Skip to main content
Cannabis Facility Build Guide

GMP and GACP Cannabis Production Consultants: Pharma-Grade Certification

By September 19, 2026No Comments

GMP & GACP Cannabis Consultants — Navigating Pharma-Grade Certification

Key takeaways

  • Part of the industry is already federally rescheduled: an April 28, 2026 final rule placed FDA-approved cannabis drug products and state-licensed medical cannabis in Schedule III, while the broader cannabis rulemaking is still undecided.
  • GACP governs everything up to and including primary drying; cGMP governs everything after it. Mixing the two in one quality system is the fastest way to fail an audit.
  • FDA does not hand out cGMP certificates. It inspects, classifies the inspection, and issues cGMP declarations to foreign regulators for export — so "FDA cGMP certified" is a claim no US operator can truthfully make.
  • Ph. Eur. monograph 3028 sets hard numbers for medicinal flower: loss on drying at a maximum of 12.0 per cent, total CBN at a maximum of 1.0 per cent, lead at 0.5 ppm, and no seeds at all.
  • Certification is won in the documentation and the validation record long before the auditor arrives — master manufacturing records, batch production records, CAPA, and IQ/OQ/PQ on every piece of equipment.

Federal cannabis policy stopped being a forecast on April 28, 2026. On that day the Drug Enforcement Administration published a final rule placing FDA-approved drug products containing cannabis, and cannabis handled under a qualifying state medical licence, into Schedule III of the Controlled Substances Act. The same agency issued a notice of hearing on the much larger question — whether cannabis generally moves from Schedule I to Schedule III — and that question is still open. Two facts follow from this split, and they now set the agenda for the GMP and GACP cannabis consultants working across the United States: a slice of the industry is already inside the federal pharmaceutical perimeter, and the rest is standing at the door.

Being inside that perimeter is expensive and it is also the point. Internal Revenue Code Section 280E applies only to trafficking in Schedule I and Schedule II controlled substances, so the categories moved in April fall outside it. The Marijuana Policy Project puts the effective federal rate that 280E has been producing at 70 per cent or higher, against a 21 per cent corporate rate for an ordinary business, and a swing of that size changes what a facility can afford to build. What it does not change is the standard of evidence. Federal tax treatment, federal banking relationships and institutional capital all arrive attached to the assumption that the operation behind them can survive an inspection, and a state cultivation licence has never been evidence of that.

The scale of the gap is easy to state. CRB Monitor counted 36,169 active cannabis business licences in the United States at the end of the first quarter of 2026 — 14,671 in cultivation, 5,143 in manufacturing and processing, 11,459 in retail — and that total has now fallen for seven consecutive quarters. Almost none of those licences sit on top of a pharmaceutical quality system. Closing that distance is what GMP and GACP cannabis consultants are hired to do: audit the facility as an inspector would, rebuild the standard operating procedures, qualify the equipment, and get the documentation into a state where it can be handed to a regulator without a covering explanation.

Where rescheduling actually stands

The single most common error in current compliance planning is treating rescheduling as one event that either has or has not happened. It is two proceedings, moving at different speeds, and they carry different consequences.

The first is finished. The April 28, 2026 final rule is narrow and specific: FDA-approved medical products containing cannabis, and cannabis products regulated under a state medical cannabis licence, are in Schedule III. For operators inside those two categories, 280E no longer applies, because 280E reaches only Schedule I and Schedule II substances. That is real money, available now, and it is the reason a medical-licensed operator should be talking to a tax advisor about prior-period positions rather than waiting for further news.

The second is not finished. The broader proposal to move cannabis itself from Schedule I to Schedule III went to an eleven-day administrative hearing before the agency's Chief Administrative Law Judge, concluding on July 15, 2026, with post-hearing briefs due on August 17, 2026. A recommended decision from the judge follows, then twenty days for the parties to file exceptions, then a final ruling from the Administrator — who is not bound by the recommendation, and whose ruling is itself open to judicial review. Anyone building a 2027 budget on the assumption that adult-use operations are about to escape 280E is budgeting on a coin toss.

Section 280E applies only to Schedule I and Schedule II substances. The categories rescheduled in April 2026 fall outside it. Everything else does not.Internal Revenue Code § 280E, read against the DEA final rule of April 28, 2026

There is a second correction worth making early, because it appears throughout consulting marketing and it is wrong. FDA does not certify facilities as cGMP compliant. There is no certificate, no registry, and no seal. What FDA does is inspect, classify the outcome of that inspection, and — on request from an establishment whose most recent inspection was acceptable and which already holds a valid Certificate of Pharmaceutical Product — issue a cGMP declaration directly to a named foreign regulator. Compliance is a status observed at inspection, not a credential held between inspections. Any consultant promising FDA cGMP certification is selling something that does not exist, and that is a useful filter to apply before signing an engagement letter.

