Cannabis Regulations And B2B Documentation: The Compliance Guide For Buyers

If you buy cannabis ingredients for a living, you already know the paperwork is the product. The flower, the distillate, the terpene blend, none of it moves through interstate commerce, gets onto a dispensary shelf, or clears a brand's QA team without a stack of documents behind it. And the rules behind those documents change depending on the state line you cross, the country you ship to, and the week you happen to be reading the Federal Register.

This guide walks through how cannabis regulations actually work in 2026, what counts as adequate cannabis product documentation, what a real COA cannabis report looks like, and what your cannabis compliance B2B checklist should include before you cut a purchase order. Written for dispensary buyers, brand owners, formulators, and procurement teams who do not have time for fluff.

Why Cannabis Regulation Is Fragmented

There is no single cannabis rulebook. There are dozens, sometimes in conflict with each other. Cannabis remains a Schedule I controlled substance under the federal Controlled Substances Act, even as 38 states plus DC have legalised medical use and 24 states have legalised adult-use sales, according to Wikipedia's tracking of state cannabis laws.

That conflict is the whole story. A product can be fully legal in California, taxed by the state, sold through a licensed retailer, and still technically illegal under federal law the moment it crosses a state line. So compliance is built locally. Each legal state runs its own regulator, its own testing rules, its own labelling requirements, and its own approved methods. A COA that satisfies Colorado will not necessarily satisfy New York, and a hemp product that ships freely in Texas may be restricted in California.

For B2B buyers, the takeaway is simple. You cannot buy off a generic "compliant" claim. You buy off documents that match the jurisdiction you are selling into.

The Current US Federal Status

Three things are happening at the federal level at the same time, and you need to keep them separate in your head.

1. Marijuana is still Schedule I (mostly)

In August 2023, the US Department of Health and Human Services recommended moving marijuana from Schedule I to Schedule III, and in May 2024 the Drug Enforcement Administration formally proposed that rule, drawing more than 42,000 public comments, as documented by Wikipedia's record of the rulemaking. The process stretched through administrative delays into 2026, when a partial action reclassified FDA-approved cannabis products and state medical marijuana to Schedule III. Broad recreational cannabis remained in Schedule I as of that action.

2. Hemp is federally legal under the 2018 Farm Bill

The Agriculture Improvement Act of 2018, commonly called the 2018 Farm Bill, carved hemp out of the definition of marijuana in the Controlled Substances Act. Hemp is defined as cannabis containing no more than 0.3 percent delta-9 THC on a dry weight basis, and it is no longer a controlled substance, per the FDA's standing guidance on cannabis-derived products. The same guidance preserves FDA authority over hemp products in food, supplements, and cosmetics.

3. State legalisation runs parallel to all of it

States have built complete regulatory regimes around the federal vacuum. They license cultivators, manufacturers, distributors, retailers, and testing labs. They write the testing panels. They issue and revoke COAs. For most B2B buyers, the state regulator is the agency you actually deal with day to day.

The Documents A B2B Buyer Actually Needs

Forget the generic "we are compliant" line in a supplier's email. Compliance lives in a specific set of documents. If your supplier cannot produce these on request, that is the answer.

Document	What it proves	When you need it
Certificate of Analysis (COA)	Lab-tested cannabinoid and terpene content, contaminant pass/fail	Every batch, every product
Safety Data Sheet (SDS / MSDS)	Hazard classification, handling, storage, first aid, transport	Concentrates, isolates, terpenes, solvents
Certificate of Origin	Country and facility of production, chain of custody	Import, export, customs clearance
FEMA GRAS attestation	Flavor ingredient recognised as Generally Recognized As Safe by FEMA	Terpenes and flavor blends used in food applications
State licence copy	Supplier is licensed in jurisdiction of origin	Onboarding, vendor file
GMP / ISO 17025 certificate	Manufacturing or lab quality system accreditation	Pharma-adjacent, EU export, premium retail
Stability data	Product holds spec across shelf life	Liquid formulations, vape carts, edibles

What A Good COA Actually Contains

A COA is a formal lab document detailing analytical test results, signed by an authorised representative of the testing entity, as defined by Wikipedia's reference on certificates of analysis. In cannabis, that means a specific panel of tests with pass/fail results against state limits. A complete COA should include:

• Identification: sample ID, batch or lot number, product description, sample weight, date received, date tested, date reported.
• Laboratory information: lab name, address, licence number, ISO/IEC 17025 accreditation reference, signing analyst.
• Cannabinoid profile: THC, THCA, total THC, CBD, CBDA, CBG, CBN, CBC and minor cannabinoids, reported as percentage by weight and mg per unit.
• Terpene profile: individual terpenes in percentage or mg per gram, with a clear limit of quantitation.
• Pesticides: screen against the state's mandated list, with action levels and pass/fail. California, for example, currently requires testing for 66 pesticides, according to the California Department of Cannabis Control.
• Heavy metals: lead, arsenic, cadmium, mercury at minimum.
• Microbial contaminants: total yeast and mold, Shiga-toxin producing E. coli, Salmonella, Aspergillus species.
• Mycotoxins: aflatoxins B1, B2, G1, G2 and ochratoxin A.
• Residual solvents: butane, propane, ethanol, benzene, hexane and others, especially relevant for concentrates.
• Moisture content and water activity: for flower and biomass.
• Foreign material: visible contaminants, hair, insect parts.

California's Department of Cannabis Control requires every batch of legal cannabis to clear cannabinoid and terpene quantification, residual solvents, pesticides, heavy metals, microbial impurities, mycotoxins, moisture, water activity, and foreign material before release. Other states use similar panels with different action levels.

If a COA you receive only shows a cannabinoid percentage and nothing else, it is not a compliance document. It is a marketing graphic. The difference matters when a buyer is comparing flower against concentrates for a product line, because each format has its own contaminant risk and its own required testing depth.

State-By-State Variability: Three Working Examples

The headline rule is the same everywhere. Test every batch. The detail underneath is where suppliers and buyers come unstuck.

California

The Department of Cannabis Control requires that testing labs hold ISO/IEC 17025 accreditation and a Type 8 testing licence. Labs cannot hold any other cannabis business licence in the state, eliminating the obvious conflict of interest. Every batch is tested against a defined contaminant panel before retail release.

Colorado

Colorado's Marijuana Enforcement Division runs its own testing programme with its own contaminant list, its own action levels, and its own approved methods. A Colorado COA will look different from a California one, even for the same product.

New York

New York's Office of Cannabis Management is newer, and the testing framework has been tuned through several rounds of amendment since adult-use launch. Buyers selling into the New York market should always confirm which version of the testing protocol applies to the lot they are buying.

The practical lesson. A COA from State A is evidence of testing, not evidence of compliance in State B. If you are moving product across state lines as a brand operating in multiple states, you almost always need a fresh COA from a licensed lab in each market.

International: EU, Canada, Australia

If your product touches international markets, the bar climbs.

European Union

Medical cannabis sold into the EU is treated as a pharmaceutical product and falls under EU Good Manufacturing Practice. The European Medicines Agency oversees the framework, and national competent authorities issue EU-GMP certification after facility inspection. Cultivation must meet Good Agricultural and Collection Practice (GACP) standards before processed cannabis can move through a GMP supply chain. The EMA has published guidance on cannabis-derived medicinal products under EU medicines legislation that describes how the framework is applied.

Canada

Health Canada regulates cannabis under the Cannabis Act and the Cannabis Regulations (SOR/2018-144). Licensed processors must test every lot for cannabinoid content, microbial and chemical contaminants, and pesticide active ingredients against published limits, and unauthorised pesticide detections must be reported immediately. THC and CBD content on the label has to match the tested values.

Australia

The Office of Drug Control sits under the Therapeutic Goods Administration and licences cultivation, production, and manufacture of medicinal cannabis. Australia treats medicinal cannabis as a therapeutic good, with TGO 93 setting out quality standards for products supplied through the Special Access Scheme and Authorised Prescriber routes.

Where Terpene Suppliers Fit In The Framework

This is the part most buyers get wrong, and most suppliers do not bother to clarify. Botanical terpenes, isolated from sources outside cannabis, are not controlled substances. A bottle of limonene, myrcene, or beta-caryophyllene sourced from citrus, hops, or clove is a flavor ingredient. It does not contain THC, it does not derive from cannabis, and it does not sit on any controlled-substance schedule.

Many of the terpenes used in cannabis-adjacent formulations also carry Generally Recognized As Safe status through the Flavor and Extract Manufacturers Association GRAS programme, which has been evaluating flavor ingredient safety since 1959 and has assessed roughly 2,200 flavoring substances, according to FEMA's published programme overview. The aliphatic and aromatic terpene hydrocarbons used as flavor ingredients have been reaffirmed as GRAS through that process, as documented in peer-reviewed assessment published on PubMed.

That status applies to use in human food. It does not automatically extend to inhalation. Regulators in several jurisdictions have started looking at inhalation toxicology for terpenes used in vape products specifically, and the safety dossier for that route of administration is still being built. If you formulate vape products, you should be asking your terpene supplier about inhalation data, not just FEMA GRAS food status. For a deeper read on how terpenes differ from cannabinoids in chemistry and regulatory treatment, see our guide on terpenes versus cannabinoids.

