Everything a European patient receives from a pharmacy has passed through a two-standard quality system. GACP (Good Agricultural and Collection Practice) governs the plant while it is still a plant, from cultivation to drying. EU-GMP (European Union Good Manufacturing Practice) takes over from post-drying processing all the way to final release. Layered on top is a mandatory battery of laboratory tests for cannabinoid content, terpenes, microbial contamination, heavy metals, pesticides, residual solvents and more, summarised in a Certificate of Analysis (CoA) that follows every batch. Together, these systems are the reason a gram of cannabis dispensed in Berlin, Lisbon or London can credibly be called a medicine.
Every article we have written so far in this series has ended with the same underlying promise: whatever is happening on the plant, in the extractor, in the formulation lab or in the packaging line, the finished product a patient collects from a pharmacy has to be safe, consistent and exactly what its label says it is. Quality assurance is the system that turns that promise into a documented fact.
It is also, quietly, the most European part of the whole industry. The bar that EU-GMP sets is high enough that only serious operators can play at commercial scale, and the resulting quality gap is a big part of why Europe has become the world’s most credible medical cannabis market.
This is the eighth and final article in our Cannabis 101 series. In the previous article we walked through the extraction methods and refinement steps that turn cured flower into finished oils, distillates and isolates. Here we close the loop and look at how everything we have covered across the series, cultivation, extraction, formulation, is proven safe and consistent before it ever reaches a patient.
Why quality assurance sits at the centre of European medical cannabis
Medical cannabis is unusual as a pharmaceutical starting material. It is a whole botanical crop, grown in living rooms and controlled greenhouses, that has to be dispensed with the same reliability as an aspirin. Two things have to be true at the same time:
🟣 Safety. Nothing harmful in the product. No moulds, no pathogenic bacteria, no pesticide residue, no heavy metals absorbed from the soil, no leftover extraction solvents, no mycotoxins from poor drying.
🟣 Consistency. Every batch of the same product must deliver the same active-ingredient profile. A patient stabilised on 10 mg of THC per dose needs to keep getting 10 mg of THC per dose, batch after batch, month after month, year after year.
Achieving both at the same time is what the European quality-assurance system is designed to do. It splits the work between two standards that hand off to each other, and it verifies the result with laboratory testing at multiple points along the way.
🌱 Fun fact:
European medical cannabis is subject to a stricter overall quality regime than most conventional pharmaceuticals, precisely because it is a natural product with inherent variability. Very few other medicines require both an agricultural quality standard and a pharmaceutical manufacturing standard to be maintained side by side across the whole supply chain.
GACP: the field-and-drying-room standard
GACP stands for Good Agricultural and Collection Practice. It is the standard that governs everything from the moment a cannabis seed or clone is planted through to the moment its harvested flower has been dried and is ready to enter the processing side of the operation.
GACP-compliant cultivation covers, among other things:
🟣 Seed and cultivar selection. Documented genetic identity of every plant in the room; no unknown or unverified genetics.
🟣 Growing environment. Controlled temperature, humidity, light, water and air quality, with validated equipment and continuous logging.
🟣 Nutrient and pesticide management. Restricted list of permitted inputs, full traceability of what was applied, when and at what concentration.
🟣 Pest and disease control. Documented integrated pest management strategy that avoids or minimises chemical intervention.
🟣 Harvest, drying and initial post-harvest handling. Controlled environmental conditions during drying, chain-of-custody paperwork on every batch of dried material.
🟣 Documentation. Standard operating procedures for every step, batch records, training records for every worker, and a full audit trail.
GACP is the reason a well-run European medical cultivation facility looks less like a farm and more like a hybrid of a laboratory and a hospital. Everyone is gowned, everything is logged, every input is measured, and every deviation gets recorded. It is also the standard that a national competent authority will inspect against when a producer applies to supply the medical market.
Once the dried material leaves the drying room, however, GACP hands off. Everything from that point onward sits under a stricter regime: EU-GMP.
