Cannabis testing regulations in California

The passage of Proposition 215—the Compassionate Use Act of 1996—in California legalized the use, possession, and cultivation of cannabis by patients with a physician's recommendation to treat most any "illness for which marijuana provides relief." In 2016, Proposition 64 passed, legalizing the sale and distribution of recreational cannabis and cannabis infused products. Since the passage of both, the regulations regarding testing of cannabis in the state have adapted and changed.

California's cannabis testing regulations

1. Laboratory licensing requirements

The laboratory must have ISO/IEC 17025 accreditation for aspects being tested (e.g., cannabinoids, heavy metals, etc.), and the same accreditation must apply to all licensed testing lab locations. An interim testing license valid for 12 months is available before acquiring ISO/IEC 17025 accreditation if all other requirements are met, with all accreditation results being supplied to the Bureau within one business day of receiving the results from the accrediting body. Laboratories must provide upon request by Bureau of Cannabis Control all accreditation certificates. Applications must include all accreditation certificates for cannabis testing, standard operating procedures (SOPs) for how the lab handles testing methods for all aspects being tested, method validation reports for all testing methods, and SOPs for sampling cannabis goods.

2. Basic sampling requirements

In addition to having sampling SOPs and making them available to samplers, all testing of samples (from test batches in final form only) must be conducted in the same laboratory, specifically the receiving laboratory. Proper storage procedures must be followed, and chain of custody (COC) must be maintained. If the regulatory compliance testing cannot be completed after sampling but before certificate of analysis (COA) is issued, the Bureau can approve resampling and testing by another licensed laboratory (if request protocol is followed).

3. COC requirements

A collection of 11 items must be included on COC forms, from laboratory name and license number to printed name and signature of sampler. Additionally, if a sample changes custody (or is simply transported) or is destroyed, the date, time, printed name, and signature of the responsible individual must also be recorded on the COC. If a sample moves between two different licensees, the COC form can’t be altered.

4. Harvest batch sampling requirements

The state defines a “harvest batch” as “a specifically identified quantity of dried flower or trim, leaves, and other cannabis plant matter that is uniform in strain, harvested at the same time, and, if applicable, cultivated using the same pesticides and other agricultural chemicals.” When sampling from a harvest batch, the sample should weigh 0.35% of the total harvest batch weight, though more can be used if required to ensure a representative sample for the required testing. When pulling from a harvest batch, that batch shall not exceed 50.0 pounds. If the harvest batch is unpacked, a specific number of increments must be used based on the batch size (in pounds):

Table 1. Increments per harvest batch size Unpacked Harvest Batch Size (pounds) Number of Increments (per sample) ≤ 10.0 8 10.1 – 20.0 16 20.1 – 30.0 23 30.1 – 40.0 29 40.1 – 50.0 34

The increments must be obtained from different locations in the batch, horizontally and vertically. If the batch is in multiple containers, you must pull, as best as possible, the same number of increments from each container.

5. Cannabis product and pre-roll batch sampling requirements

Like harvest batches, sampling requirements for cannabis product and pre-roll batches must be representative. Also similar to harvest batches, cannabis product and pre-roll batches can’t be over a specific amount, in this case a quantity greater than 150,000 units. And likewise, representative samples must consist of increments relative to the size of the batch collected from:

Table 2. Increments per product/pre-roll batch size Cannabis Product or Pre-roll Batch Size (units) Number of Sample Increments (per sample) ≤ 50 2 51 – 150 3 151 – 500 5 501 – 1,200 8 1,201 – 3,200 13 3,201 – 10,000 20 10,001 – 35,000 32 35,001 – 150,000 50

6. Transportation requirements for cannabis goods

Cannabis goods samples should never be visible, and locked in an apparatus that can be secured to the inside of a vehicle or trailer that has an alarm system. The vehicle and trailer itself must always be locked and secured, outside of residential areas. Contents must remain unaltered during transportation, and transportation routes must be directly from laboratory to laboratory, with exception of fuel, rest, and vehicle repair stops. Only people age 21 or older shall ever be allowed in the vehicle and/or trailer, and only a qualified employee of the lab may be in the vehicle/trailer during transportation. Vehicles/trailers must be registered with the Bureau.

7. Sample reception requirements

A sample may not be received without an accompanying COC form. Recipient must date and print and sign the COC form. Samples without COC forms, with broken tamper-evident material, or that are contaminated/degraded/rendered unusable shall never be analyzed and released for retail sale.

8. SOP requirements

SOPs submitted to the Bureau must incorporate sample preparation and test method documentation. Those SOPs must always be available to laboratory employees during operating hours and be available by request from the Bureau at any time.

