Out of Compliance Meaning in Cannabis

Quick Answer: Being "out of compliance" in the cannabis or hemp industry means violating strict regulations governing cultivation, processing, testing, packaging, labeling, or reporting—resulting in immediate consequences such as product holds, recalls, license suspensions, and potentially severe fines.

For cannabis, compliance often involves adhering to state-mandated requirements like COA testing for pesticides, microbials, heavy metals, and potency variance (typically ±10%), as well as using regulated track-and-trace systems such as Metrc. Penalties for cannabis violations can reach up to $100,000 per infraction, with potential criminal charges.

Hemp compliance, governed primarily by federal and state agricultural authorities, centers on limits like the federal 0.3% delta-9 THC threshold, maintaining valid and accurate Certificates of Analysis (COAs) from DEA-registered or USDA-approved laboratories, and abiding by strict packaging and labeling rules. Non-compliance in hemp can result in immediate batch destruction, required reports to regulatory agencies, and risk to licensing or future market access.

Both industries operate under a zero-tolerance approach: a single failed test or documentation error can trigger swift regulatory action. Modern compliance demands thorough recordkeeping, validated lab testing, and full traceability from seed-to-sale or seed-to-product—enforced either through cannabis-specific tracking systems or agricultural hemp guidelines.

At Arvida Labs, we recognize the evolving complexities of hemp compliance and voluntarily adopt many of the rigorous standards found in cannabis regulations. Our commitment to comprehensive COAs, GMP-certified manufacturing, and advanced packaging traceability helps our partners meet or exceed regulatory expectations and build consumer confidence.

Key Takeaways

• Failed COA tests for pesticides, heavy metals, or microbials trigger immediate product holds and mandatory 72-hour reporting to state regulators within cannabis operations under state cannabis control board rules. In the hemp industry, similar rapid reporting and holds occur when contaminants or THC levels exceed federal or state agricultural guidelines.
  

• Metrc non-compliance—including discrepancies between physical inventory and system data—results in administrative holds affecting entire batches in cannabis markets. Hemp businesses, while not required to use Metrc, maintain comparable batch-level tracking systems to support compliance and traceability consistent with USDA or state agricultural regulations.
  

• The Missouri DCR issued multiple recalls in 2024 for cannabis products lacking proper Metrc tracking or mandatory testing, illustrating the consequences of cannabis market compliance failures. Hemp recalls, governed by different authorities, follow agricultural product recall processes when applicable.
  

• Pesticide action limits vary by state and product, but detection of banned substances in strict states like New Jersey triggers automatic failure and recall enforcement for both cannabis and hemp products.
  

• Remediation is permitted for some failures such as microbial or heavy metal contamination under state and federal rules, but pesticide failures universally prohibit remediation, requiring immediate destruction of affected products.
  

• Arvida Labs offers compliant cannabinoid ingredients with comprehensive COAs meeting or exceeding testing requirements in both cannabis and hemp markets, backed by advanced manufacturing and packaging solutions. Contact us to learn more today.
  

What "Out of Compliance" Actually Means for Cannabis Operators

Out of compliance status occurs when cannabis or hemp products or business operations fail to meet regulatory requirements ranging from testing thresholds to documentation and labeling standards.

In cannabis, violations typically include failed laboratory tests, discrepancies in Metrc reporting, labeling errors, and expired licenses that disrupt required seed-to-sale tracking systems.

Hemp compliance primarily requires adherence to federal and state agricultural rules, including not exceeding the 0.3% delta-9 THC threshold mandated by law, using DEA-registered or USDA-approved laboratories for testing, maintaining accurate Certificates of Analysis (COAs), and following rigorous packaging and labeling guidelines applicable to hemp products. Unlike cannabis, hemp operators do not use Metrc but instead comply with USDA or state agricultural oversight, often voluntarily integrating cannabis-quality best practices.

California's DCC requires testing laboratories to report COA results within one day of completion with any failure triggering immediate administrative holds. This can freeze inventory movement until compliance is restored. In both cannabis and hemp markets, voluntary recalls help mitigate penalty severity, but pesticide contamination always triggers mandatory destruction.

While action limits for contaminants vary, common standards exist: heavy metals such as lead fail at 0.5 ppm, arsenic and cadmium at 0.2 ppm. Microbial pathogens including E. coli, Salmonella, or Aspergillus detection at any level results in failure. Washington state sets water activity limits at 0.65 aw for useable cannabis and 0.85 aw for edibles, with violations requiring immediate remediation or destruction across cannabis and hemp products sold in the state.