Entour's terpene chemistry was developed by Dr. Jeffrey C. Raber, Ph.D., an organic chemist who founded one of California's earliest accredited cannabis testing labs, The Werc Shop. The regulatory perspective in our product documentation comes from that history. You can read more about Dr. Raber's background and approach if you want context on why our supplier documentation is structured the way it is.

The B2B Documentation Checklist

Before you sign a purchase order with any cannabis ingredient supplier, work through this list. If they cannot answer yes to most of it, that is a sourcing red flag.

1. Can the supplier produce a batch-specific COA for every lot, not a generic product COA from 18 months ago?
2. Is the testing lab ISO/IEC 17025 accredited, and is it independent from the supplier?
3. Does the COA cover the full panel relevant to your jurisdiction: cannabinoids, terpenes, pesticides, heavy metals, microbials, mycotoxins, residual solvents, moisture, foreign material?
4. Are SDS documents available for every product, current to GHS format, and accurate for the actual material being shipped?
5. Is there a Certificate of Origin showing facility, country, and chain of custody?
6. For terpenes intended for food applications, can the supplier confirm FEMA GRAS status of each component?
7. For inhalation applications, can the supplier provide inhalation toxicology data or a clear statement that the product is not validated for inhalation?
8. Is the supplier's state licence current, and is the licence type appropriate for the product they are selling you?
9. Does the supplier carry product liability insurance, and will they name your business as additional insured?
10. Is there a documented recall procedure in place if a batch fails post-release testing?

This is the floor, not the ceiling. Premium retail accounts, multi-state operators, and pharma-adjacent buyers will ask for stability data, retain samples, supplier audit reports, and method validation packages on top of the above. If you are building a brand for the long term, see our breakdown of what to look for in the best terpene company in 2026 for a procurement framework that goes beyond price.

FAQ

What is a COA in cannabis?

A Certificate of Analysis is a lab-issued document showing the test results for a specific batch of cannabis product. It covers cannabinoid and terpene content plus contaminant testing, and it is signed by an authorised analyst at an accredited laboratory.

Is cannabis legal at the federal level in the US?

Marijuana remains a Schedule I controlled substance under federal law as of 2026, though a partial rescheduling action moved FDA-approved cannabis products and state medical marijuana to Schedule III in April 2026. Hemp containing no more than 0.3 percent delta-9 THC is federally legal under the 2018 Farm Bill.

Are terpenes controlled substances?

Botanical terpenes isolated from non-cannabis sources, such as citrus or hops, are not controlled substances. They are flavor and fragrance ingredients. Many also hold FEMA GRAS status for food use. Terpenes derived from cannabis itself sit under cannabis regulatory frameworks.

What is the difference between a COA and an SDS?

A COA reports the analytical test results for a specific batch of product, confirming what is in it. A Safety Data Sheet covers hazard classification, handling, storage, transport, first aid, and disposal information for the product as a chemical material. Both are needed for most B2B transactions.

Do hemp-derived products need a COA?

While federal law does not mandate a COA for every hemp product, almost every responsible buyer requires one. State hemp programmes, retailer policies, and FDA scrutiny over cannabinoid content make batch-level testing the practical standard for the industry.

How often should a supplier retest a product?

State rules vary, but the strong practice is fresh testing on every production batch, plus stability testing to support shelf-life claims. Many jurisdictions require retesting after processing or repackaging, and some require annual retesting for stored inventory.

Continue reading from our terpene guides

If you want to go deeper on the practical and commercial side of terpenes, these are the guides we update most often in the Entour library.

• Best terpene company for cannabis brands in 2026. How to evaluate a B2B terpene supplier on chemistry, transparency, and consistency.
• B2B guide: how to source wholesale terpenes. Practical sourcing playbook for brands, formulators, and procurement teams.
• Terpene calculator: how much terpene per ounce. Working math for dosing concentrates, edibles, and vape formulations.
• Terpenes in edibles and beverages: a formulator's guide. Format-specific considerations for ingestible products.
• The art of terpene combinations: creating custom blends. How experienced formulators stack terpenes for target profiles.
• The high-stakes world of online terpene shopping. What to verify before paying any online terpene vendor.
• Top terpene trends in 2026. Where formulation, regulation, and consumer demand are heading next.
• What is the terpene that causes psychedelic effects?. A look at the science behind reported psychedelic-leaning terpene profiles.

Browse Entour's terpene catalogue

Looking at specific product formats? Jump straight to Live Terpenes · Native® blends · Inspired® blends · Live Derived® blends · Effects blends · Single terpene isolates · Sample packs.