9. Test method base requirements

Developed test methods must be validated as well as implemented. The test methods must be in line with the Food and Drug Administration’s (FDA) Bacterial Analytical Manual (2016), the AOAC International Official Methods of Analysis for Contaminant Testing of AOAC International (20th ed.), and United States Pharmacopeia and the National Formulary’s Methods of Analysis for Contaminant Testing (2016).

10. Test method validation requirements

Nonstandard, amplified, modified, and lab-developed validation methods are acceptable. The FDA’s Guidelines for the Validation of Analytical Methods for the Detection of Microbial Pathogens in Foods and Feed (2nd ed.) must be followed for microbial sample analysis. The FDA’s Guidelines for the Validation of Chemical Methods for the FDA FVM Program (2nd ed.) must be followed for chemical sample analysis. Each test method must have a generated validation report to go with it, which includes instrument calibration data, raw data, reference material data, limits of detection (LOD) and limits of quantitation (LOQ) determination data, LCQ report, documentation, and manager review, date, and signature. Any changes to existing test methods or newly developed test methods must be submitted to the Bureau within five business days as a new validation report using Notification and Request Form BCC-LIC-027.

11. Testing requirements

Collected sample increments must be homogenized prior to testing. Samples shall be tested for cannabinoids, foreign material, heavy metals, microbial contaminates, mycotoxins, moisture content, water activity, residual pesticides, residual solvents/processing chemicals, and terpenoids, if applicable. The results for all these tests shall appear on the associated COC form for the sample. Regulatory compliance testing is also required for each sample. In all cases, products whose samples fail tests can’t be sold in retail. Any additional tests beyond the required that result in failure still render a sample as having failed testing and that product being ineligible for retail sale.

11.1 Moisture content and water activity

Dried flower = Minimum 0.5 grams of representative sample; water activity must not exceed 0.65 Aw, indicated as “pass” or “fail” on the COA; moisture content shall have the value reported as a percentage on the COA.

Solid edible cannabis product = Minimum 0.5 grams of representative sample; water activity must not exceed 0.85 Aw, indicated as “pass” or “fail” on the COA.

11.2 Residual solvent/processing chemicals

Minimum 0.25 grams of representative sample; reported as micrograms per gram (µg/g) on the COA, indicated as well with “pass” or “fail”; “pass” is assigned when the presence of any listed item doesn’t exceed indicated action level. (Exclusions apply for ethanol in alcohol-containing orally-consumed products and ethanol or isopropyl alcohol in topical cannabis goods.)

Table 3. Action levels for residual solvents/processing chemicals in cannabis products Category I Residual Solvent or Processing Chemical CAS No. Cannabis Product or Pre-Roll Action Level (µg/g) 1,2-Dichloroethane 107-06-2 1.0 Benzene 71-43-2 1.0 Chloroform 67-66-3 1.0 Ethylene oxide 75-21-8 1.0 Methylene chloride 75-09-2 1.0 Trichloroethylene 79-01-6 1.0 Category II Residual Solvent or Processing Chemical CAS No. Cannabis Product or Pre-Roll Action Level (µg/g) Acetone 67-64-1 5000 Acetonitrile 75-05-8 410 Butane 106-97-8 5000 Ethanol 64-17-5 5000 Ethyl acetate 141-78-6 5000 Ethyl ether 60-29-7 5000 Heptane 142-82-5 5000 Hexane 110-54-3 290 Isopropyl alcohol 67-63-0 5000 Methanol 67-56-1 3000 Pentane 109-66-0 5000 Propane 74-98-6 5000 Toluene 108-88-3 890 Total xylenes (ortho-, meta-, para-) 1330-20-7 2170

11.3 Pesticides

Minimum 0.5 grams of representative sample; report presence of any residual pesticide from Category I (with limit of quantitation of 0.10 µg/g or lower) and micrograms per gram (µg/g) of any residual pesticide from Category II, indicated as “pass” or “fail” on the COA; a sample passes residual pesticide testing if BOTH are true: no Category I pesticide is detected and Category II pesticides, if detected, don’t exceed indicated action levels:

Table 4. Category I residual pesticides Category I Residual Pesticide CAS No. Aldicarb 116-06-3 Carbofuran 1563-66-2 Chlordane 57-74-9 Chlorfenapyr 122453-73-0 Chlorpyrifos 2921-88-2 Coumaphos 56-72-4 Daminozide 1596-84-5 DDVP (Dichlorvos) 62-73-7 Dimethoate 60-51-5 Ethoprop(hos) 13194-48-4 Etofenprox 80844-07-1 Fenoxycarb 72490-01-8 Fipronil 120068-37-3 Imazalil 35554-44-0 Methiocarb 2032-65-7 Methyl parathion 298-00-0 Mevinphos 7786-34-7 Paclobutrazol 76738-62-0 Propoxur 114-26-1 Spiroxamine 118134-30-8 Thiacloprid 111988-49-9