GACP and cGMP: farm versus facility

Expanding operators fail here more often than anywhere else, and the failure is almost always the same one: an agricultural quality system stretched to cover a manufacturing process it was never written for.

GACP → cGMP · where one standard stops
The handover point is primary drying
GACP — agricultural
Everything up to and including primary drying
Soil & substrate Irrigation water purity Seed & clone traceability Worker harvest hygiene Light, temp, VPD, CO₂ Primary drying
Handover — primary drying
cGMP — manufacturing
Everything after primary drying
Extraction Winterisation & distillation Cleanrooms & pressure cascade HVAC & HEPA filtration IQ / OQ / PQ equipment qualification Packaging & batch release
Two standards, two documentation sets cannacribs.org
The handover point is primary drying. Everything upstream of it is agricultural practice; everything downstream is pharmaceutical manufacturing, and the two need separate documentation sets.

What GACP actually covers

Good Agricultural and Collection Practice governs raw agricultural inputs, field and room management, and the harvest itself. In Europe the governing text is the EMA guideline on good agricultural and collection practice for starting materials of herbal origin, reference EMA/HMPC/246816/2005. It reached Revision 1 on 12 August 2025. That revision matters to this industry specifically: it was updated to account for indoor growing technology that did not exist when the original 2006 guideline was written. The scope runs to soil and substrate quality, irrigation water purity, seed and clone traceability, worker hygiene at harvest, and the primary drying environment. The objective behind all of it is contamination that arrives from outside the plant: heavy metals taken up from the growing medium, pesticide residues, and mycotoxins produced in a drying room that held humidity a few points too high for a few hours too long.

Whether the site is a greenhouse or a fully sealed indoor room, GACP expects homogeneous control of the environment — light, temperature, vapour pressure deficit, CO₂ — for a reason that growers sometimes miss. The point is not plant health on its own. It is batch-to-batch repeatability of the chemical profile, because a medicinal product with a cannabinoid content that drifts between harvests is a product that cannot be prescribed against a fixed specification. Uniformity is a compliance parameter here, not an agronomic preference.

Where cGMP takes over

Current Good Manufacturing Practice governs post-harvest processing, extraction, refining, cleanroom operations and final packaging. The controls are different in kind, not merely in strictness: positive-pressure cleanroom environments, differential pressure between adjacent zones, HEPA filtration on the air handling, formal qualification of every piece of equipment, and validated packaging lines. The objective is identity, strength, purity and consistency in the finished product, with cross-contamination prevented by the physical design of the building rather than by procedure alone.

The chain-of-custody principle between the two is worth stating precisely, because it is frequently overstated. Under EudraLex, herbal starting material used in EU-GMP manufacture must come from cultivation run to GACP — GACP is the mandatory floor for market access, and a manufacturer cannot substitute its own quality system for the grower's. In the United States there is no equivalent blanket prohibition on paper yet. The practical consequence is identical anyway: a domestic processor that cannot document the agricultural provenance of its input biomass has no defensible answer when an inspector asks where the material came from, and no route into the European market at all.

The certification spectrum

Which standard applies is decided by what the operation makes and where it intends to sell it, not by ambition. A tier above the one the business needs costs money and opens no market.

The four tiers, what each one governs, and the text that governs it.
Standard Regulatory scope Governing text Key operational controls
GACP Cultivation, harvest and primary drying EMA/HMPC/246816/2005 Rev. 1 Soil, substrate and water testing; harvest sanitation; drying control; seed and clone traceability
cGMP — 21 CFR Part 111 Dietary supplement manufacturing, packaging, labelling and holding 21 CFR Part 111 Sanitation, raw material identity verification, master manufacturing records, batch testing, equipment qualification
cGMP — 21 CFR Parts 210 and 211 Finished pharmaceuticals, including a Schedule III drug product 21 CFR Parts 210, 211 Process validation, classified cleanrooms, active pharmaceutical ingredient controls, independent quality unit
EU-GMP Manufacture and export of medicinal products into the European Union EudraLex Volume 4, including Annex 1 Sterile-grade cleanroom design, qualified person and in-house testing staff, full IQ/OQ/PQ validation, three-yearly certificate

Part 111 deserves a note, because the way it is usually described in this industry is misleading. It is the dietary supplement rule, and cannabis is not a lawful dietary ingredient under the Federal Food, Drug, and Cosmetic Act. An operator who runs to Part 111 is therefore adopting a recognised quality framework voluntarily, not satisfying a legal classification. That is still worth doing. It builds the documentation habits, the identity-verification discipline and the batch records that Parts 210 and 211 will later demand. What it needs is an accurate internal description, so that nobody on the commercial team starts telling customers the products are federally compliant supplements.