COA Failures: When Test Results Trigger Compliance Violations

Certificate of Analysis (COA) failures are the most common compliance violations in both cannabis and hemp industries, with specific thresholds defining pass or fail status for each contaminant category. Understanding these regulatory limits and their consequences helps operators manage testing proactively and avoid costly violations before products reach the market or testing labs.

Pesticide Testing Failures

Pesticide violations carry the harshest penalties because remediation is universally prohibited across both cannabis and hemp operations. Canada's mandatory testing requirements specify 96 pesticide active ingredients with action limits ranging from 0.01 to 20 ppm. Similarly, states like New Jersey ban all pesticide use on cannabis, meaning any detection triggers automatic failure and mandatory recall.

In hemp, pesticide limits are governed under USDA and state agricultural rules, with strict prohibitions on many toxins. While remediation of pesticide contamination is not allowed, rapid reporting and destruction of affected batches are mandatory.

When pesticides are detected in cannabis products, operators must notify regulators within 72 hours of receiving test results. Massachusetts found that 22 of 58 pesticide failures were not reported within the required timeframe, with delays ranging from 4 to 16 days. These reporting failures compound original violations, resulting in increased fines and regulatory scrutiny.

Microbial and Mycotoxin Limits

Microbial contamination poses immediate health risks, making failures especially serious for cannabis and hemp alike. According to ACS Laboratory standards, microbiological compliance is measured on a presence/absence pass/fail basis, where detection of pathogenic bacteria triggers product failure. Common regulatory limits include:

• Total Yeast and Mold: 10,000 CFU/g for flower, 1,000 CFU/g for edibles

• E. coli: Not detected

• Salmonella: Not detected

• Aspergillus species: Not detected

• Aflatoxins (mycotoxins): 20 ppb total

• Ochratoxin A: 20 ppb
  

Unlike pesticide violations, microbial contaminations may qualify for remediation through treatments such as ozone or gamma irradiation, though such methods must be pre-approved by state regulators prior to implementation in both cannabis and hemp sectors.

Heavy Metal Action Limits

Heavy metals accumulate in cannabis plants through contaminated soil or nutrients, with specific limits protecting consumer safety:

Contaminant	Flower (ppm)	Edibles (ppm)	Concentrates (ppm)
Lead	0.5	0.5	1.0
Arsenic	0.2	0.2	0.4
Cadmium	0.2	0.2	0.4
Mercury	0.1	0.1	0.2

Heavy metal failures allow remediation through dilution or blending with compliant material, though final products must pass retesting before release.

Track-and-Trace Compliance in Cannabis and Hemp

In cannabis markets, track-and-trace systems like Metrc are mandatory for state-licensed operators, requiring real-time reporting of all cannabis movements. Violations, such as discrepancies between physical inventory and Metrc records, missing or incorrect package tags, unreported waste, delayed transfer manifests, or late lab result uploads, lead to severe administrative holds that can freeze entire inventories and disrupt supply chains.

However, in the hemp industry—where Arvida Labs operates—Metrc is not used or required. Instead, hemp businesses comply with federal and state agricultural regulations that mandate batch-level tracking, detailed documentation, and reporting to ensure product safety and traceability. Several hemp-specific digital tracking solutions, such as Hemp Batch Tracker, support these requirements by enabling end-to-end visibility from seed genetics to finished product and consumer.

Missouri's 2024 cannabis recalls illustrate the critical consequences of non-compliance with Metrc and state cannabis tracking systems, where product removal from the market was required due to tracking failures. For hemp, recall and compliance protocols differ, typically enforced by USDA or state agriculture departments, but similarly require robust batch traceability and accountability.

California’s new Metrc Retail ID system exemplifies advanced cannabis compliance technology, allowing instant consumer recall alerts through QR codes. While hemp regulations are not yet as digitally integrated, Arvida Labs proactively incorporates batch-level traceability, compliant packaging, and QR-enabled transparency in its hemp products to build consumer trust and readiness for future regulatory evolutions.

Labeling and Packaging Compliance Failures

Labeling violations, while sometimes appearing minor, can lead to significant consequences including full product recalls. For example, Missouri recall of Bootheel CannaCare products containing unlisted ingredients demonstrates how critical ingredient disclosure is for compliance.