Table 5. Category II residual pesticides Category II Residual Pesticide CAS No. Action Level (µg/g) Inhalable Cannabis Goods Action Level (µg/g) Other Cannabis Goods Abamectin 71751-41-2 0.1 0.3 Acephate 30560-19-1 0.1 5 Acequinocyl 57960-19-7 0.1 4 Acetamiprid 135410-20-7 0.1 5 Azoxystrobin 131860-33-8 0.1 40 Bifenazate 149877-41-8 0.1 5 Bifenthrin 82657-04-3 3 0.5 Boscalid 188425-85-6 0.1 10 Captan 133-06-2 0.7 5 Carbaryl 63-25-2 0.5 0.5 Chlorantraniliprole 500008-45-7 10 40 Clofentezine 74115-24-5 0.1 0.5 Cyfluthrin 68359-37-5 2 1 Cypermethrin 52315-07-8 1 1 Diazinon 333-41-5 0.1 0.2 Dimethomorph 110488-70-5 2 20 Etoxazole 153233-91-1 0.1 1.5 Fenhexamid 126833-17-8 0.1 10 Fenpyroximate 111812-58-9 0.1 2 Flonicamid 158062-67-0 0.1 2 Fludioxonil 131341-86-1 0.1 30 Hexythiazox 78587-05-0 0.1 2 Imidacloprid 138261-41-3 5 3 Kresoxim-methyl 143390-89-0 0.1 1 Malathion 121-75-5 0.5 5 Metalaxyl 57837-19-1 2 15 Methomyl 16752-77-5 1 0.1 Myclobutanil 88671-89-0 0.1 9 Naled 300-76-5 0.1 0.5 Oxamyl 23135-22-0 0.5 0.2 Pentachloronitrobenzene 82-68-8 0.1 0.2 Permethrin 52645-53-1 0.5 20 Phosmet 732-11-6 0.1 0.2 Piperonylbutoxide 51-03-6 3 8 Prallethrin 23031-36-9 0.1 0.4 Propiconazole 60207-90-1 0.1 20 Pyrethrins 8003-34-7 0.5 1 Pyridaben 96489-71-3 0.1 3 Spinetoram 187166-15-0, 187166-40-1 0.1 3 Spinosad 131929-60-7, 131929-63-0 0.1 3 Spiromesifen 283594-90-1 0.1 12 Spirotetramat 203313-25-1 0.1 13 Tebuconazole 107534-96-3 0.1 2 Thiamethoxam 153719-23-4 5 4.5 Trifloxystrobin 141517-21-7 0.1 30

11.4 Microbial impurities

Minimum 1.0 grams of representative sample; results indicated as “pass” or “fail” on the COA.

Inhalable cannabis sample passes testing if shiga toxin–producing Escherichia coli; Salmonella spp.; and pathogenic Aspergillus species A. fumigatus, A. flavus, A. niger, and A. terreus are not detected in 1.0 grams. Non-inhalable cannabis sample passes if both shiga toxin–producing Escherichia coli and Salmonella spp. are not detected in 1.0 grams.

11.5 Mycotoxins

Minimum 0.5 grams of representative sample; results posted as micrograms per kilograms (µg/kg) on the COA, indicated as well with “pass” or “fail”; sample passes testing if both total of aflatoxin B1, B2, G1, and G2 does not exceed 20 µg/kg and Ochratoxin A does not exceed 20 µg/kg.

11.6 Foreign material

Analyze the total representative sample prior to sample homogenization to determine whether foreign material is present; indicated on COA with “pass” or “fail.” Samples pass testing if sand/soil/dirt doesn’t exceed a fourth of the total sample area, mold doesn’t exceed a fourth of the total sample area, embedded foreign material doesn’t exceed a fourth of the total sample area, and if they contain less than one insect fragment/hair/mammalian excreta per 3.0 grams of sample.

