For state-licensed cannabis operators
GACP + GMP Gap Assessment
aligned to Schedule III.
A scoped assessment that maps your cultivation (GACP) and manufacturing (GMP) practices against the standards required by the federal Schedule III posture — and that the EU GMP Annex 7 export pathway, IND/NDA filings, or pharma partnership arrangements will demand of any operator pursuing them. The diagnostic foundation for every downstream federal-pathway engagement.
Why this is the right place to start
The April 2026 rescheduling did three things at once. It moved FDA-approved drug products containing marijuana and state-medical marijuana to Schedule III. It opened a 60-day DEA registration window for state-licensed operators (closes on or about June 27, 2026 — see the 60-Day Federal Pathway primer). And it made state-licensed medical marijuana lawfully exportable under DEA permit for the first time.
The DEA registration is the immediate sprint. The longer-tail question — the one that determines what a cannabis operation can actually become over the next two years — is whether the cultivation and manufacturing practices on the floor today are aligned to the GACP and GMP standards that the operator’s chosen downstream lane requires.
- For state-medical operators staying state-bound: alignment to 21 CFR Part 111 / 117 plus the new § 1301.13(k) federal overlay (initial inventory, biennial inventory, theft and loss reporting, statutory warning label, federally retrievable records).
- For operators pursuing EU pharmacy export: alignment to EU GMP Part II + Annex 7 (herbal medicinal products) and EMA HMPC GACP guideline for cultivation. Annex 16 Qualified Person function for batch release.
- For operators pursuing IND/NDA, CTM supply, or pharma partnership: alignment to 21 CFR Part 211, ICH Q7/Q10/Q11, and an integrated quality system built once at the highest common bar (see Build Once, Build to the Highest Bar).
All three lanes require a clear-eyed read of where you are today against the relevant standard. The gap assessment is that read, scoped to your chosen target and delivered with sequencing dependencies, capability needs, and a binding recommendation for any follow-on remediation work.
What’s included
Stage 1 is the gap assessment itself. We won’t quote a fixed price for any Stage 2 remediation engagement until Stage 1 is complete — we don’t know yet what we’d be quoting, and neither do you.
1. Pre-engagement intake
Structured intake covering state licenses (per location), controlled documents list, current SOP inventory across cultivation, processing, packaging, QA, sanitation, and training, recent inspection / audit reports, open CAPAs, GMP-relevant equipment inventory, and your target downstream lane (state-medical-only, EU export, IND/NDA, pharma partnership). The cleaner the intake, the lower the engagement cost.
2. Assessment — remote or on-site
Remote tier: structured records review (batch records, COA pedigree, METRC genealogy, transport manifests, theft/loss log, training, sanitation and EM logs, calibration, deviation/CAPA register), video walkthrough of the facility led by your QA staff, and virtual personnel interviews at QA, operations, and floor levels. On-site tier (2–3 days, one cofounder lead + supporting domain expert): everything in the remote tier plus in-person walk-through of cultivation, drying, trimming, packaging, vault, lab, and warehousing zones. On-site catches the things that don't surface on paper — gowning discipline, traffic flow, posted-vs-controlled SOP gap, equipment condition, sanitation realism, environmental discipline. Closing meeting with preliminary findings either way.
3. Gap assessment report
Findings categorized by domain (cultivation GACP, processing GMP, QA system, facility design, EM and sanitation, recordkeeping, training, etc.) and severity tier (Critical / Major / Minor / Observation). Each finding mapped to the specific clause of the target standard — 21 CFR Part 111/117/211 sections, EU GMP Part II / Annex 7 / Annex 1 / Annex 15 sections, ICH Q7 sections, or § 1301.13(k) federal-overlay requirements.
4. Remediation roadmap with sequencing
Prioritized work plan: what must be addressed before DEA inspection, what before any EU export shipment, what before IND filing. Capability requirements (in-house vs. consultant vs. vendor). Realistic timelines anchored to your construction or operational state. Critical-path dependencies (the EM baseline study can’t begin until HVAC is balanced; the DQ trace matrix can’t close until V1.0 drawings are issued; etc.).
