Cannabis” resource hub aggregating state regulations, proficiency-testing programs, and accreditation requirements — a useful starting point for a multi-state operator or a procurement team benchmarking a vendor’s compliance coverage across jurisdictions, rather than treating any single state’s rule as universal.

Practical procurement implication: if you operate (or are sourcing product/testing) across more than one state, confirm accreditation and licensure separately for each state your supply chain touches — don’t assume a lab’s home-state credential travels.

Hemp testing requirements: the federal layer

Hemp is regulated differently from marijuana because the 2018 Agriculture Improvement Act (the “2018 Farm Bill”) removed hemp — cannabis with a delta-9 THC concentration of no more than 0.3% on a dry-weight basis — from the Controlled Substances Act’s definition of marijuana and gave USDA regulatory authority over hemp production. USDA’s implementing regulations (finalized as part of its hemp production rule) require pre-harvest compliance testing that measures total THC — delta-9 THC plus THCA converted at a 0.877 factor (THCA has a molecular weight that yields roughly 87.7% as much delta-9 THC when decarboxylated) — rather than delta-9 THC alone, because THCA converts to delta-9 THC when heated. USDA’s rule has historically required this compliance testing to be performed by a laboratory registered with the Drug Enforcement Administration (DEA), reflecting hemp’s legal status as a controlled substance until it clears the compliance threshold.

For a procurement team, the practical takeaway is that hemp compliance testing and cannabis (marijuana) state-program testing are governed by different authorities with different lab-qualification requirements — a lab’s state cannabis license does not automatically qualify it to run USDA-compliant hemp pre-harvest testing, and vice versa. Confirm current DEA-registration and USDA-approval status directly against USDA’s published hemp program materials before contracting, since specific procedural requirements are refined periodically.

Accreditation: why ISO/IEC 17025 is the baseline procurement filter

Regardless of which state or federal program applies, the near-universal requirement across cannabis regulatory programs is that a testing laboratory hold accreditation to ISO/IEC 17025, the international general standard for the competence of testing and calibration laboratories, from an accreditation body operating under the framework of ILAC (the International Laboratory Accreditation Cooperation). In the U.S., the accreditors most commonly recognized by state cannabis programs are ANAB (the ANSI National Accreditation Board) and A2LA, with some states also referencing NELAC/TNI frameworks originally built for environmental testing.

ISO/IEC 17025 accreditation is scope-specific: a lab is accredited for particular test methods on particular matrices, not “accredited” as a blanket status. When evaluating a vendor, request the lab’s current scope of accreditation document and confirm it explicitly lists the cannabis/hemp matrix and the specific test methods (potency, pesticides, heavy metals, residual solvents, microbials, mycotoxins) relevant to your product — a lab can be validly ISO/IEC 17025-accredited for an unrelated matrix while having no accredited scope covering cannabis at all.

Vendor and lab evaluation checklist for procurement

Whether you are contracting a third-party testing lab or validating an in-house QC function, the following are the verifiable, non-marketing criteria that map directly onto the regulatory requirements above:

• Current accreditation certificate and scope document naming the accreditor (ANAB, A2LA, or state equivalent), the ISO/IEC 17025 revision (2017 is current), and the specific cannabis/hemp analytes and methods covered.
• State licensure status in every state where the lab will report results, verified directly against that state’s public list of licensed/certified cannabis testing labs rather than taking the vendor’s word for it.
• Proficiency testing (PT) participation and results — regular, documented participation in a recognized interlaboratory PT/round-robin program for each accredited analyte, with a track record of passing results, not just enrollment.
• Method validation documentation for each panel — limit of detection/quantitation, accuracy, precision, and matrix-specific recovery data, referenced against AOAC CASP, ASTM D37, or an equivalent framework.
• Chain-of-custody and sampling procedures — documented, auditable sample handling from collection through disposal, since a compliance test result is only defensible if custody is unbroken.
• Turnaround time and capacity — realistic committed turnaround under normal and surge volume, and what happens (retest policy, cost) on a presumptive failure.
• Data management and LIMS integration — how results are transmitted, whether the lab’s laboratory information management system supports the state’s mandated track-and-trace/reporting integration (for example a state seed-to-sale system), and how raw data and certificates of analysis are archived and retrievable for audit.

