Most New York processors discover the GMP audit requirement about nine months too late. The rule is short and unforgiving: every adult-use and medical cannabis product in the state must be processed to Good Manufacturing Practice standards, and licensed processors must submit proof of a qualified third-party GMP audit to the Office of Cannabis Management within one year of commencing licensed operations. There are no exceptions to the GMP standard itself. GMP certification for cannabis processors in New York is not a badge you add once you're profitable — it's a condition of keeping your license in good standing. This guide from Cannaspire's cannabis consultants covers the rule, the deadline, which federal standard applies to your products, who is authorized to audit you, and how to get certified without burning your first year.
Clock already running on your audit? We take New York processors from gap assessment to certificate. Get a free 30-minute consultation.
Schedule a CallWhat's in this guide
- The rule: what New York actually requires
- Part 111 or Part 117 — which applies to you
- The one-year audit deadline and renewals
- Who is authorized to audit you
- Conditional exemptions (Type 3 and microbusiness)
- What a GMP audit actually covers
- How to get GMP certified in New York
- Proof it works: a New York case study
- How Cannaspire helps
- Frequently asked questions
The rule: what New York actually requires
New York's requirement lives in two places in Title 9 of the NYCRR. Section 123.6(a) governs adult-use cannabis processors. Section 113.12(d)(2) governs Registered Organizations — the vertically integrated operators that manufacture and dispense medical cannabis. Both point to the same standard.
Stripped to its essentials, the Office of Cannabis Management (OCM) requires three things:
- Process to GMP standards, always. All adult-use and medical cannabis products must be processed in accordance with Good Manufacturing Practice standards, as applicable for the product type. OCM's own Adult-Use Good Manufacturing Practices guidance states plainly that there are no exceptions to this requirement.
- Maintain those standards for the full license period. Not just at inspection. Processor licenses run two years, and GMP standards apply throughout.
- Prove it with a third-party audit. Licensees authorized to conduct certain processing activities must submit proof of a qualified third-party GMP audit of their extraction and/or manufacturing processes, to the satisfaction of the Office, within one year of commencing licensed operations.
The distinction that trips people up: processing to GMP standards and holding a third-party GMP certificate are two separate obligations. A conditional exemption can relieve you of the second. Nothing relieves you of the first.
What "GMP" means here. New York doesn't write its own manufacturing code. It adopts the FDA's — specifically 21 CFR Part 111 (dietary supplements) or 21 CFR Part 117 (human food), depending on the product. Your cannabis facility is being held to a food and supplement manufacturing standard. If your operating plan was written for a cultivation mindset, that gap is where audit findings come from.
Part 111 or Part 117 — which applies to you
Getting this wrong at the start means building the wrong quality system. OCM's guidance is clear that the determination turns primarily on the intended use of the product.
| Standard | Covers | Typical cannabis products |
|---|---|---|
| 21 CFR Part 111 | Manufacturing, packaging, labeling, and holding of dietary supplements — products intended to supplement the diet (herbs and botanicals, extracts, concentrates, and combinations) | Capsules, tinctures, softgels, and similar ingestible supplement-style formats |
| 21 CFR Part 117 | Current GMP for human food, with an emphasis on preventive controls, hazard analysis, and a comprehensive food safety plan | Edibles, beverages, and other products consumed as food |
Part 117 carries the heavier analytical burden — hazard analysis and risk-based preventive controls are baked into the standard, not bolted on. If your product mix spans both categories, your quality system has to satisfy both. That is a design decision worth making before you sign a lease, not after.
The one-year audit deadline and renewals
The clock starts when you commence licensed operations — not when you're awarded the license, and not when construction finishes. Within one year of that date, proof of a qualified third-party GMP audit must be submitted to OCM.
| Milestone | Timing | What it means for you |
|---|---|---|
| Operations commence | Day 0 | The one-year audit clock starts |
| Readiness work | Months 0–8 | Gap assessment, facility corrections, QMS build, SOPs, training, internal audit |
| Third-party audit | Months 8–11 | Audit by an OCM-authorized certification body; corrective actions closed out |
| Proof submitted | By month 12 | Certificate emailed to compliance@ocm.ny.gov, subject line: license number and "GMP Audit Certificate" |
| License renewal | Every 2 years | An updated GMP audit or certification is required at each renewal |
Two details that matter more than they look. First, this is not a one-and-done exercise — processors required to provide proof of a qualified third-party audit must submit an updated audit or certification at every license renewal. Second, an audit completed earlier can still count, provided it falls within the required window (within one year of commencing operations, or within one year of the previous renewal). As you approach the end of a two-year licensure period, plan on another audit.
Twelve months is less runway than it sounds. Scheduling with an authorized certification body, remediating findings, and closing corrective actions all consume calendar. Work backwards: if the audit needs to happen in month nine or ten to leave room for corrective actions, your gap assessment and documentation build have to start in month one. Operators who begin at month eight are usually negotiating with a deadline they can't move.
Not sure where your gaps are? A GMP gap assessment turns a vague deadline into a dated, owner-assigned task list.
