What cGMP Certification Actually Requires
Here's what people misunderstand: cGMP isn't just about having a clean facility. It's about having documented, repeatable, auditable systems for everything that happens in that facility.
Let's break down what that actually looks like.
1. Facility Design and Environment Control
What it requires:
- Designated areas for different manufacturing stages (no cross-contamination)
- Controlled temperature and humidity in production areas
- Proper ventilation and air filtration systems
- Cleanable surfaces and equipment
- Pest control procedures
- Regular maintenance schedules for all equipment
Why it matters: Cannabinoid ingredients are sensitive. Temperature fluctuations can degrade potency. Humidity can introduce moisture that leads to microbial growth. Poor air quality can contaminate product. A cGMP facility controls these variables instead of hoping for the best.
What this means for you: If your supplier operates out of a converted warehouse with no environmental controls, they're not cGMP certified—no matter what their website says. And your product consistency will suffer for it.
2. Standard Operating Procedures (SOPs) for Everything
What it requires:
- Written procedures for every manufacturing step
- Training documentation showing employees understand the SOPs
- Deviation procedures when something goes wrong
- Version control so you know which SOP was followed for which batch
Why it matters: "We've always done it this way" isn't a system. When your team member who "just knows" how to run the extraction quits, what happens? In a cGMP facility, the SOP ensures anyone trained can execute the process consistently.
What this means for you: Consistency. When your supplier says "we run this extraction process the same way every time," cGMP means they have documentation to prove it—not just institutional memory.
3. Raw Material and Supplier Qualification
What it requires:
- Testing or certification for every raw material before use
- Approved supplier lists
- Documentation of supplier quality agreements
- Quarantine systems for incoming materials until they're verified
Why it matters: Your final product is only as good as what goes into it. cGMP facilities don't accept hemp biomass just because it showed up. They test it. They verify the supplier. They document everything.
What this means for you: When you ask "where does your hemp come from," a cGMP supplier can show you supplier qualifications, test results, and traceability documentation. Not just photos of pretty fields.
4. In-Process Controls and Testing
What it requires:
- Testing at critical points during production (not just final product)
- Documented acceptance criteria for each stage
- Investigation procedures when results fall outside specifications
- Equipment calibration and validation records
Why it matters: By the time you test the final product, it's too late to fix problems. In-process testing catches issues early—when they can still be corrected or when the batch can be stopped before more resources are wasted.
What this means for you: Your supplier isn't guessing whether the extraction went well. They're testing. And if something's wrong, they know it before the batch becomes your problem.
5. Batch Documentation and Traceability
What it requires:
- Every batch gets a unique identifier
- Complete documentation from raw materials through finished product
- Ability to trace any finished product back to its source materials
- Retention of batch records for years (usually 3-5 years minimum)
Why it matters: If there's ever a quality issue, contamination concern, or recall, you need to know exactly what happened. cGMP traceability makes that possible. Without it, you're flying blind.
What this means for you: When you get a COA for "Batch #2025-1104-CBD-001," that number means something. It connects to specific hemp lots, specific extraction runs, specific testing results. You have a paper trail.
6. Quality Control and Quality Assurance
What it requires:
- Independent QC/QA function (not just production staff checking their own work)
- Review and approval of all batch records before product is released
- Investigation of deviations and out-of-specification results
- Trending analysis to identify patterns before they become problems
Why it matters: Production teams have incentives to keep things moving. QC/QA teams have authority to stop production if something's wrong. That checks-and-balances system is crucial for quality.
What this means for you: Your batch doesn't ship just because production finished it. It ships because Quality Control reviewed everything and signed off. That's accountability.
7. Regular Third-Party Audits
What it requires:
- Scheduled audits by external certification bodies
- Corrective action plans for any findings
- Documentation of improvements and compliance
- Ongoing monitoring to maintain certification
Why it matters: Self-certification isn't certification. Third-party auditors have no incentive to give you a pass. They're checking whether you actually follow your procedures—not just whether you have procedures written down.
What this means for you: When a supplier says "we're cGMP certified," they're saying "we've invited external auditors into our facility to verify everything we claim." That's radically different from "we follow best practices."
