How to Open a Cannabis Testing Lab: A Procurement and Licensing Guide

Opening a cannabis or hemp testing laboratory is a regulated-startup decision more than a lab-science one: before an instrument is ever powered on, an operator has to sequence state licensure, ISO/IEC 17025 accreditation, facility and security build-out, and a defensible capital-equipment plan correctly, or the whole timeline stalls. This guide is written for the person who actually has to make those calls — a lab manager, procurement officer, or founding administrator evaluating whether and how to open a cannabis testing lab — and focuses on the decisions that are genuinely comparable across vendors, accreditation bodies, and states: what the regulatory framework actually requires, what belongs in a real business plan, and how to evaluate equipment and accreditation options on verifiable criteria rather than marketing claims.

The regulatory foundation: state licensure, ISO/IEC 17025, and federal status

Three separate regulatory tracks converge on any cannabis or hemp testing lab, and an operator has to satisfy all three before samples can be reported for compliance purposes:

• State cannabis-testing licensure. Every US state with a legal cannabis program (medical, adult-use, or both) regulates testing labs through its own cannabis or agriculture agency — for example California’s Department of Cannabis Control, Colorado’s Marijuana Enforcement Division, or Michigan’s Cannabis Regulatory Agency — and each publishes its own license category, application process, and required test panel. Some states cap the number of testing-lab licenses issued or run periodic application windows, which makes the application calendar itself a real planning input, not a formality.
• ISO/IEC 17025 accreditation. The great majority of state cannabis-testing programs require the lab to hold, or be actively pursuing on a defined timeline, accreditation to ISO/IEC 17025 — the general international standard for the competence of testing and calibration laboratories — from an accreditation body that is a signatory to the Global ACI MRA (in the US, commonly A2LA, ANAB, or PJLA). (On 1 January 2026 the ILAC MRA and IAF MLA were merged into the single Global ACI MRA under Global Accreditation Cooperation Incorporated (Global ACI); existing accreditations and the legacy marks remain valid through the transition.) See CASRAI’s ISO/IEC 17025 guide for what the standard actually accredits and how it differs from ISO 9001. Because the accreditation body’s own site assessment typically cannot happen until the facility, instrumentation, and validated methods are in place, accreditation timing has to be planned alongside, not after, facility build-out.
• Federal controlled-substance status. Cannabis containing more than 0.3% Delta-9 THC on a dry-weight basis remains a Schedule I controlled substance under the federal Controlled Substances Act, even in states where it is legal for medical or adult-use purposes; hemp (0.3% THC or below, as defined by the 2018 Farm Bill) is not federally controlled. This distinction matters directly for licensing: some states require or permit a marijuana-testing lab to hold a DEA registration authorizing possession of a Schedule I substance for analytical purposes, in addition to state licensure, while hemp-only testing labs generally do not face that federal registration question because hemp itself is not federally scheduled. Requirements vary by state and change; confirm the current requirement directly with the state’s cannabis regulatory agency and, where a Schedule I registration may be needed, with DEA’s Diversion Control Division before finalizing a facility or business plan around an assumption either way.

Choosing your test menu and scope of accreditation

State programs typically mandate a required test panel before product can be released to a dispensary, processor, or manufacturer, and the panel drives essentially every downstream procurement decision. The categories that recur across state programs are:

• Potency (cannabinoid) testing — typically HPLC or UHPLC, reporting THC, CBD, and other cannabinoids.
• Pesticide residue testing — typically LC-MS/MS and/or GC-MS/MS, against a state-defined action-level list.
• Residual solvent testing — typically headspace GC-MS or GC-FID, relevant mainly for extracted/concentrate products.
• Heavy metals testing — typically ICP-MS, for lead, arsenic, cadmium, and mercury.
• Microbial contamination testing — culture-based plating or molecular methods such as qPCR, for pathogens like Aspergillus, Salmonella, and Shiga-toxin-producing E. coli.
• Mycotoxin testing — typically LC-MS/MS, for aflatoxins and ochratoxin A.
• Water activity, moisture, and foreign matter/filth — simpler physical and visual methods, but still part of most required panels.