11.7 Heavy metals

Minimum 0.5 grams of representative sample; reported as micrograms per gram (µg/g) on the COA, indicated as well with “pass” or “fail.” Sample passes testing if it doesn’t exceed the action levels for four heavy metals:

Table 6. Action levels for heavy metals Heavy Metal Action Level (µg/g) Inhalable Cannabis Goods Action Level (µg/g) Other Cannabis Goods Cadmium 0.2 0.5 Lead 0.5 0.5 Arsenic 0.2 1.5 Mercury 0.1 3.0

11.8 Cannabinoids

Minimum 0.5 grams of representative sample. A limit of quantitation (LOQ) of 1.0 mg/g or lower shall be established for all cannabinoids, with any cannabinoid found to be less than the LOQ reported on the COA as “<1 mg/g” if by dry weight or “<1 mg/mL” if by volume. The COA shall report THC, THCA, CBD, and CBDA as a percentage unless it is from a harvest batch, in which case a dry-weight percent shall be used, calculated as:

dry-weight percent cannabinoid = wet-weight percent cannabinoid / (1 – percent moisture / 100)

The COA shall report total THC and total CBD as a percentage; the COA shall ALSO show all the above in milligrams per gram (mg/g) if by dry-weight or milligrams per milliliter (mg/mL) if by volume. Note that total THC and CBD concentrations shall be calculated differently whether based on weight or volume:

Weight: total cannabinoid concentration (mg/g) = (cannabinoid acid form concentration (mg/g) x 0.877) + cannabinoid concentration (mg/g)

Volume: Total cannabinoid concentration (mg/mL) = (cannabinoid acid form concentration (mg/mL) x 0.877) + cannabinoid concentration (mg/mL)

If the cannabis product is packaged or in serving size, report THC, CBD, total THC, and total CBD on the COA in milligrams per package or serving. Any other cannabinoids not mentioned shall be reported on the COA both as a percentage and in either milligrams per gram (mg/g) if by weight or milligrams per milliliter (mg/mL) if by volume. COA should also clearly indicate “pass” or “fail” overall for cannabinoid testing.

A sample passes testing if:

• edibles – milligrams per serving for THC no greater than 10
• non-orally-dissolving edibles for medical use only – milligrams per package for THC no greater than 100
• orally-dissolving edibles for medical use only – milligrams per package for THC no greater than 500
• cannabis concentrates and topical goods - milligrams per package for THC no greater than 1000
• cannabis concentrates and topical goods for medical use only - milligrams per package for THC no greater than 2000

11.9 Terpenoids

If requested, minimum 0.5 gram of representative sample required. Results are posted as both a percentage and in either milligrams per gram (mg/g) if by weight or milligrams per milliliter (mg/mL) if by volume on the COA.

12. COA requirements

Along with all those previously mentioned COA requirements, a generated COA must be uploaded into the track-and-trace system and emailed to the Bureau (bcc.labs@dca.ca.gov) within one business day of completing all sample analysis, and before any other entity is given the corresponding test results. The COA itself must contain the text “Regulatory Compliance Testing” in 14-point or greater font in the upper right-hand corner of each page, with no images or text appearing above the term. It must also contain laboratory demographics (including license number), distributor demographics (including license number), and cultivator demographics (including license number). Additionally: batch number, sample identifier, sample history, unobstructed photo, total weight of batch/sample, total unit count, density, test method, instrumentation, LOD, LOQ, attestation, and unknown/unidentified/injurious analytes detected. The final COA must be reviewed by the supervisor, dated, and signed.

Additional requirements for each representative sample: issue an overall “pass” or “fail” for entire batch; issue a “pass” or “fail” for any qualitative results for analytes and appropriate units of measure for quantitative; issue a “pass” or “fail” for each test method. When reporting, with the exception of cannabinoid results, use “<LOQ” for analytes detected below analytical method LOQ; “ND” for reporting analytes not detected or below LOD; and “NT” for any test not performed.

13. Remediation and retesting requirements

“Cannabis remediation” largely means safely extracting contaminated sample/batch into oils and concentrates or “cleaning” contaminates from a sample/batch. A licensed distributor or microbusiness is responsible for arranging remediation with the producer. If it can’t be remediated, they are also responsible for destruction, and the sample/batch can’t be retested. If it can’t be remediated after two attempts by the producer, the entire batch must be destroyed. Per the COA requirements, any new COA from a remediated sample must be sent to the Bureau within one business day.

14. Sample retention requirements

Laboratories must retain a reserve sample (not used in the testing process) for at least 45 days after analysis is complete, upon which it may be destroyed and denatured to the point of being unusable/unrecognizable. Sample storage must be secure and environmentally stable so as to not contaminate or degrade the sample. Reserve samples must be provided to the Bureau upon request.

15. Laboratory quality assurance (LQA) requirements

The licensed laboratory must have an LQA program implemented, which includes a manual that addresses quality control, GLP training, objectives for measurement data, traceability, instrument maintenance/calibration, auditing, corrective action, process amendment steps, record retention, document control, standardization methods, and method validation. The LQA program and manual must be reviewed annually, amended if necessary, and approved.

