CBD, GMP and GdocP; quality management in the cannabis industry

Good Documentation Practice for CBD industryAround the world different rules apply for the cultivation, manufacture and sale of cannabis and CBD products. But up until now they’ve been enforced with different levels of success and commitment.

With the uneven observation and policing of quality standards and GxP, the CBD industry has flourished in the absence of consistent regulation. However, all this may be about to change.

High hopes: CBD - the new wonder product?

As the New York Times remarked in late 2019:

“CBD is popping up in nearly everything — bath bombs, ice cream, dog treats — it is hard to overstate the speed at which it has moved from the Burning Man margins to the cultural center. A year ago, it was easy to be blissfully unaware of CBD. Now, to measure the hype, it’s as if everyone suddenly discovered yoga. Or penicillin. Or maybe oxygen”

What is CBD?

CBD is one of many chemicals called cannabinoids. It is found within the hemp plant and can be selectively extracted and used in products like oils and edibles to impart a feeling of relaxation and calm. Unlike its cousin, delta-9-tetrahydrocannabinol (THC), which is the major active ingredient in marijuana, CBD is not psychoactive. CBD products can be easily purchased over the counter and on the internet, and are increasingly being used in tightly regulated prescription drugs.

GMP in the CBD Industry

The CBD industry is flourishing

The growth of the medicinal cannabis and CBD industry globally has been meteoric and practically unfettered. In fact, according to Forbes the CBD Market is predicted to reach $20 Billion by 2024. It’s popularity in a range of ingestibles and oils as well as its new prominence in medical research has all contributed to its hot commercial status, but also the growing need for the control of standards in its production and sale.

Murky regulatory status has fuelled sector growth - but impacted quality goals

Globally, there has been uncertainty about how to police the law surrounding the production and sale of products made with CBD. A soft stance on enforcement has meant in some regions prohibited products such as CBD flowers and unapproved, ’novel’ CBD foods are openly on sale.

At the same time, a lack of internationally recognised standards around cultivation, harvesting, processing and sale have led to wildly different levels of quality in end products and outcomes for consumers.

This includes potentially unsafe levels of THC being present, or such negligibly low levels of CBD that it could not possibly have its intended effect on the consumer. Meanwhile, all kinds of claims are being made for the contents and efficacy of these products that are not always supported. One journalist writing recently in The Guardian demonstrated the extraordinary range of different experiences and promises that consumers are given by broadly similar products.

Meanwhile, industry insiders have also reflected on the way inconsistency in product contents and customer outcomes is undermining the real value that CBD can potentially bring to consumers.

The frothy claims about CBD says Jason DeLand of Dosist in a recent NYT article, “sets up some false expectations that the molecule will never be able to live up to,” He suggests not only are these questionable claims an invitation for government regulation, but they risk making even legitimate applications seem dubious, too.

The end of the ‘wild west’

But all this is changing. After several years of what has been described as an ‘unregulated wild-west style market’, governments and agencies in Europe and the U.S. have started to look closely at how to regulate the industry. They are beginning to define and police minimum standards in cultivation, product development, manufacturing and packaging. Witness this recent statement from the FDA, setting out its stall as definitive source (and enforcer) of clearly understandable regulation:

“The FDA is committed to protecting the public health while also taking steps to improve the efficiency of regulatory pathways for the lawful marketing of appropriate cannabis and cannabis-derived products. FDA has a number of resources available that address cannabis and cannabis-derived products, such as CBD, and the agency wants to ensure that consumers and other stakeholders have access to these resources in a centralized location.”

It’s important to note that as with all good regulation the intention is to:

  • Ensure products are safer and offer better value to customers
  • Make product contents more predictable and understandable for consumers
  • Bring the benefits of more organised and regulated industry to manufacturers themselves.

And the good news is with a greater adoption of recognised standards internationally, businesses can expect increased consumer confidence in the quality of their own products and the sector in general.

Producers and manufacturers up and down the CBD supply chain are being increasingly required by regulators (and each other) to demonstrate the way they have met standards in their manufacturing and ensured the quality of their end products, before they can be sold. This need is particularly acute in the supply of ingredients for use in the highly regulated pharmaceuticals sector.

Welcome to the world of GXP: from GMP to GdocP

For the first time in many cases, it seems, cultivators and producers are seeing and hearing regulatory terms applied to what is expected of them by clients and government agencies. This includes evidence of the operation of their GxP (the FDA and WHOs umbrella term for good industry practices required in the life sciences sector) and more specifically:

  • Good Manufacturing Practice (GMP),
  • Good Agricultural and Collection Practice (GACP)
  • Good Laboratory Practices (GLP)

These are the acronyms that appear in the regulatory literature throughout the world and describe required approaches to quality challenges, ensuring manufacturing and other standards are met in a consistent and auditable way, while being subject to a process of continual improvement, often using GxP systems.

