In the cannabis industry, many are unaware that rescheduling will require companies to follow the same GMP rules that all consumed products must adhere to once it is federally legal, bringing about profound change. The greatest cost of GMP compliance is often in facilities and equipment upgrades, with the latter being the main focus of this piece. And if you’re in a state with food-grade GMP requirements, know that Schedule III will mean a whole new level: pharma-grade.
Processors will feel the greatest impact of Good Manufacturing Practices (GMP) rules. Growers will primarily follow Good Agricultural & Collection Practices (GACP) rules, but if they package flowers or pre-rolls, they’ll need to be GMP-compliant too. Even retailers and transporters need to follow GMP storage and handling rules. None of this will become an issue until the DEA makes the proposed rescheduling official, but it appears that decision is not far off now.
The bottom line is anyone who produces a product that goes in or on humans and animals must comply with product safety rules centered around GMP and GACP, collectively referred to here as GMP. Think of it as the FDA’s legal teeth. And yet, of the more than 36,000 cannabis licensees in the U.S., only five are GMP “pharma-grade” FDA-certified, and they can only do research; none are allowed to sell products. This is why many of the big MSOs say they have facilities that “mirror” GMP requirements, which is what everyone should strive for right now.
GMP auditors evaluate five core elements within an organization, referred to as the five P’s: people, premises, processes, products and procedures. They do so in three levels: food, nutraceutical and pharmaceutical grades, with pharma-grade being an order of magnitude more challenging than food-grade. Note that medical-grade cannabis will require pharma-grade GMP compliance.
Cannabis has not yet been held to GMP standards because it has not been federally legal. As it becomes formally rescheduled, it will eventually have to follow the same rules as all other products. Although no firm date has been announced, businesses will likely have 18-24 months to comply once it’s formalized. Keep in mind, it can take six to 12 months or longer to complete a food-grade GMP audit. Pharma-grade operations will spend two or more years getting certified.
Technically, American processors must comply with U.S. standards; however, different states have slightly different rules, and other countries like Canada have slightly different standards. Sometimes, the standards are very different. A much more stringent European (EU) model is considered the gold standard for GMP globally and is often required for international exporting.
As the recent tainted lettuce scare in U.S. news graphically illustrates, food and product safety are serious matters. The CDC reports unsafe products cause about 130,000 hospital visits and kill more than 3,000 people annually in the U.S. alone; pets and livestock are also impacted. A major dog food line is being closed down right now because it repeatedly failed to meet FDA (animal) food safety guidelines — the ultimate penalty for companies that don’t comply with GMP.
Complying With GMP
Regulators need to ensure companies offer safe products, made in clean facilities with properly trained staff. They need to confirm products are well tested, both before and after launch, and that companies can trace, fix or recall products if a problem is discovered. GMP guidelines define and manage this framework, and cannabis is about to be regulated using these rules for the first time in the United States. The EU required GMP from the start, but just six out of 40 U.S. states have required it (California, Florida, Ohio, Maryland, Michigan and New York), and only to the most modest food-grade standards; a long way from pharma-grade.
STEP 1: The GMP “gap” assessment begins by determining where the company currently stands in compliance and what it needs to pass an audit. It’s common to begin this process entirely from scratch. Once deemed compliant after passing an official audit, they need to continue working on compliance and upgrading to the most “current” GMP standards, hence the “c” in cGMP.
STEP 2: Next, document everything as a standard operating procedure, from how equipment is chosen and ingredients are acquired to how they will make, test, store and ship products. Even how staff dress and wash up after a break must be outlined in detailed SOPs.
STEP 3: Finally, train staff to implement quality management systems that track SOPs, processes, tests and batches. While the first steps are more administrative, the last step involves a hands-on process called validation. This is where manufacturers prove, through testing, what a machine or process produces. Product validation will be featured in our next segment.
GMP expert Andrew Samann on equipment
Andrew Samann, a certified GMP consultant and co-owner of Intrepid Scientific, is a former ICH-Q7 lead who has audited pharmaceutical manufacturers on EU standards. He applies this experience to cannabis now, with more than 100 GMP engagements across North America, South America and the EU. He started our conversation by dispelling one of the most common myths with GMP equipment validation up front, stressing, “There’s no such thing as GMP-certified equipment! We’ve all seen people at trade shows ask whether equipment is pre-certified, but it’s a myth. Equipment needs to be installed to be validated — the facility’s entire operational process is validated as one unit, but only after it’s been fully built out.”
Andrew goes on to say, “This is where GMP rules won’t just impact licensees, it will impact equipment sellers too. When a buyer starts out asking about your equipment’s GMP compliance, if a seller doesn’t have good answers, or they don’t even know what IQ, OQ and PQ mean, the sale will be lost very quickly. They just go silent on you.”
Installation Qualification (IQ) confirms that a machine is built correctly, delivered and properly placed, and that it has the correct utility links, manuals and part lists. Operational Qualification (OQ) tests how the machine works; it confirms buttons, sensors and alarms work, tests upper and lower operating limits, and runs without real product materials. Performance Qualification (PQ) tests the machine in real-life conditions, using actual materials and real workers, and proves the process produces good products over time. Once an auditor ticks these three boxes, your equipment is “validated” for GMP purposes.
“No machine is GMP compliant or GMP certified on its own either,” Samann pointed out. “GMP is a property of an operation — a facility, a quality system, a trained team running a controlled process. What a machine does needs to be qualifiable, designed in, and documented so the buyer can take it through qualification inside their own GMP system.”
Samann explained, “For equipment suppliers to be GMP-ready, they need to provide buyers with specific information, like equipment and instrument specification tables, materials of construction, traceability for product-contact surfaces, and sanitary welding certifications.
“Suppliers should add IQ verification points, recommended IQ acceptance criteria, a FAT/SAT support statement, a structured risk assessment, and cleaning and maintenance guidance. In practice, it is a documentation job, not a redesign, provided the machine was engineered to be cleaned, calibrated and controlled in the first place. The honest vendor keeps the lanes separate and states each plainly: here is our conformity status, and here is our GMP documentation that supports qualification.”
Clearly, GMP will be a big hurdle for US cannabis businesses, and the time to get ready is now.
Andrew Samann is available for gap analysis and expert GMP advice at Andrew@IntrepidScientific.com.
Steve Fuhr is an extraction consultant with SciPhy Systems. For a GMP qualification-support package on SciPhy’s processing equipment, he can be reached at SteveFuhr@SciPhySystems.com.