16. Laboratory quality control (LQC) requirements

LQC samples are required and shall be analyzed in the same way as other samples analyzed in the laboratory. Negative and positive controls, as well as a replicate sample, must be used for microbial testing for each analytical batch. Unexpected results require a new set of controls. Corrective action must be taken if results are outside of acceptance criteria, until results are within acceptance parameters.

Each analytical batch must have at least one each of a method blank, laboratory control sample, and replicate/matrix spike sample. A continuing calibration verification (CCV) sample must be used at the beginning of analysis and every 10 samples after. Corrective action must be taken if results are outside of acceptance criteria, until results are within acceptance parameters.

During any testing, if analyte is detected above any action level, the laboratory must prepare another sample and reanalyze it in replicate within another analytical batch. Quantitative analyses require both to be RPD ≤30%, while qualitative requires both to concur. If this leads to LQCs outside of the acceptance criteria again, results can’t be reported and the batch can’t be approved for retail sale. Corrective action is required to comply. Any result declared a false-positive or –negative may require re-sampling or –testing by the Bureau. A unified LQC report for each batch is required after all testing.

17. LOD and LOQ requirements

Limits of detection (LOD) for chemical analyses shall be calculated using signal-to-noise ratio of between 3:1 and 2:1, using: LOD = (3.3 x standard deviation of the response) / slope of the calibration curve with minimum of seven spiked blank samples, or FDA/EPA published methods.

Limits of quantitation (LOQ) for chemical analyses shall be calculated using signal-to-noise ratio of 10:1, at minimum, using: LOQ = (10 × standard deviation of the response) / slope of the calibration curve with minimum of seven spiked blank samples, or FDA/EPA published methods.

18. Data package requirements

Each analyzed representative sample shall have a completed data package (including cover page and checklist BCC-LIC-024), which must be produced upon Bureau request.

19. Proficiency testing requirements

At least once every six months, the licensed laboratory must participate in an ISO/IEC 17043-accredited proficiency testing program. Additionally, every year the laboratory should complete a proficiency program for cannabinoid, heavy metal, microbial, mycotoxin, pesticide, solvent, and terpenoid test methods. All proficiency testing programs should follow the laboratory’s existing SOPs and be rotated among the laboratorians analyzing samples. These programs must be reported upon and signed with attestation that SOPs were followed. These reports must be reviewed by supervisory personnel and delivered to the Bureau within three business days using form BCC-LIC-027. Any results for analytes deemed unacceptable, questionable, unsatisfactory, etc. may not be reported until the laboratory both remedies the failure for each analyte and includes a corrective action report showing how the failure was remedied.

20. Audit requirements

Internal laboratory audits must be conducted once per year or according to ISO/IEC 17025 requirements, whichever is more frequent, and the audit should be conducted to ISO/IEC 17025 standards. Results of internal and on-site audits must be submitted to the Bureau within three business days using form BCC-LIC-027.

21. Employee requirements

Employee age minimum is 21, and all employees must complete a documented training program for the work they will perform. At least one supervisor/management employee must be affiliated with the laboratory, who oversees and directs the laboratory’s methods, LQA program, and ongoing training. That supervisor/manager must at minimum have an appropriate doctoral degree, master’s degree, bachelor’s degree, and relevant full-time practical experience. Any analyst must have either a master’s or industry-specific bachelor’s degree or completed a two-year education with relevant coursework plus three years of full-time practical experience. Any sampler must have completed a two-year program or earned a high-school diploma/GED plus one-year of full-time practical experience.

22. Record retention requirements

Specific records must be retained for at least seven years: financial records, personnel records, training records, contracts with other licensees, permits, licenses, other authorizations, security records, destruction records, track-and-trace data documentation, and other documents in connection with license commercial cannabis business. All records shall be legible and stored in a secured area. The Bureau must be given access to these records to perform its duties, without notice, and even during times outside standard business hours. Records should be able to be produced immediately upon request, either electronic or physical.

23. Track-and-trace requirements

The State of California mandates the use of the California Cannabis Track-and-Trace system, which uses the Metrc software platform created by Franwell, Inc. (CCTT-Metrc). The designated account manager for the laboratory is required to register for and complete the associated CCTT-Metrc training program before an annual license to the software is issued. Afterwards, the designated account manager will be responsible for ordering and assigning unique identifiers (UIDs), when necessary. Incoming batches will already be tagged with UIDs and need to be scanned into CCTT-Metrc upon receipt; the same can be said about shipping out of the laboratory. However, samples taken from a batch at the laboratory will presumably have to be tagged with a UID as a new “package” as well and tracked in CCTT-Metrc.