CASRAI’s cannabis pesticide testing guide covers the pesticide and microbial procurement decision in more depth — instrumentation choice, reference-method selection, and the build-vs-outsource question — and the general accreditation-body evaluation approach in CASRAI’s food microbiology testing guide (written for a different regulated-testing sector, but the accreditation-body evaluation criteria carry over directly) is a useful companion read. A lab does not have to launch accredited for every category on day one in every state, but the scope statement submitted to the accreditation body and the state license application both have to match what the lab can actually validate and run reliably — scope creep between what’s licensed, what’s accredited, and what’s actually validated is one of the more common post-launch compliance problems.

Cannabis testing lab business plan: what to include

A cannabis testing lab business plan needs the same core sections as any regulated-industry lab startup plan, with the regulatory track built in rather than treated as an appendix:

• Executive summary — the license category being pursued, target state(s), and test menu scope.
• Market and demand analysis — the number of licensed cultivators/processors/dispensaries the lab would realistically serve, existing testing-lab capacity and any state-imposed cap on new testing licenses, and expected sample volume by test category.
• Regulatory and licensing plan — the specific state license category, application timeline and window, and the accreditation body and target scope statement, sequenced against each other (see the sequencing section below).
• Test menu and method-validation plan — which panels the lab will run at launch versus add later, and which reference methods (state-mandated, AOAC, or a validated in-house method) each will use.
• Facility and equipment budget — capital instrumentation, facility build-out (security, sample receiving, waste handling, HVAC), and ongoing consumables and service-contract costs.
• Staffing and quality management plan — lab director, quality manager, and analyst roles, credential requirements (often state-defined), and how the ISO/IEC 17025 quality management system will be documented and maintained.
• Financial projections and working capital — revenue per sample by test category, and a realistic runway that covers the period between opening the facility and receiving both accreditation and the state license, since neither typically issues instantly and the lab generates no reportable revenue until both are in hand.
• Risk and compliance plan — how the lab will handle proficiency-testing failures, method deviations, and regulatory audits without losing accreditation or licensure standing.

Capital equipment: what to budget for and how to evaluate vendors

Analytical instrumentation is typically the single largest capital line item in opening a cannabis testing lab, and the panel above drives the instrument list: at minimum, an HPLC/UHPLC for potency, an LC-MS/MS and/or GC-MS/MS for pesticides and mycotoxins, a GC-MS or GC-FID for residual solvents, an ICP-MS for heavy metals, and a microbiology setup (plating and/or a molecular platform) for pathogen screening. Rather than ranking specific commercial vendors — which this guide deliberately does not do, since vendor fit depends on the lab’s own validated methods, service region, and budget — evaluate any instrument or reagent supplier against the same set of verifiable criteria:

• Documented method validation support. Does the vendor provide validated application methods for the specific cannabis/hemp matrix and target analyte list the lab needs, or does the lab have to fully develop and validate the method itself?
• Calibration traceability. Are reference standards and calibration materials traceable to a recognized national metrology standard (e.g., NIST-traceable in the US) — this is a direct ISO/IEC 17025 requirement, not optional polish.
• Proficiency testing (PT) participation. Will the instrument and method combination support participation in an ISO/IEC 17043-accredited proficiency testing program for cannabis analytes? CASRAI’s proficiency testing and EQA guide covers what accredited labs actually have to demonstrate through PT, and most accreditation bodies require ongoing PT performance as a condition of maintaining scope.
• Service, support, and consumables supply chain. What is the vendor’s documented response time for service calls, and how reliable is the consumables/reagent supply chain for this specific application — an instrument that is down for weeks, or a reagent lot that’s backordered, directly threatens turnaround-time commitments to clients and licensing requirements around timely reporting.
• Total cost of ownership. Purchase price, service contract cost, consumables cost per sample, and expected instrument lifespan, not sticker price alone.
• LIMS/data-system integration. Whether the instrument’s data system integrates with the lab’s laboratory information management system (LIMS) for chain-of-custody and reporting purposes; CASRAI’s sample chain-of-custody guide covers what documentation an accreditation body and state auditor will expect to see end-to-end from sample receipt to report.

Facility, security, and waste-disposal requirements

Because a cannabis testing lab takes physical possession of a controlled or state-regulated product, most state programs impose facility requirements beyond generic lab build-out: video surveillance and access-control/alarm systems covering areas where product samples are stored or handled, a documented and secure chain of custody from sample receipt through disposal, and defined waste-destruction procedures — many states require cannabis waste to be rendered unusable and unrecognizable before disposal, often through a documented process involving a licensed waste hauler. Separately from security, the facility itself needs adequate space to physically separate sample receiving, wet chemistry, instrumentation, and microbiology work, plus HVAC/ventilation sized for both odor control and instrument environmental requirements (temperature and humidity stability matter for HPLC/GC/MS precision). Confirm the specific security and waste requirements with the target state’s cannabis regulatory agency early — they directly shape the facility lease and build-out budget, and retrofitting security infrastructure after a lease is signed is materially more expensive than designing it in.