Timelines are where consulting proposals get least honest, so here is one figure with a name attached to it. GrowerIQ's 2026 EU-GMP guide puts the total span from gap analysis to certificate at twelve to twenty-four months for a facility with no prior pharmaceutical GMP history, of which the gap analysis itself is roughly a month and remediation is anywhere from three to eighteen. The inspection at the end runs three to five days. The certificate, once granted, lasts three years. We have deliberately left capital cost out of the table above: the figures circulating in the market are not traceable to any published source, they swing by a factor of ten with the condition of the building, and quoting them would be guesswork dressed as data. The place to put a real number on it is your own financial model, built against the building you actually have.

The European Pharmacopoeia, Ph. Eur. 3028

For anyone targeting European export or supplying medical active pharmaceutical ingredients, the European Pharmacopoeia is not guidance. Monograph 3028, published by the EDQM and carried in Supplement 11.5 as 07/2024:3028, sets legally binding quality thresholds for cannabis flower across the states party to the Convention.

The monograph begins by splitting medicinal flower into three chemotypes on dry-weight cannabinoid content, and the definitions are narrow. A THC-dominant type carries a minimum of 5.0 per cent THC and a maximum of 1.0 per cent CBD. An intermediate type carries a minimum of 1.0 per cent of each, with a THC to CBD ratio between 0.2 and 5.0. A CBD-dominant type inverts the first: a maximum of 1.0 per cent THC and a minimum of 5.0 per cent CBD. A batch that lands between two of these definitions does not belong to whichever is closer. It belongs to neither, and it cannot be released against the monograph at all.

The purity limits that decide a release

The numbers below are the ones that most often catch an operation that has been producing perfectly saleable recreational flower for years. Loss on drying is capped at a maximum of 12.0 per cent, measured at 40 °C over twenty-four hours — which is a moisture target, a microbial control and a drying-room design constraint at the same time. Total cannabinol is capped at a maximum of 1.0 per cent, and that one is quietly brutal, because CBN accumulates through oxidative degradation during storage. A batch can pass on the day it is packed and fail four months later in a warehouse that was never built to hold pharmaceutical stock.

Foreign matter is limited to a maximum of 2 per cent, and for material going into medicinal products the monograph is stricter still: no seeds, and leaves not exceeding 1.0 cm. Heavy metals are tested under general chapter 2.4.27, with limits for medicinal products of 0.2 ppm arsenic, 0.3 ppm cadmium, 0.5 ppm lead and 0.1 ppm mercury. Mercury is the one most commonly forgotten in a domestic testing panel, and it is the one that most often arrives from the growing medium rather than from anything the facility did. Identity is confirmed by high-performance thin-layer chromatography with vanillin detection, and the cannabinoid profile by liquid chromatography against defined retention times and resolution requirements.

None of this is exotic analytical work. It is, however, a different testing programme from the one a state regulator requires, run at a different frequency, against a specification that was written to be defended rather than to be passed. Building the drying and storage environment that keeps CBN under 1.0 per cent through a product's shelf life is a facility engineering problem, and it is cheaper to solve at design stage than to retrofit after a failed release.

Cleanroom and facility engineering

Facility work filmed across commercial builds for CannaCribs, multi-state operators among them, shows the same pattern every time. The conversion from industrial real estate to pharmaceutical-grade space is decided by the building envelope and the air. That happens long before anyone specifies a piece of processing equipment, and in practice earlier still: an export-grade build either has room to happen at site selection or it does not.

The three structural decisions

Differential pressure zoning comes first. Cleanrooms are run at cascading positive pressure so that when a door opens, air moves outward from the cleaner space into the less clean one and carries particulate with it. Get the cascade backwards, or leave one room neutral, and every door opening becomes an unlogged contamination event that no procedure will catch. Second is the air handling itself: multi-stage units with high-efficiency particulate air filtration, holding humidity setpoints tightly enough that fungal spores have nowhere to establish. Third is the finish. Non-porous epoxy floor coatings, coved junctions where wall meets floor, and flush doors exist so that chemical sanitisation actually reaches every surface — a square internal corner is where biofilm lives, and it cannot be cleaned out with more effort.

Our commercial facility design breakdown walks through how these decisions interact with room sizing and post-harvest flow, and the site design stage of the build guide covers the layout and biosecurity zoning that has to be settled before the cleanroom shell is specified at all.

Equipment qualification: IQ, OQ, PQ

cGMP does not permit unvalidated or undocumented second-hand processing equipment, and the qualification sequence is not paperwork generated after installation. Installation Qualification verifies that the equipment was delivered, mounted, wired and plumbed to the manufacturer's specification and the engineering drawings. Operational Qualification tests and records that it runs inside defined parameters — thermal stability, pressure tolerance, pump speed. Performance Qualification demonstrates that it produces compliant batches repeatedly under normal commercial conditions, which is the only one of the three that can fail for reasons nobody anticipated. Budget for that. A used extraction skid bought at auction with no documentation history is not a saving; it is an IQ that has to be reconstructed from first principles by someone billing by the hour. It is the same instinct behind commissioning and SOP implementation — prove every system performs as designed before anything of value depends on it — carried up to a pharmaceutical standard of evidence.