To meet quality objectives in product development and production of CBD pharmaceuticals, many in the CBD chain are also being required to meet the standards of FDA 21 CFR Part 11, too (these are the highest quality standards legally required of producers of medical products, devices and diagnostics).

And, it should be remembered, the enforcement of these standards also entails the threat of sanctions. Companies producing or using CBD in their products who do not adhere to regulatory requirements in their manufacturing process can expect sanctions including fines, impounded products, license suspension or revocation, not to mention the risk of lost contracts, reduced revenue and damaged reputation.

Good documentation practices should underpin your GMP

The quality challenge might be unfamiliar for some but it’s real, and for small scale companies encountering it for the first time it can seem daunting.

But what they are discovering is that pretty much all GxP is underpinned by Good Documentation Practices (GDocP). Because the way you document GMP, SoPs (standard operating procedures) and oversee change control in the life sciences industry, is the way standards are defined, shared and met across a business. Ultimately, it’s a key way in which companies are audited for compliance too.

Rigorous and repeatable SoPs, risk based thinking, continuous improvement, management reviews, corrective actions and external auditing are all a vital part of GMP that can be established and maintained through proper document management and control.

CBD industry look to med dev and pharma for Quality Solutions

To meet these standards, many in the CBD industry are looking to the quality management software commonly used by large pharmaceutical companies or industrial sized producers to implement QMS, keep their documented processes and procedures in order and instill ‘Good Manufacturing Practice’ throughout their companies.

But, as we’ve found from our work with SMEs and entrepreneurs in the medical device manufacturing industry, these pieces of software are not very agile and can be crippling to smaller businesses. They can take months to install, they need huge amounts of training for workers to use successfully, and they can be very prescriptive in the way they ask you to define and order the way you work.  Meanwhile, using Google Drive or Dropbox may not be able to provide anything like the robust approach to documentation you'll need to survive in a regulated industry.

Why not just use Google Drive as a Document Management System?


Instead a more flexible approach to Quality Management is needed.

Document Management Systems for regulated industry

There are Document Management Systems that operate as cloud-based, process-driven intranets, digital frameworks for the compliant storage of all your project documentation - that can scale with you - and from the outset make observing GdocP part of your organisational DNA.

A digital Document Management System that allows you to upload and add to your existing quality and SOP documentation (in common formats such as word, excel etc) is a good place to start. With the right tools you can use them to define a basic, working Quality Management System from which greater controls can evolve.

  • Structuring document filing and storage in a robust and secure way
  • Locking down quality documentation for editing
  • Imposing and managing version control of documentation
  • Establishing work flows to ensure compliant SOPs
  • Managing future document and SOP control and approval sequences
  • Introduce tools for future internal and external audits


Regulation of the cannabis industry is an evolving force, but closer scrutiny of the sector is here and more is coming. There are lots of tech solutions out there intending to improve traceability and accountability for the industry and its customers, including blockchain-powered apps intended to guarantee provenance and quality for consumers.

However, as with most regulation, good governance and quality management has at its heart proper systems of document management and control. As small CBD producers and developers begin to grapple with the robust quality requirements that will be their new reality, it’s worth checking out some of the more agile and scalable QMS solutions that have helped medical product SME’s get ahead. There are Document Management Systems out there that can flex around you, but still help you structure and manage a robust and auditable quality solution suitable for regulated industry.

Guide to GXP compliance


Tags: Quality Management System, FDA Compliance

Joe Byrne

Written by Joe Byrne

Joe Byrne is the CEO of Cognidox. With a career spanning medical device start-ups and fortune 500 companies, Joe has over 25 years of experience in the medical device and high-tech product development industries. With extensive experience in scaling businesses, process improvement, quality, medical devices and product development, Joe is a regular contributor to the Cognidox DMS Insights blog where he shares expertise on scaling and streamlining the entire product development cycle, empowering enterprises to achieve governance, compliance, and rigour.

Related Posts

Data integrity in life sciences: the vital role of ALCOA principles

Data integrity is central to the safe development and manufacturing of every life-science product ...

ISO 13485:2016: What does it take to meet medical device QMS requirements?

Navigating the complexities of ISO 13485:2016 can seem daunting, but understanding its requirements ...

4 challenges you'll face moving from a paper based QMS to an eQMS

The case for ditching paper based QMS (Quality Management Systems) can seem like a no-brainer. But ...

QMSR and ISO 13485:2016: what’s in the new FDA regulation?

At last! It’s happened! The FDA has announced the date for the publication of its new Quality ...

An A-Z of Medical Device Development; Acronyms, Regulatory & Technical Terms

The regulations and literature surrounding medical device development are packed with acronyms and ...

QSR Compliance: What’s inside FDA 21 CFR Part 820?

The FDA’s Quality System Regulation (QSR) for medical device manufacturers is commonly known as FDA ...