See Our GMP ServicesWho is authorized to audit you
This is where operators lose the most time and money. A GMP audit only counts if it is conducted by an accredited third-party certification body that OCM has authorized. An audit from a reputable firm that isn't on the Office's list will not, on its own, satisfy the requirement.
OCM publishes and periodically revises a list of Approved Adult-Use Cannabis GMP Auditors. As of the list revised July 21, 2026, three certification bodies are approved to audit adult-use cannabis processor licensees in New York:
- Kiwa ASI LLC
- Apple Leaf LLC
- Perry Johnson Registrars Food Safety Inc.
Because this list is short and revised over time, always pull the current version from the resources section of OCM's GMP page before you engage anyone. If a certification body you want to use is not listed, OCM directs licensees to contact the Office at compliance@ocm.ny.gov rather than assume.
A short approved list also means limited capacity. Three bodies serving every plant-touching processor in New York is a scheduling constraint, not just an administrative detail. Book early.
Conditional exemptions (Type 3 and microbusiness)
New York offers a narrow off-ramp from the audit requirement — not from GMP itself. Only Adult-Use Type 3 processor licensees and microbusiness licensees may request a conditional exemption, and only if processing activities are limited to a specific short list:
- Packaging, labeling, and branding of whole flower, with no further grinding of cannabis on site.
- Packaging, labeling, and branding of non-infused pre-rolls, provided the flower is purchased pre-ground and no grinding is conducted by the licensee.
- Packaging, labeling, and branding of kief that may be pressed into pucks using a punch press, provided no grinding of cannabis is conducted by the licensee.
Note the through-line: grinding cannabis flower is never exempt. OCM excludes it explicitly on employee-protection grounds. If you grind, you audit.
Three things operators misread about exemptions. First, an exemption is conditional — it requires a submitted request and written approval from the Office; you are not exempt because you believe you qualify. Second, it applies exclusively to the listed activities and product types; add a single processing activity or product outside that list and you must undergo a full audit and certification. Third, and most important: an approved exemption does not relieve you of the obligation to follow and execute GMP standards for the product type you're processing. You still need the SOPs, the sanitation program, the records, and the training.
If you're still deciding between Type 1, Type 2, and Type 3, that choice determines your GMP burden more than almost any other decision — see our full New York cannabis processor license guide for how the three types compare.
What a GMP audit actually covers
OCM's guidance organizes GMP into six major sections:
- Management Commitment
- Risk Management
- Quality Management Systems
- Site & Facility Management
- Product Controls
- Staff Training
Underneath those, OCM notes that GMP audits typically include a substantial set of technical requirements. The list is long, and it's worth reading as a scoping document rather than a summary:
- Quality and documentation: document control and recordkeeping, internal audits, verification and validation, corrective and preventive actions (CAPAs), regulatory compliance
- Product and process controls: HACCP, risk-based preventive controls, product testing, hold and release controls, product identification and traceability, packaging and labeling controls, chemical controls, allergen management
- Facility and environment: cleaning and sanitation controls, pest control, environmental monitoring, equipment and utensils, water safety and quality management, air safety and quality management, waste management, storage and distribution controls
- People and response: employee training, personnel practices (cGMP/cGAP), supplier controls, complaint management, recall program, crisis management
Read that list against your current operation and the shape of the work becomes obvious. Most of it is documentation and behavior — SOPs that match what people actually do, logs that get filled in daily, training records that prove competency. That's why GMP failures are rarely equipment failures. They're evidence failures.
Build the program an auditor expects to see
Cannaspire builds working quality systems for New York processors — gap assessment, SOPs, logs, training, and audit readiness — designed to be used daily, not stored in a binder.
Talk to a GMP ConsultantHow to get GMP certified in New York
There is no single "apply for GMP certification" form in New York. Certification is the output of a readiness program that ends with a successful third-party audit. Here's the sequence that works:
1. Confirm your standard and your scope
Determine whether Part 111, Part 117, or both apply based on your intended product uses. Then define the scope of certification — which rooms, which processes, which SKUs. Scope discipline here saves months later.
2. Run a GMP gap assessment
Assess the operating plan and the physical processing area against the standard: people flow and material flow, segregation of activities to prevent contamination and mix-ups, and cleanability of finishes. This is the step that most often reveals that the room you planned to use is the wrong room.
3. Fix the facility before you paper over it
Cleanable surfaces, controlled access, defensible traffic patterns, temperature and humidity control, pest exclusion. Documentation cannot compensate for a building that can't behave like a manufacturing space.
4. Build the quality management system
Document control and versioned SOPs, batch and lot traceability, sanitation and hygiene, quality control checks, testing and COA management, nonconforming product handling, CAPAs, recall and complaint management, training, and recordkeeping with defined retention. Write procedures that match your real equipment and staffing — not templates.
5. Qualify vendors and labs
New York requires processors to test product lots and follow sampling and testing protocols supported by permitted labs. Establish chain-of-custody workflows — sample integrity, documented handling, tracking — and qualify the vendors supplying materials, packaging, and services.
