Who verifies GACP compliance for medical cannabis?

The buyer verifies it, through audits of the grower. Revision 1 of the EMA guideline on Good Agricultural and Collection Practice, adopted by the Committee on Herbal Medicinal Products on 9 July 2025, asks for regular audits of cultivation sites and processing facilities by “expert representatives of the buyer/manufacturer”. The text uses the word certified only about organic production, so a GACP certificate sold by a certification body rests on that body’s private scheme. During the public consultation one certification body asked the committee to name certification bodies as auditors, and the committee replied that a third-party contractor can already act as the buyer’s representative. For an importer of medical cannabis, GACP therefore sits inside supplier qualification. For a grower, it means the buyer’s auditors on site, whether or not the grower holds a certificate. I carry out second-party audits for buyers across this supply chain, and this clause defines that work.

It says, in section 3, that expert representatives of the buyer check compliance through regular audits, under a written agreement with the producer that refers to the guideline. The clause on audits reads:

Section 7 adds that the producer keeps a field record as agreed with the buyer, together with “The audit reports, including those by or on behalf of the GMP licensed manufacturers or other parties”.

The EMA page for the guideline lists Revision 1 as adopted and published on 12 August 2025, with no separate date of coming into effect. The handover from GACP to GMP is a separate question. I covered it in where GMP starts for medical cannabis, and on 10 September I sat on the round table on the future of EU-GMP at PTMC 2026 in Lisbon.

It moved from written quality agreements in 2006 to audits by the buyer in 2025, in three documented steps. Section 3 of the 2006 guideline asked producers and buyers to agree on quality, “such as content of active principle”, and the text mentioned audits only as reports to keep “for a minimum of 10 years”.

In 2021 the committee’s concept paper on the revision listed the points to clarify, among them “diverse practice in Member States, uncertainty about requirements, certification and dossier submission”.

The draft of Revision 1, open for comments from 15 April 2024, brought verification into section 3 with audits “by expert representatives of producers and buyers”. The adopted text reads “by expert representatives of the buyer/manufacturer”, and producers no longer appear in that sentence. The documents give no reason for the change.

It can when it audits for the buyer. In the overview of comments on the draft, a certification body wrote that “The audits can also be performed by independent entities, such as Certification Bodies (third party audits)” and proposed adding “and/or Certification Bodies”. The committee’s answer reads “Partially agreed. The term ‘Expert representatives’ includes the possibility of a third-party contractor.” The adopted text does not contain the proposed words.

A contractor working for the buyer audits against the scope, the agreement and the risks the buyer defines, and reports to the buyer. A certificate the grower commissions answers to the standard of the scheme the grower chose. I made the same point about GMP certificates in August, and it holds for GACP:

It looks at the evidence the guideline asks the producer to keep. Qualifying a supplier means knowing which site performs which step, under which conditions and with which parameters recorded. In the guideline that evidence includes:

• the field record agreed with the buyer, from training and hygiene to fertilisation, pesticide applications and harvest (section 7);
• seeds and propagation material identified by genus, species, variety or chemotype and origin, with their supplier evaluated (section 8), including vegetative propagation, which the guideline says “may be referred to as cloning”;
• drying conditions such as temperature, duration and method, which “must be recorded in detail” (section 12);
• a representative sample of every batch sent to the buyer, “stored for 3 years” (section 14).

For indoor cultivation, Annex 1 of the guideline adds acceptance criteria for cultivation conditions set for each batch, a documented approach to validation, qualification of critical equipment and the rule that “daily (digital) records of critical process parameters must be kept and reviewed”. Before a new cycle, the person responsible for quality approves all materials.

A written agreement and an audit programme, both before the first shipment. The agreement names the guideline, the field record the buyer expects and the right to audit, and the programme sets how often the auditors visit and what expertise they bring. I read audits of the sites as visits, and whether a GMP supplier audit can be done remotely sets out the limits of a desk review.

The grower keeps the field record, the audit reports and the retained samples. A certificate can sit in that file and help the buyer plan the first audit. It leaves the buyer’s own duty under section 3 in place, the duty of the second party described in first-party and second-party audits. Some destination countries add requirements of their own for imported flower, so the agreement also names the market.

Written by

Riccardo Longato

GMP Pharmaceutical Quality Systems Lead Auditor

CQI/IRCA certified lead auditor, certificate no. LA113.

Has spoken at PTMC Lisbon, JIHE Tokyo, AIHEF Bangkok and IndicaSativa Trade Bologna.

LinkedInCredentials and stages