EU-GMP: the pharmaceutical standard
EU-GMP stands for European Union Good Manufacturing Practice. It is the same regulatory framework that governs the manufacture of every conventional pharmaceutical medicine sold in Europe, applied to cannabis from post-drying processing all the way to the finished packaged product on a pharmacy shelf.
EU-GMP compliance covers, among other things:
🟣 Facility design. Cleanrooms with controlled airflow, air-lock entry systems, segregated areas for incoming material and finished product, materials of construction that can be validated and cleaned.
🟣 Equipment qualification and validation. Every piece of processing, extraction, distillation, filling, packaging and labelling equipment must be qualified against a written specification and re-validated on a schedule.
🟣 Personnel training. Documented training programmes for every role, from operators to QA to quality persons responsible for batch release.
🟣 Standard operating procedures. Every action anyone takes in the facility is described in an approved SOP, and the batch record proves the SOP was followed.
🟣 Batch documentation. Every batch has a full paper trail: input materials, in-process controls, analytical test results, deviations, corrections and final release sign-off.
🟣 Change control and deviation management. Any change to equipment, process, supplier or specification triggers formal review before it can be implemented.
🟣 Recall procedures. Ability to identify and recall a specific batch quickly if a problem is discovered post-release.
Achieving EU-GMP certification typically takes 12–24 months of preparation, requires investment ranging from several hundred thousand to several million euros in facility upgrades and quality systems, and culminates in an on-site inspection by a national competent authority. In Germany that inspection is coordinated through the ZLG network on behalf of BfArM (the federal medicines regulator); in Portugal it is INFARMED; every European jurisdiction has its own inspecting authority. Certification is not a one-time achievement: facilities are re-inspected on a regular cycle, and failure to maintain the standard results in loss of certification and loss of market access.
Almost every cannabis product sold through a German or UK pharmacy today was made in an EU-GMP-certified facility somewhere in Europe or Canada. It is the entry ticket to the market, and it is why the number of credible producers in Europe is still comparatively small.
🌱 Fun fact:
EU-GMP was not invented for cannabis. The framework has been in use for decades to regulate the manufacture of conventional pharmaceutical medicines across the European Union, and cannabis producers essentially inherited it wholesale when medical markets began opening in the 2010s. Cannabis is one of the newest industries to have to meet a standard that pharmaceutical companies have been operating under since long before any of us started reading about cannabinoids.
Laboratory testing: what actually gets measured
Documented processes only prove that a producer followed their own SOPs. Proving that the resulting product is actually safe and consistent requires laboratory testing, and every batch of European medical cannabis is subjected to a battery of analytical tests before it can be released for sale.
The core tests every batch typically has to pass include:
🟣 Cannabinoid potency. Quantification of THC, CBD and often several minor cannabinoids (CBG, CBN, CBC, THCV) plus their acidic precursors (THCA, CBDA), typically by HPLC (high-performance liquid chromatography). This is the test that produces the potency numbers on the product label.
🟣 Terpene profile. Identification and quantification of the dominant terpenes (myrcene, limonene, pinene, linalool, caryophyllene and others), typically by GC-MS (gas chromatography-mass spectrometry). This produces the terpene profile that defines the product’s chemovar (see Article 4).
🟣 Microbial contamination. Total aerobic microbial count, yeast and mould count, and screening for specific pathogens such as Salmonella, Escherichia coli and Aspergillus. Contamination at any of these points can fail a batch outright.
🟣 Heavy metals. Testing for arsenic, cadmium, lead and mercury, which cannabis plants can absorb from contaminated soil or water. Typically measured by ICP-MS (inductively coupled plasma mass spectrometry).
🟣 Pesticide residues. Screening for dozens of individual pesticides against tight regulatory limits, using GC-MS and LC-MS.
🟣 Residual solvents. For extract-based products, testing that the ethanol, CO2 or hydrocarbon solvent used in extraction (see Article 7) has been removed to well below regulatory limits.
🟣 Mycotoxins. Screening for toxins produced by mould, particularly aflatoxins and ochratoxin A, which can occur if drying and curing were mismanaged.