Key labeling requirements include:

• Complete cannabinoid profile within ±10% of tested values

• Listing of all ingredients, including processing aids

• Required warning statements in specified font sizes

• Batch/lot numbers matching tracking records (e.g., Metrc for cannabis)

• Testing dates within validity periods (typically 12 months)

• Laboratory license number and contact information
  

Packaging regulations extend beyond labels to include structural and safety mandates. Child-resistant packaging must meet ASTM D3475 standards, and products resembling candy or appealing to children are automatically rejected regardless of test results. Arvida Labs ensures its packaging designs comply with these standards to meet or exceed regulatory requirements in hemp markets.

Corrective Action Plans and Remediation Protocols

When compliance failures occur, operators must implement Corrective and Preventive Action (CAPA) plans documenting root causes and prevention strategies. Effective CAPA protocols distinguish between companies that recover from violations and those facing repeated failures.

Remediation options vary by violation type and state regulations. California DCC requires pre-approval of remediation plans through remediation@cannabis.ca.gov, with only manufacturers authorized to perform remediation. Approved methods include:

For Microbial Contamination:

• Ozone treatment at specified concentrations
  

• Dry heat treatment (minimum 4 hours at 140°F)
  

• Extraction into concentrates (with retesting required)

For Heavy Metals:

• Dilution with compliant material
  

• Extraction and distillation to reduce concentrations
  

• Conversion to non-inhalable products with higher limits

Prohibited Remediation:

• Any remediation of pesticide failures
  

• Methods imparting toxic substances
  

• Remediation after second retest failure

Washington regulations specify that remediation cannot impart any toxic or harmful substance to the product. Failed quantities may be converted to extracts, but must pass all required testing before sale.

Voluntary vs. Mandatory Recalls

n both cannabis and hemp industries, the distinction between voluntary and mandatory recalls is critical. Voluntary recalls are proactively initiated by operators, often upon identifying potential issues, to demonstrate good-faith compliance and mitigate regulatory penalties.

Mandatory recalls are issued when serious violations occur, such as:

• Pesticides exceeding action limits, which trigger immediate destruction—under strict zero-tolerance policies.

• Detection of pathogenic bacteria or contaminants that pose health risks.

• Products sold before passing required Certificates of Analysis (COAs).

• Safety or labeling issues involving consumer health.
  

For example, Michigan CRA's 2024 recall involved over 1,098 units not tested in final form, which violates fundamental testing standards. Such recalls typically require rapid cessation of sales, consumer notification, and destruction of non-compliant products.

Costs of Recalls and Prevention

Recall costs extend beyond the product’s market value and include:

• Notification expenses for consumers and retailers

• Product retrieval and destruction fees

• Laboratory testing and investigation costs

• Lost production and brand reputation damage

• Potential legal liabilities and lawsuits

Preventing Compliance Failures Through Systematic Controls

Prevention requires quality systems addressing every compliance touchpoint. Successful operators implement redundant checks catching issues before they reach regulators or consumers.

• Testing Strategy Implementation: Schedule testing at multiple production stages rather than relying on final testing alone. Pre-harvest testing identifies contamination before significant processing investment. In-process testing during extraction or manufacturing catches issues before batch completion.
  

• Documentation Management: Maintain real-time documentation systems that integrate with Metrc to prevent data mismatches. Digital SOPs guarantee consistent procedures across shifts and facilities. Batch records must capture every input, process parameter, and deviation for complete traceability.
  

• Supplier Qualification Programs: Verify all input materials through supplier COAs and incoming testing. High-end suppliers, like Arvida Labs, provide documentation for cannabinoid ingredients, including stability data and residual solvent profiles meeting strictest state requirements. Establish approved vendor lists with qualification criteria and audit schedules.
  

• Internal Audit Protocols: Conduct weekly Metrc reconciliation identifying discrepancies before state inspections. Review all COAs for accuracy and completeness before product release. Mock recalls test system effectiveness and identify gaps in traceability.
  

Closing Thoughts — Staying Compliant with Arvida Labs

In an industry where regulations change every other week and scrutiny is constant, brands cannot think about compliance as just a box to check. It is the foundation of long-term brand survival. At Arvida Labs, we make compliance an operational priority, not an afterthought. Our white-label services are designed to give cannabis companies peace of mind by managing every stage of the process, from sourcing raw materials to formulation, blending, filling, and packaging. With GMP-compliant facilities, third-party verified testing, and rigorous documentation, we ensure that every finished product meets or exceeds the standards regulators demand.

