Cannabis GMP Compliance in Canada: What Health Canada Requires of Licensed Producers

Of the licensed producers Health Canada has put on compliance holds or warning in recent years, the majority weren’t cited for product contamination. They were cited for documentation — incomplete batch records, missing deviation sign-offs, and change control procedures that lived in their SOPs but nowhere in their actual production history. It’s a pattern that repeats itself across the industry, and it’s almost entirely preventable.

Canada legalized adult-use cannabis on October 17, 2018, under the Cannabis Act (S.C. 2018, c. 16). That legislation created an entirely new licensing regime. And while the industry spent its first few years building canopy space and brand recognition, Health Canada’s Cannabis Compliance Directorate was quietly building inspection capacity. The regulatory grace period is over. Facilities that hold processing or cultivation licences and still treat Good Production Practices as a checkbox exercise are operating on borrowed time.

This post covers what the Cannabis Regulations actually require, what mandatory lot testing looks like in practice, and the compliance gaps inspectors find most often.

Good Production Practices vs. Pharmaceutical GMP: More Similar Than You’d Think

The Cannabis Regulations (SOR/2018-144) use the term “Good Production Practices” (GPP) in Part 5 — not the “Good Manufacturing Practices” language that governs pharmaceuticals under Division 2 of Part C of the Food and Drug Regulations. Cannabis facilities sometimes interpret this distinction as meaning the pharmaceutical GMP framework doesn’t apply to them.

Technically, that’s correct. Practically, it changes very little.

Part 5, Division 3 of the Cannabis Regulations establishes GPP requirements that are structurally parallel to Canada GMP requirements for conventional pharmaceuticals. Both frameworks demand a documented quality management system, qualified personnel, controlled premises and equipment, formal sanitation programs, complete production records, and a change control procedure. The terminology diverges; the expectations don’t.

Where cannabis GPP does differ meaningfully is in its integration of security requirements, mandatory personnel background checks, and Cannabis Tracking and Licensing System (CTLS) reporting obligations. Failure to meet CTLS reporting timelines can jeopardize a licence independent of any quality finding — a risk with no direct equivalent in the pharmaceutical GMP world.

What Health Canada’s Cannabis Regulations Actually Require

Part 5, Division 3 of the Cannabis Regulations maps cleanly onto a conventional quality system framework. Here’s how the core requirements translate into day-to-day operations:

Quality management system: Licensed producers need a documented QMS covering lot numbering, yield tracking, in-process testing, and lot disposition. It doesn’t need to follow ISO 9001 or any named standard. But it does need to be coherent — an inspector should be able to follow a single lot from input materials to final disposition without hitting a documentation gap.

Personnel and hygiene: Staff who directly handle cannabis must be trained on contamination prevention, hygiene protocols, and their specific role in the production process. Training records must be current. Facilities that scale up quickly often onboard people before formal training programs are in place — and that’s exactly the kind of thing inspectors ask about first.

Premises and equipment: Facilities must be designed to prevent contamination and cross-contamination between cultivation, processing, and packaging areas. Equipment must be maintained and calibrated on a documented schedule. Maintenance logs matter as much as maintenance itself.

Sanitation and pest control: A written sanitation program is mandatory. Pest control requires documented inspection logs — dates, findings, and interventions. Critically, every pesticide application must be recorded with the product name, concentration, and application area. Whatever goes on or near the plant will show up in mandatory lot testing, and inspectors will cross-reference pest control records against pesticide test results.

Production controls: Batch records must capture every production step — lot numbers, quantities, personnel sign-offs, and in-process check results. Yield reconciliation, comparing starting material weight to finished product weight at each stage, is a critical control point. Unexplained yield variances are a red flag during inspections.

Change control: Every modification to a facility, process, piece of equipment, or written procedure must be documented before implementation. Not after. Before. This is where many cannabis operations fall apart, and we’ll address it in detail below.

Mandatory Lot Testing: What Every Batch Must Clear Before Release

Section 97 of the Cannabis Regulations establishes the mandatory testing framework. No lot of cannabis can be sold or transferred until it has passed testing for each applicable parameter. There are no provisional releases. There are no backorder exemptions.

For dried cannabis, the mandatory parameters include:

• Potency (THC and CBD): Total THC and total CBD content, expressed as percentages. This is the labelling anchor. If the tested potency doesn’t match the label claim within Health Canada’s stated tolerance, the lot cannot be sold — period.
• Moisture: Maximum 13% moisture content. Lots that exceed this must either be reprocessed or destroyed.
• Microbial contamination: Total aerobic count ≤100,000 CFU/g; total yeast and mould ≤10,000 CFU/g; Escherichia coli absent in 1 g; Salmonella spp. absent in 25 g.
• Heavy metals: Lead ≤10 µg/g, cadmium ≤2 µg/g, arsenic ≤2 µg/g, mercury ≤1 µg/g. These limits align with food safety frameworks and require validated inductively coupled plasma mass spectrometry (ICP-MS) methods to reliably achieve the detection sensitivity Health Canada expects. Standard ICP-OES methods are often inadequate for mercury at these concentrations.
• Pesticide residues: Tested against Health Canada’s Maximum Residue Limits for cannabis under the Pest Control Products Regulations. This is a multi-residue panel — a lot can fail on a single compound out of dozens, even if all others are non-detect.