The five-step consulting and audit roadmap

Turning a live commercial facility into a certified operation without stopping production is a sequencing problem. These five steps run in sequence because each one produces the input the next one needs.

GMP & GACP cannabis production consultants
The five-step certification roadmap
1
Baseline gap audit
Facility and SOP inspection as an inspector would run it — air turnover, drainage, finishes, traffic flow. Output: a deficit list with owners and dates.
2
Remediation & document control
Master Manufacturing Records, Batch Production Records, and CAPA. Skipping this step is why step five fails.
3
Retrofits & equipment validation
Cleanroom panels, epoxy floors, HEPA air handling — then IQ, OQ and PQ on every extraction, winterisation and distillation system.
4
Quality unit & mock audits
An independent QA unit with sole authority to reject, then simulated inspections testing staff interviews and a two-hour batch recall.
5
Certification audit & continuous compliance
An accredited registrar audits the site. Afterwards an internal audit calendar holds it there — certification is a photograph, compliance is the film.
Each step produces the evidence the next one consumes cannacribs.org
Each step produces the evidence the next one consumes. Skipping step two is why step five fails.

How the five steps run

  1. Baseline gap audit. A physical and operational inspection of the site as an inspector would conduct it: air turnover rates, floor drainage, wall and ceiling finishes, personnel and material traffic flows, and every existing standard operating procedure read against the standard the business is targeting. The output is a deficit list with owners and dates against it.
  2. Remediation and document control. Master Manufacturing Records fix the formula and the processing steps for every product. Batch Production Records give step-by-step traceability from input biomass to packaged goods for each individual batch. Corrective and Preventive Action protocols turn a deviation into an investigation with a closing signature rather than a note in a shift log.
  3. Retrofits and equipment qualification. Cleanroom panels, epoxy flooring and HEPA-equipped air handling go in, and IQ, OQ and PQ are completed on every extraction, winterisation and distillation system. This is the step that takes the schedule hostage if the building survey in step one was superficial.
  4. Quality unit and mock audits. An independent Quality Assurance unit is designated with sole authority to accept or reject raw materials, packaging components and finished batches — sole authority meaning it cannot be overruled by production or by the commercial side. Simulated inspections then test staff interview readiness, document retrieval speed and the ability to reconstruct a batch recall inside two hours.
  5. Certification audit and continuous compliance. An accredited registrar performs the formal audit. Afterwards, an internal audit calendar keeps the site in the state the auditor found it in, which is the part most operations underestimate — certification is a photograph, and compliance is the film.

Step four is where most engagements discover their real problem. A quality unit that reports to the chief operating officer is not independent, and an auditor will identify that inside the first hour of interviews. Resolving it is an organisational decision rather than a technical one, and it usually has to be made by whoever owns the business. Raise it in step one, not in step four.

What pharma-grade compliance is worth

The commercial case for this work is real, and it is also frequently argued with numbers that do not survive contact with a source. Here is the version that does.

Three things are true at once. The first is that 280E relief for the rescheduled medical categories is already in effect, which means the compliance argument no longer depends on a future ruling — it is a current tax position for operators inside those categories. The second is that EU market access is closed without EU-GMP and closed without GACP behind it, so the certificate is not a differentiator in that channel but the entry condition. The third is that pharmaceutical supply relationships are contractual and long, which is a different business model from wholesale flower and values a producer on audit history rather than on this quarter's price.

Against that, an honest caveat, and it is the one we give clients before they commit capital. Certification does not create demand. A facility can complete a flawless EU-GMP build and still have no offtake agreement, and the industry has examples of exactly that. The licence-count trend makes the point from the other direction: 36,169 active licences at the end of Q1 2026, falling for seven straight quarters, is a market consolidating rather than expanding. Compliance is a way of choosing which side of that consolidation an operation ends up on. It is not a substitute for having a customer.

You will also want to read this alongside the audit-ready facility guide, which covers track-and-trace, batch release and the quality culture side of the same problem, and the full facility build guide if the decision in front of you is still whether to build at all. If you want this assessed against your own building rather than in the abstract, our GMP and GACP cannabis consultants run baseline gap audits, draft the MMR and BPR documentation set, and engineer the retrofits. The fastest way to start is to send us your floor plan and your target markets.

References and regulatory resources

Every figure in this article traces to one of the sources below. Where a claim could not be traced, it was left out.