🟣 Moisture content and water activity. Confirming the flower is neither too wet (mould risk) nor too dry (harshness, terpene loss).
🟣 Foreign matter. Visual and microscopic inspection for stems, seeds, insects, hair, dust or any other unwanted material.
Each of these tests is performed by an accredited analytical laboratory, either in-house at the producer or at an independent third party. The results are compiled into the batch’s Certificate of Analysis, which then travels with the product all the way to the pharmacy.
The Certificate of Analysis: reading between the lines
The Certificate of Analysis, universally shortened to CoA, is arguably the single most important document in the European medical cannabis industry. It is the paper (or PDF) that summarises everything a laboratory measured on a specific batch, and it is the reason a prescriber can write a prescription confident that the product will behave the way it is supposed to.
A typical medical cannabis CoA includes:
🟣 Batch identity. Producer name, product name, cultivar, batch number, date of manufacture, expiry date.
🟣 Cannabinoid content. Percentage or milligram-per-gram values for each measured cannabinoid.
🟣 Terpene profile. Percentage or milligram-per-gram values for each measured terpene.
🟣 Contaminant results. Pass/fail results for every microbial, heavy metal, pesticide, solvent and mycotoxin test, usually reported against the specific regulatory limits.
🟣 Physical parameters. Moisture content, water activity, appearance.
🟣 Laboratory and signatory. Name and accreditation of the testing laboratory, plus the signature of the qualified person who released the batch.
The CoA is the document that lets a pharmacist answer a patient’s questions about a specific jar of flower or bottle of oil with actual data rather than marketing claims. It is also the document a regulator will ask for first if anything is ever queried about a batch.
Understanding how to read a CoA, and knowing when a CoA looks incomplete or suspicious, is one of the most valuable practical skills a professional entering the European medical cannabis industry can pick up.
🌱 Fun fact:
The Certificate of Analysis format used in cannabis today is essentially the same document format used across food, cosmetics, pharmaceutical excipients and industrial chemicals. Cannabis is late to the party of “every batch of anything gets a CoA”, but the party has been running for decades in the industries next door.
Why quality assurance matters to jobs in the European cannabis industry
Quality assurance is where every part of the industry we have covered across this series comes together, and it is one of the most active hiring corners of the European market today:
🟣 Quality assurance and quality control professionals are the beating heart of any EU-GMP-certified producer. QA writes and maintains the quality system; QC runs and interprets the tests. Both are essential and neither role scales without the other.
🟣 Qualified Persons (QPs) are legally responsible for the release of every batch of medicinal product from an EU-GMP site. The QP role is a specific regulated position across European jurisdictions and one of the most in-demand hires in the medical cannabis industry.
🟣 Regulatory affairs professionals manage the ongoing relationship between the producer and the national competent authorities: submitting variations, hosting inspections, filing incident reports and keeping certification current.
🟣 Analytical chemists and laboratory technicians run the HPLC, GC-MS, LC-MS and ICP-MS instruments that produce the test results underlying every CoA. Analytical capability is one of the most technically-loaded corners of the industry.
🟣 Compliance and validation specialists design and execute the qualification and validation studies that prove equipment, cleanrooms, processes and analytical methods do what they are supposed to do.
🟣 Facility engineers and cleanroom specialists build and maintain the physical environments in which all of the above happens.
🟣 Business leaders across the industry use EU-GMP status as a strategic asset. It is often the single biggest determinant of whether a producer can sell into Germany, the UK, Portugal, the Netherlands and other regulated European markets.
Understanding EU-GMP, GACP and Certificates of Analysis is arguably the most transferable knowledge in medical cannabis today. Every producer needs it, every regulator expects it, and every patient depends on it, whether they know the acronyms or not.
Closing the series
This is the last article in our Cannabis 101 series, and it feels fitting to close on quality. Across the eight articles we have covered:
🟣 The 10,000-year history of cannabis and how it returned to European pharmacies.
🟣 The anatomy of the plant from roots to trichomes.
🟣 The chemistry of cannabinoids and terpenes and the still-contested entourage effect.
