The Compliance Crisis: 10 Emerging Cannabis Compliance Issues in 2025

Kim Anzarut, CEO and founder of Allay Consulting | Image Credit: © Kim Anzarut

As the cannabis industry matures and inches closer to federal reform, compliance is becoming more complex, and more crucial, than ever before. Gone are the days when flying under the radar was enough to survive. In 2025, operators face growing scrutiny from state regulators, and soon, Occupational Safety and Health Administration (OSHA) and the Food and Drug Administration (FDA). From inconsistent lab testing to standard operating procedure (SOP) gaps and safety risks, today’s most prevalent compliance challenges reflect an industry struggling to catch up with the pace of legalization. Whether you're a single-state operator or a national brand, these ten issues are defining the future of cannabis compliance, and they’re too big to ignore.

1. Regulatory Fatigue and Confusion

The pace of regulatory change is exhausting for cannabis operators. Labeling rules, packaging requirements, track-and-trace mandates, testing thresholds, they all evolve frequently and often without adequate transition time. Small operators especially struggle to keep up, and even well-resourced multi-state operators (MSOs) can fall behind in one or more markets. This constant churn leads to compliance fatigue, where companies either delay updates or make rushed changes that increase risk. Operators need a structured process for regulatory change management, including regular policy reviews, cross-departmental communication, and early adoption of anticipated rule shifts.

2. Lab Testing Inconsistencies and Potency Inflation

Despite industry growth, lab testing remains one of the least standardized elements of cannabis compliance. Many operators engage in "lab shopping," sending products to multiple labs and selecting the result with the highest THC concentration. Compounding the issue is the lack of uniform testing protocols across states, allowing labs to use varying solvents, equipment, and calibration methods. Some states are beginning to enforce tighter lab accreditation standards, but enforcement remains inconsistent. Operators should focus on working with ISO-certified labs, making sure measurement standards are consistent, implementing internal quality assurance and quality control (QA/QC) testing procedures, and pass regulations that are built to reduce business decisions based on inflated potency numbers.

3. SOP and Training Documentation Gaps

SOPs are the backbone of a compliant operation, but many businesses treat them as a one-and-done requirement. We often see SOPs that are outdated, not followed, or completely missing. Even worse, training and track and trace documentation is frequently lacking or non-existent. This creates massive compliance gaps when audits occur. Regulators expect to see proof that your team has been trained on current SOPs and safety protocols. Every time an SOP is updated, training should follow, and that training must be documented. Creating a centralized, digital SOP and training management system can help ensure your operation is always audit-ready.

4. Recordkeeping Weaknesses

When regulators arrive, they will want to see all your records. Unfortunately, many cannabis companies fall short in this area. Batch records, training records, internal audits, complaint logs, and corrective action and preventive action (CAPA) plans are often incomplete or missing. While state traceability systems track movement and sales, they don’t capture the operational data needed to demonstrate quality assurance. A strong documentation system should include SOP adherence logs, employee sign-offs, cleaning logs, and quality control metrics. These records don’t just keep you compliant, they also protect your brand in the event of a recall or lawsuit. Remember—if it’s not documented, it didn’t happen.

5. OSHA Non-Compliance in Extraction and Cultivation

Cannabis manufacturing and cultivation facilities are increasingly under scrutiny by OSHA and local fire marshals. Extraction rooms classified as Class I Division 1 often lack proper spark-proof equipment, ventilation, and alarm systems. Cultivation areas expose workers to respiratory irritants, pesticide residues, and inadequate personal protective equipment (PPE). Many operators don’t realize how many OSHA standards apply to their processes until an inspection occurs. Common violations include missing safety data sheets (SDS), untrained employees, and absent respiratory protection programs. Businesses should conduct internal OSHA readiness audits and invest in worker safety programs that go beyond the minimum required.

6. “cGMP Light” Programs That Don’t Hold Up

Many companies claim to be "cGMP compliant" without undergoing accredited third-party accredited certification. These so-called "cGMP-light" programs often lack critical components like internal audits, deviation tracking, and CAPAs. When regulators or investors ask for documentation, these programs quickly fall apart. True cGMP certification requires a comprehensive quality management system, employee training, supplier qualification, rigorous documentation, and passing an onsite audit. With federal oversight on the horizon, and investors increasingly demanding cGMP credentials, companies that treat cGMP as a box-checking exercise will find themselves at a disadvantage. Those who invest in authentic cGMP systems now will be better positioned for expansion, acquisition, or FDA engagement.

7. Inconsistent Enforcement Across States

Not all cannabis regulations are enforced equally. Some states conduct frequent, thorough inspections, while others take a more reactive approach, investigating only after complaints or incidents. This uneven enforcement creates a patchwork of compliance standards that benefits bad actors and penalizes companies that play by the rules. In states with minimal oversight, some operators skip basic safety and documentation steps, creating risks for consumers and industry reputation. As enforcement increases nationwide, companies operating above the minimum requirements will have a head start. A proactive, standardized compliance program is no longer just best practice, it’s a competitive advantage. Another way to ensure compliance with all state regulations is to make sure you have a knowledgeable internal compliance officer or contracting with a consulting company to assist.

8. Environmental and Sustainability Non-Compliance

As environmental scrutiny intensifies, cannabis companies are facing new expectations around waste, water use, and sustainability. Cultivation operations often overuse water and energy, and improperly dispose of plant waste or packaging materials. Some states are now incorporating environmental compliance directly into licensing criteria, with audits focused on pesticide runoff, carbon footprint, and hazardous waste disposal. Operators should prepare now by tracking environmental key performance indicators (KPIs), adopting sustainable cultivation practices, and ensuring they can document how they manage resources and waste. Sustainability isn’t just about optics; it’s increasingly tied to compliance and license renewals.

9. Cross-State Expansion Headaches

Expanding into new states brings major compliance challenges. What’s legal in California may be prohibited in Missouri. Labeling rules, testing protocols, allowable ingredients, and even ownership structures vary widely. Companies that try to clone operations across state lines without customizing for each regulatory environment and specific facilities often run into trouble. To succeed, MSOs need scalable but adaptable compliance frameworks and state-specific SOPs. Compliance leads must be embedded in expansion planning from the beginning. Cross-state alignment requires careful coordination, not copy-paste solutions.

10. Rescheduling and the Coming Wave of Federal Oversight

With cannabis poised to be reclassified as a Schedule III drug, operators should prepare for a seismic shift in compliance expectations. Rescheduling opens the door for FDA oversight, particularly around infused products and therapeutic claims. The FDA will bring new requirements around labeling, cGMP certification, adverse event reporting, and facility registration. Companies that already operate with cGMP certification, robust documentation, and quality assurance protocols will have a significant edge. Those who have relied on state-by-state leniency will need to play catch-up fast. Rescheduling won’t automatically fix the compliance mess; it will likely make the stakes higher.

Compliance isn’t just a regulatory requirement, it’s the foundation of a successful, sustainable cannabis business. In an industry that’s still defining itself, those who prioritize safety, transparency, and preparedness will be best positioned for growth and longevity. Whether it's preparing for OSHA inspections, tightening up your SOPs, or future-proofing your operations with cGMP certification, now is the time to act. Waiting until regulators come knocking is a losing strategy. The cannabis companies that thrive in this new era will be the ones who treat compliance as a competitive edge, not a burden.

About the Author

Kim Anzarut, CQA, CP-FS is the CEO and founder of Allay Consulting. Direct correspondence to: kim.anzarut@allayconsulting.com.