Staffing and the quality management system

State programs commonly define minimum credential requirements for the lab director role (frequently an advanced degree in chemistry, biology, or a related science plus documented relevant laboratory experience) and may separately require a designated quality manager role, distinct from the lab director, responsible for the ISO/IEC 17025 quality management system. That system — document control, internal audits, management review, corrective and preventive action, measurement uncertainty, and proficiency-testing tracking — has to exist in a real, auditable form before the accreditation body’s assessment, not be assembled retroactively; building it in parallel with facility and equipment procurement, rather than after, is the difference between a smooth accreditation assessment and a failed one that delays the state license behind it.

Sequencing: what typically has to happen in what order

The exact sequence and timeline are state-specific and can run to many months given accreditation-body assessment queues and state application windows, but the general dependency order that recurs across states is: confirm the target state’s license category, application window, and any license cap; build out the facility to meet both state and accreditation site-assessment requirements; validate methods and document the quality management system; apply for ISO/IEC 17025 accreditation (or document active pursuit, if the state allows a conditional license pending accreditation); apply for the state testing license; obtain DEA registration if the state’s marijuana-testing framework requires it; and begin ongoing proficiency-testing participation once accredited. Treating accreditation and state licensure as sequential rather than parallel processes — assuming the state license can be secured first and accreditation “added later” — is one of the more common planning mistakes, since most states require accreditation (in hand or actively underway on a defined timeline) as a condition of the license itself.

Frequently asked questions

How much does it cost to open a cannabis testing lab?

There is no single verifiable figure, since cost depends heavily on the state’s required test menu, facility lease and build-out costs in that market, and whether instrumentation is purchased or leased. The major cost categories are consistent across states, though: capital analytical instrumentation (typically the largest single category), facility build-out including security and waste-handling infrastructure, ISO/IEC 17025 accreditation fees and the site assessment, state licensing fees, staffing, and working capital to cover the period before accreditation and licensure are both in hand and the lab can generate reportable revenue. Build the budget from the equipment and facility sections above against the specific target state’s requirements rather than relying on a generic industry figure.

Do cannabis testing labs need DEA registration?

It depends on what the lab tests and the state’s specific framework. Because cannabis above 0.3% THC remains a federal Schedule I controlled substance, some states require or permit a marijuana-testing lab to hold a DEA registration for Schedule I analytical possession in addition to state licensure. Hemp-only testing labs (testing product at or below the 0.3% THC threshold defined by the 2018 Farm Bill) generally do not face this federal registration question, since hemp itself is not federally scheduled. Confirm the current requirement with the target state’s cannabis regulatory agency and, if a Schedule I registration may apply, with DEA’s Diversion Control Division.

What accreditation does a cannabis testing lab need?

Nearly all state cannabis-testing programs require ISO/IEC 17025 accreditation (or a documented, time-bound path to it) from a Global ACI MRA (formerly ILAC MRA) signatory accreditation body, with a scope statement that specifically covers the test categories — potency, pesticides, residual solvents, heavy metals, microbials, mycotoxins — the lab intends to report on. See CASRAI’s ISO/IEC 17025 guide for what the standard accredits and how it differs from a certification like ISO 9001.

What should a cannabis testing lab business plan include?

At minimum: an executive summary naming the target state and license category, a market/demand analysis grounded in that state’s actual licensed cultivator/processor/dispensary count, a regulatory and licensing plan that sequences state licensure against ISO/IEC 17025 accreditation, a test-menu and method-validation plan, a facility and equipment budget, a staffing and quality-management plan, financial projections that account for the pre-revenue accreditation/licensing period, and a compliance risk plan. See the dedicated business-plan section above for the full breakdown.

How long does it take to get a cannabis testing lab licensed?

There is no fixed, verifiable timeline — it depends on the state’s application-review capacity, the accreditation body’s site-assessment queue, and whether the state allows a conditional license pending accreditation versus requiring accreditation in hand first. Realistic planning treats this as a multi-month process at minimum, with facility build-out, method validation, and quality-system documentation running in parallel with (not after) the accreditation and licensing applications.