🟣 The taxonomy debate around sativa, indica, ruderalis, hybrids and the shift toward cultivars and chemovars.
🟣 The cultivation lifecycle from seed to cured flower.
🟣 The product formats and consumption routes that reach the patient.
🟣 The extraction methods that turn flower into oils, distillates and isolates.
🟣 And, in this article, the quality assurance systems that make sure all of the above ends up as a safe, consistent, patient-ready medicine.
The point of the series was never to make anyone into an expert in a single article, but to hand any professional stepping into the European medical cannabis sector the shared vocabulary and mental models that everyone in the industry is quietly working with. Cultivators, extractors, formulators, chemists, prescribers, pharmacists, compliance officers, commercial leaders: all of them are speaking the same language, and now, so can you.
If you are exploring roles in the European cannabis industry, or hiring for one, we would love to hear from you.
Frequently asked questions
What is the difference between GACP and EU-GMP?
GACP (Good Agricultural and Collection Practice) governs everything from cultivation to drying: the plant while it is still a plant. EU-GMP (European Union Good Manufacturing Practice) takes over from post-drying processing all the way to final packaged product. GACP is an agricultural quality standard; EU-GMP is a pharmaceutical manufacturing standard. Serious European medical cannabis producers are certified under both.
What tests does medical cannabis have to pass?
Every batch of European medical cannabis is typically tested for cannabinoid potency, terpene profile, microbial contamination (including yeast, mould and specific pathogens), heavy metals, pesticide residues, residual solvents (for extracts), mycotoxins, moisture content and foreign matter. Results are compiled into a Certificate of Analysis that follows the batch to the pharmacy.
What is a Certificate of Analysis (CoA)?
A Certificate of Analysis is the document that summarises every laboratory test performed on a specific batch of cannabis, along with the batch’s identity, cannabinoid and terpene content, contaminant results, and the signature of the qualified person who released the batch. It is the primary document that lets prescribers and pharmacists trust that a product is what its label says it is.
Who inspects and certifies EU-GMP cannabis facilities?
Each European country has its own national competent authority. In Germany the process is coordinated through the ZLG network on behalf of BfArM; in Portugal it is INFARMED; other European jurisdictions have their own regulators. Certification typically takes 12–24 months of preparation, is capital-intensive, and requires ongoing re-inspection to maintain.
Why is quality assurance so important in medical cannabis?
Because cannabis is dispensed as medicine. A patient stabilised on a specific dose of a specific product needs that product to be safe, consistent and exactly what its label claims, batch after batch. Quality assurance is the system that turns a variable agricultural crop into something a European pharmacy can dispense with the same reliability as an aspirin.
References
- EU-GMP certification for cannabis: the complete 2026 guide (GrowerIQ)
- Is medical cannabis legal in Germany? (GvW Graf von Westphalen)
- Germany medical cannabis legislation and market data (Prohibition Partners)
- What are the GMP requirements for medical cannabis? (ECA Academy)
- Medicinal cannabis: what it takes to be GMP-ready (Cleanroom Technology)
- European cannabis regulations by country: the 2026 business guide (Cannabis Europa)
- Process development for GMP-grade full-extract cannabis oil (PMC, 2024)
- The history of cannabis: 10,000 years of medicine, prohibition and revival (Lumino, Cannabis 101, Article 1)
- Cannabis plant anatomy: a field guide from roots to trichomes (Lumino, Cannabis 101, Article 2)
- THC, CBD and terpenes: the chemistry behind cannabis (Lumino, Cannabis 101, Article 3)
- Sativa, indica, ruderalis and hybrids: the cannabis taxonomy debate (Lumino, Cannabis 101, Article 4)
- Cannabis cultivation lifecycle: from seed to harvest and beyond (Lumino, Cannabis 101, Article 5)
- Medical cannabis products: from flower to oil, vaporiser to tincture (Lumino, Cannabis 101, Article 6)
- Cannabis extraction methods: from flower to oil, distillate and rosin (Lumino, Cannabis 101, Article 7)
English (UK)
Deutsch