Our cannabinoid distillates and isolates provide the clean, consistent inputs brands need to build compliant products without the risk of contamination or failed audits. By partnering with Arvida, companies avoid costly recalls and reputational damage while accelerating speed to market with confidence.

We don’t just provide cannabinoids, we provide a safety net. Contact us to learn more today and stay compliant with Arvida Labs.

Frequently Asked Questions

What Happens When a Product Fails COA Testing?

Failed COA tests trigger immediate administrative holds preventing all product movement until resolution. Operators must notify state regulators within 72 hours and quarantine affected batches. Depending on the failure type, options include remediation (if allowed), retesting (with state approval), or mandatory destruction. California requires labs to upload results to track-and-trace systems within one day, automatically flagging non-compliant products.

Can I Remediate Products that Failed for Pesticides?

No, pesticide failures universally prohibit remediation regardless of contamination levels. Washington state explicitly states pesticide failures may not be remediated, requiring immediate destruction. This zero-tolerance approach reflects pesticide toxicity concerns and the inability to remove residues through standard remediation methods. Operators must destroy affected products and investigate contamination sources to prevent recurrence.

How Long Do I Have to Report Compliance Failures?

Reporting timelines vary by violation type but typically require 24-72 hour notification. Massachusetts requires contamination reporting within 72 hours of identification, though audits found frequent non-compliance with delays up to 16 days. Metrc discrepancies must be corrected within 24 hours of discovery. License violations like expired permits trigger immediate cessation of operations until resolved.

What's the Difference Between Administrative Hold and Recall?

An administrative hold places products on freeze within a facility pending further investigation or remediation. During this hold, distribution, sale, or destruction activities are temporarily prohibited until regulators or operators verify the product’s safety or decide on proper next steps. Administrative holds do not always trigger public notification, especially if the product has not left controlled environments. A recall, by contrast, requires removing products already in market circulation. Recalls mandate public consumer alerts, product retrieval from retailers or consumers, transparent disclosure of contamination or risk details, and often legal reporting obligations.

How Do Potency Variance Limits Affect Compliance?

Most states allow ±10% variance between labeled and tested cannabinoid values, though some require ±15% for edibles due to homogenization challenges. Exceeding variance limits requires relabeling at minimum, with significant overages potentially triggering recalls. Under-potency creates consumer fraud issues while over-potency raises safety concerns, particularly for THC limits in hemp-derived products where exceeding 0.3% delta-9 THC triggers federal violations.

Sources Used for this Article

1. Missouri Division of Cannabis Regulation - Product Recalls. health.mo.gov/safety/cannabis/recalls.php
   

2. Metrc Cannabis Compliance Tracking System. metrc.com
   

3. California Department of Cannabis Control - Testing Laboratories. cannabis.ca.gov/licensees/testing-laboratories/
   

4. Washington State Liquor and Cannabis Board - Quality Control Testing. app.leg.wa.gov/wac/default.aspx?cite=314-55-102
   

5. Canada Health - Mandatory Cannabis Testing for Pesticides. canada.ca/en/public-health/services/publications/drugs-health-products/cannabis-testing-pesticide-requirements.html

   
   

6. Massachusetts Cannabis Control Commission - Pesticide Reporting Audit. mass.gov/info-details/the-cannabis-control-commission-did-not-ensure-that-marijuana-establishments-and-independent-testing-laboratories-properly-reported-marijuana-products-that-tested-positive-for-pesticides
   

7. Cannabis Business Times - Metrc Direct to Consumer Recall Feature. cannabisbusinesstimes.com/vendor-news/news/15753496/metrc-launches-directtoconsumer-product-recall-feature-in-california
   

8. Michigan Cannabis Regulatory Agency - Recall Bulletin. michigan.gov/lara/news-releases/2024/05/15/cra-issues-recall-bulletin-and-product-advisory-bulletin
   

9. 365 Cannabis - Metrc California Recall Process. 365cannabis.com/metrc-california-recall-process/
   

10. Colorado Marijuana Enforcement Division - Metrc Requirements. med.colorado.gov/metrc
    

11. New Jersey Cannabis Regulatory Commission - Testing Guidelines. nj.gov/cannabis/highpoints/20250304.shtml