None of these criteria depend on taking a vendor’s marketing claims at face value — each is a document or a public record you can request and independently verify before signing a contract.

In-house testing capability vs. third-party contract lab

The build-vs-buy decision for cannabis/hemp testing turns on volume, capital budget, and regulatory exposure rather than a universal answer:

• Third-party contract testing avoids the capital cost of chromatography/mass-spec instrumentation and the overhead of maintaining ISO/IEC 17025 accreditation in-house, at the cost of turnaround-time dependency on an external lab and less direct control over method changes.
• In-house testing makes sense at higher volumes where instrument utilization justifies the capital and staffing cost, and where turnaround-time control is a competitive factor — but it means the operation itself must obtain and maintain state licensure and ISO/IEC 17025 accreditation, participate in proficiency testing, and carry the compliance burden a third-party lab would otherwise absorb.
• Hybrid models — in-house testing for internal process control and release decisions, with periodic third-party confirmatory testing — are common where regulations require the compliance/regulatory result to come from an independently accredited lab even if the operation runs its own QC in parallel.

Frequently asked questions

What are the hemp testing requirements at the federal level?

Federal hemp testing requirements flow from the 2018 Farm Bill’s definition of hemp as cannabis with no more than 0.3% delta-9 THC on a dry-weight basis, implemented through USDA’s hemp production regulations. Compliance testing measures total THC (delta-9 THC plus THCA at a 0.877 conversion factor), and has historically required use of a DEA-registered laboratory. Always confirm current procedural detail against USDA’s published hemp program materials, since specific requirements are periodically revised.

What are cannabis testing standards, as opposed to regulations?

“Standards” refers to the voluntary consensus method and quality-system frameworks — AOAC INTERNATIONAL’s Cannabis Analytical Science Program, ASTM International’s Committee D37, USP’s Cannabis Expert Panel, and ISO/IEC 17025 for laboratory competence — that labs use to validate methods and demonstrate quality management. “Regulations” are the specific, legally binding state or federal rules (action limits, required panels, licensure) that reference or require conformance to those standards.

What cannabis testing methods are used for each required panel?

Potency/cannabinoid profiling is typically run by HPLC; pesticide residues and mycotoxins by LC-MS/MS or GC-MS/MS; heavy metals by ICP-MS; residual solvents by headspace GC-MS; and microbial contaminants by culture/plating methods or qPCR. The specific validated method a lab uses should be referenced against AOAC CASP, ASTM D37, or an equivalent validated framework, and confirmed against the target state’s accepted-methods list.

Where do state cannabis testing requirements differ most?

States differ most in their specific action limits (particularly for pesticides and heavy metals), which analytes are on the required target list, whether mycotoxin and terpene testing are mandatory or optional, sampling protocol (batch size, number of samples), and which accreditation bodies and PT programs they recognize. There is no interstate reciprocity for lab licensure, so a multi-state operator or buyer needs to verify credentials separately in each state.

Is ISO/IEC 17025 accreditation legally required for cannabis testing labs?

In the large majority of state cannabis programs, yes — state licensure for a cannabis testing laboratory is generally conditioned on holding (or obtaining within a defined window) ISO/IEC 17025 accreditation from a recognized accreditation body, with a scope that explicitly covers the cannabis/hemp matrix and the required test methods. Confirm the specific requirement and any transition timelines directly against the regulations of the state in question.

Related CASRAI resources

• Cannabis Pesticide Testing: A Procurement and Method-Selection Guide — deeper procurement/method-selection detail on the pesticide and microbial panels.
• What Is ANAB? ANSI National Accreditation Board Explained — the accreditation body most commonly recognized by state cannabis testing programs.
• NELAC (National Environmental Laboratory Accreditation Conference) — the environmental-testing accreditation framework some states reference for cannabis labs.
• IQ/OQ/PQ (Installation, Operational, and Performance Qualification) — the equipment-qualification framework relevant to validating chromatography and mass-spec instrumentation used in cannabis testing.