For cannabis extracts, add residual solvents to the panel. Health Canada references ICH Q3C limits for Class 1 and Class 2 solvents. Manufacturers using ethanol, CO₂, butane, or propane extraction must validate their process to demonstrate consistent solvent elimination across commercial-scale batches — bench-scale data doesn’t transfer to production-scale equipment without validation work to prove it.

Aflatoxin testing is required for certain product categories, particularly edibles and products with ingredient inputs that carry inherent mould risk.

One operational point that catches producers off guard: Health Canada requires testing to be performed by an accredited third-party laboratory unless the licensed producer holds specific in-house testing authorization. That means lot release timelines are partly determined by external lab scheduling. Build a minimum 10 to 15 business day buffer into production planning for routine testing cycles — more if your lab is handling cannabinoid testing alongside a full contaminants panel.

Common Compliance Failures Health Canada Inspectors Find

Having supported cannabis facilities through Health Canada compliance reviews, a few findings appear consistently across facilities of all sizes:

Change control failures are by far the most prevalent. A head grower adjusts a nutrient protocol. A facility upgrades its drying system. IT migrates batch record software to a new platform. None of it goes through a documented change control workflow first. By the time an inspector asks to see the change request, the modification has been in operation for six months with no pre-approval documentation. The correction isn’t technically difficult — it requires a change control register, a pre-approval step, and a discipline culture that treats all changes as change-controlled events.

Incomplete deviation records are closely related. When a lot falls outside an in-process specification — a temperature excursion in the drying room, a yield reconciliation gap greater than a defined threshold, a batch record correction made after initial sign-off — the event must be documented in real time, investigated, and closed with a corrective action. Inspectors can tell quickly whether deviation records reflect what actually happened or were reconstructed to fill a gap. The timestamps alone are revealing.

Pest control documentation gaps are especially common in cultivation facilities. Verbal assurances that a pest control contractor visits regularly don’t satisfy inspectors. Written logs with dates, findings, treatments applied, and sign-off from a responsible person do.

Lot traceability breakdowns occur when lot numbers aren’t consistently applied across all production steps, or when batch record quantities don’t reconcile cleanly with CTLS reporting entries. A traceability gap doesn’t necessarily mean a product safety problem — but it creates the appearance of one, and inspectors respond accordingly.

Preparing for a Health Canada Cannabis Inspection

Health Canada conducts both announced and unannounced facility inspections. The goal of a sound compliance program is to make the results of both types indistinguishable from each other. Here’s where to focus attention:

1. Audit your document control system every six months. Confirm that all SOPs are within their designated review cycle, version numbers are current throughout, and obsolete document versions aren’t accessible on the production floor. Stale SOPs are an easy finding for inspectors and an easy win for you to eliminate.

2. Reconcile your change control register against physical reality. Pull the register and compare it against any actual changes made to the facility, equipment, or procedures in the past 12 months. If you find changes that were implemented without a formal change control record, initiate retrospective documentation and a corrective action — better to surface it yourself than to have an inspector find it.

3. Trace a lot end-to-end before every inspection cycle. Pick a finished lot at random and walk it backwards through every production step to the input materials. Then confirm it forwards into your CTLS reports. If you find a gap in either direction, you’ve identified a systemic traceability issue that needs to be fixed.

4. Review open and overdue CAPAs. Corrective and preventive actions that have been open for longer than their planned closure date are a visible indicator of a quality system that isn’t self-sustaining. Close them, or formally document why the closure date was extended and what steps are in progress.

5. Verify your contract laboratory’s ISO 17025 accreditation scope covers your required test methods. Specifically confirm that cannabis potency, heavy metals, pesticide residues, and any other mandatory parameters are explicitly listed in the lab’s scope of accreditation. A lab can be ISO 17025-accredited in general and still lack accreditation for a specific method — and that gap puts your lot release data on shaky ground.

The Canadian cannabis sector is no longer in its regulatory infancy. Health Canada’s Cannabis Compliance Directorate has experienced inspectors who can recognize a functioning quality system within the first hour of a facility review. They can also recognize one that’s been assembled for the visit.

Compliance isn’t a project with a finish line. Producers who understand that — who build quality systems their operations actually run on, not systems that exist to satisfy a checklist — consistently have shorter inspections, cleaner observation letters, and more predictable lot release timelines. That’s the competitive advantage most cannabis executives aren’t talking about.

---

Written by Nour Abochama, Quality & Regulatory Advisor, Androxa. Learn more about our team

Talk to our team about Health Canada compliance. Contact us

Related from our network

• Accredited Cannabis and Supplement Testing in the US — Qalitex Laboratories provides ISO 17025-accredited potency, heavy metals, microbial, and pesticide testing for cannabis and hemp products entering the US market.
• Regulatory Compliance for European Markets — Care Europe supports manufacturers entering EU markets with dossier preparation, REACH compliance, and market authorization strategy across EU member states.