5. CAPA register for client tracking
Working spreadsheet — every finding entered as a row with owner, due date, evidence-of-closure expected, current status. Your QA function maintains it after we deliver it; we’ll review at scoped check-ins or as a separate retainer.
6. Binding scope recommendation for Stage 2
If the assessment shows you’re already in good shape, we tell you that explicitly and you save a year of unnecessary consulting work. If not, we deliver a scoped Stage 2 proposal at a fixed or estimated fee for any of the candidate follow-on engagements — DEA registration support, Design Qualification + commissioning program, Part 211 readiness build, EU GMP bridge, integrated PQS build, expert witness support, ongoing retainer.
(Optional) 60-minute virtual closing briefing
Within 10 business days of the assessment. Useful for getting QA + operations + leadership aligned on findings before the report goes out.
How it works
Two delivery tiers. Every engagement is scoped and quoted at intake — larger or multi-site operations scale with the work.
Remote (Stage 1 lite)
Records review, video walkthrough, virtual interviews, full written report. The right tier for operators who run a clean documentation system and want a fast, lower-friction read. Some facility-condition findings may need an on-site follow-up before the Stage 2 scope can close.
On-site
2–3 days on-site with one cofounder lead plus a supporting domain expert. Catches the findings that don’t surface in the paperwork — gowning discipline, traffic flow, posted-vs-controlled SOP gap, equipment condition, sanitation realism. Travel costs billed at cost.
Stage 2 remediation pricing is quoted as part of the Stage 1 binding scope recommendation — not before.
Who leads the assessment
Cofounders deliver the engagement. There is no junior associate inserted after the sale.
Andrew Samann
Lead — overall framework
GMP and cGMP architecture; DEA § 1301.13(k) framework; ICH Q7 lead-auditor experience at SGS North America across 100+ engagements; previously led ASTM D37.02 QMS Subcommittee for Cannabis.
Kate Evans, PhD
Cross-domain principal
ANAB and A2LA lead assessor (ISO/IEC 17025); ASTM D8493-23 Technical Contact (cannabis/hemp sample prep); toxicology + pharmaceutical analysis cGMP experience; FDA test method submission.
Tess Eidem, PhD
Microbiology + GACP + EM
Preventive Controls Qualified Individual (PCQI) under FSMA (the U.S. food-safety law), 21 CFR Part 117 Subpart C. Cannabis microbiology and bioaerosol specialist. Environmental Monitoring program design.
Julie Kowalski, PhD
Analytical chemistry + QC alignment
A2LA ISO 17025 lead assessor; co-chairs AOAC CASP Pesticide Think Tank; past President NACRW; GC, GC-MS, LC, LC-MS/MS method development and validation; pesticide residue analysis; chromatography.
What typically comes after Stage 1
The gap assessment is the foundation. Stage 2 is what closes the gaps — and what it looks like depends entirely on the findings. The most common follow-on engagements:
- DEA registration support sprint — document pack assembly, Public-Interest defense memo, cultivation-area parcel mapping, Single Convention buy/sell-back SOP, security plan overlay. See the 60-Day Federal Pathway primer for the full workbook.
- Design Qualification + Commissioning Program — URS through CVMP across four sequences, built around the nine immutable auditor questions. Used when operators are expanding or building a new facility.
- Integrated PQS build — full quality system to ICH Q10 / EU-GMP / 21 CFR 211 at the highest common bar. See Build Once, Build to the Highest Bar for the strategic argument and the system pillars.
- EU GMP / Annex 7 bridge — for operators pursuing pharmacy export, the gap-close from current state to EU-GMP-ready including Qualified Person function design and Annex 1 Contamination Control Strategy.
- Post-engagement retainer — quarterly check-in plus on-call SME access. Right for operations that need a continuous quality voice but don’t yet need (or want) a full-time CQO.
Talk to us about an assessment
Send a note describing your operation — current state, target downstream lane, and any specific compliance pressure you’re facing. A cofounder will reply within one or two business days with a scoping conversation proposal and a rough estimate for the assessment.