6. Train the team and document competency
Role-based training with a training matrix and documented completion. An auditor will ask an operator what the procedure says. The answer matters.
7. Run an internal readiness audit
Use a detailed checklist with named owners, due dates, and objective evidence for each line. Find your own findings before the certification body does.
8. Engage an OCM-authorized certification body
Book early with an auditor from the Office's approved list, complete the audit, and work through any corrective actions the accrediting body issues.
9. Submit proof to OCM — and calendar the renewal
Email your certificate to compliance@ocm.ny.gov with your license number and "GMP Audit Certificate" in the subject line. Then put the renewal audit on the calendar immediately, because it's coming.
A scoping tactic worth stealing: certify the processing space for the minimum viable number of SKUs first. Additional SKUs can be added later through additional SOPs — without repeating the full lift of achieving certification. Operators who try to certify a maximal product catalog on the first pass routinely miss the one-year window.
Proof it works: a New York case study
A New York organic outdoor farm — roughly 50,000 sq. ft. of cultivation, with legacy farm buildings earmarked for processing — came to Cannaspire with a hard 12-month deadline to submit proof of a qualified third-party GMP audit. The buildings were functional for agriculture and entirely unsuited to controlled manufacturing: porous surfaces, mixed-use storage, pest and pollen ingress, inconsistent climate control, and traffic patterns that crossed clean and dirty operations.
From heritage farm building to GMP-ready processing
Cannaspire ran the GMP gap assessment, recommended relocating GMP operations to a better-suited space on the farm, built the quality management system, qualified vendors and labs, trained the team, and managed corrective actions through to certification — without compromising the farm's organic and sustainability standards.
- 150+pages of controlled documentation — SOPs, forms, logbooks, quality plan
- 200item GMP readiness audit checklist with owners and evidence
- 12 mo.audit completed and proof submitted inside the required window
The pivotal moment wasn't documentation — it was a facility call. The client had proposed one building as the GMP space; Cannaspire's analysis showed it would create avoidable GMP risk and constant timeline pressure. Relocating to a space that could better support zoning, segregation, and utilities is what made the deadline achievable. The engagement continues today with scheduled checkpoints to keep the program running.
Read the full breakdown, including the four workstreams and Chief Compliance Officer Warren Harasz's account of the project: Case Study: From Heritage Organic Farm to GMP-Ready Cannabis Processing (New York).
How Cannaspire helps
GMP projects fail when they're treated as paperwork. Cannaspire treats GMP as an operating system — facility decisions tied to contamination control and defensible flow, documents written to match real behaviors and staffing, testing and chain of custody operationalized rather than outsourced as an afterthought.
For New York processors and Registered Organizations, our cannabis GMP services cover the full arc:
- GMP gap assessment and facility strategy — evaluate your proposed processing area against Part 111/117 for flow, segregation, and cleanability, and recommend the retrofit path that actually hits your deadline.
- Quality management system build — custom SOPs, logs, and operations manuals written to your equipment, your products, and your brand, not pulled from a template library.
- Vendor, lab, and chain-of-custody qualification — sampling and testing workflows that hold up under audit scrutiny.
- Training, internal readiness audits, and corrective action management — including vetting the accrediting body and working findings through to closure.
- Renewal-cycle support — because the audit repeats at every license renewal.
Many operators pair a defined certification project with ongoing support. Cannaspire's retainer services give processors a dedicated cannabis compliance consulting partner across the license period — scheduled checkpoints, program upkeep, and renewal readiness — without building that expertise in-house. Our New York cannabis consultants work with operators from application through daily operations.
Get GMP certified before the clock runs out
Schedule a free 30-minute consultation. We'll review your facility, your product mix, and where you are in the one-year window — then map the path to a certificate. No commitment, no pressure.
Schedule a Free ConsultationFrequently asked questions
Is GMP certification required for cannabis processors in New York?
How long do I have to get a GMP audit in New York?
Who can perform a GMP audit for a New York cannabis processor?
Does 21 CFR Part 111 or Part 117 apply to my cannabis products?
How do I submit proof of my GMP audit to OCM?
Can a microbusiness or Type 3 processor skip the GMP audit?
How much does GMP certification cost in New York?
Do Registered Organizations and medical cannabis operators need GMP too?
Turn a compliance deadline into an operating advantage
Cannaspire has taken New York operators from legacy buildings to certified GMP processing space — on deadline. Work with our New York cannabis consultants and add ongoing retainer support so your program holds up between audits.
Schedule a Free ConsultationDisclaimer: This guide reflects New York's cannabis GMP requirements as published by the Office of Cannabis Management as of July 2026, including 9 NYCRR §123.6 (adult-use processors) and §113.12 (Registered Organizations), OCM's GMP Audit Guidance Document and GMP FAQ, and the Approved Adult-Use Cannabis GMP Auditors list revised July 21, 2026. The approved auditor list, guidance documents, and regulations are revised periodically. This content is for informational purposes only and does not constitute legal, tax, or financial advice. Verify current requirements directly with the Office of Cannabis Management before making business decisions. Last updated: July 2026.