Challenges for Quality Assurance and Procurement Professionals in Sourcing Cannabinol APIs for Commercial and Clinical Use

The expanding global cannabis market presents new challenges for sourcing cannabinol APIs that meet both commercial and clinical needs. Quality Assurance (QA) and procurement professionals face obstacles stemming from fractured regulatory frameworks and supply chain complexities. Understanding both domestic and international standards is crucial for ensuring compliance, safety, and efficacy in cannabinoid products.

Sourcing Cannabidiol – The Fragmented Global Regulatory Framework

A key challenge in sourcing Cannabidiol APIs lies in the fragmented nature of the global cannabis market. While some countries, like Canada, have legalized cannabis for both medical and recreational use, others, such as the U.S., still impose restrictions, especially concerning marijuana-derived cannabinoids.  While Canada treats all CBD and THC in the same manner under the Cannabis Act, the United States treats hemp-derived CBD differently from marijuana, under its Farm Bill of 2018. This mismatch in legal frameworks makes it difficult for companies to source and trade CBD APIs across borders, despite geographical proximity.

In the European Union, countries like Germany have developed robust medicinal cannabis markets regulated under pharmaceutical standards, whereas others, like Spain, lag behind, creating uncertainty for companies trying to operate across multiple jurisdictions. Navigating this complex regulatory landscape requires expertise in both cannabis regulations and pharmaceutical standards to ensure that CBD APIs meet stringent compliance requirements.

CBD APIs and Pharmaceutical Standards

Countries differ significantly in how they regulate cannabis products, which impacts the sourcing of CBD APIs. Canada, for example, regulates cannabis under the Cannabis Act, which treats it as a unique product category, imposing safety and quality guidelines. However, these guidelines may be less stringent than the pharmaceutical cGMP (current Good Manufacturing Practice) standards adopted by countries like Germany. This creates a disparity in market accessibility for companies seeking to export CBD APIs across borders.

In countries like Germany, pharmaceutical-grade CBD APIs must comply with rigorous cGMP standards, ensuring consistency, purity, and safety. On the other hand, Canadian companies may find it easier to operate domestically but struggle to meet the more stringent export requirements of nations with stricter pharmaceutical regulations.

Supply Chain and cGMP Compliance for CBD APIs

Compliance with cGMP standards is crucial for companies producing CBD APIs for international markets. Failure to meet these standards can result in significant limitations, restricting growth to domestic markets and damaging competitiveness. In some cases, companies that fail to uphold cGMP standards have faced costly recalls and reputational damage. Ensuring compliance throughout the supply chain is essential for success in the competitive CBD API market.

Cross-Jurisdiction Compliance Case Studies

To illustrate how these frameworks and standards play out in real-world scenarios, let’s explore two cross-jurisdiction case studies. These examples highlight the regulatory complexity and nuanced approach required when dealing with different countries’ regimes for CBD vs THC.

Case Study 1: Hemp-Derived CBD API – ICH Q7 Compliance for Export to Germany

A few years ago, I consulted for a North American manufacturer producing highly pure CBD isolate from hemp. The company’s goal was to export this CBD API to Germany for use in formulating medicinal products (e.g. CBD-based epilepsy medications in development). Navigating this transatlantic venture revealed several compliance hurdles:

GMP Classification & Certification: First, we had to determine whether German authorities would treat the CBD isolate as an active substance (API) or as a finished herbal medicinal product. In Germany, this classification wasn’t even harmonized across all states – some considered cannabis derivatives as APIs, others as herbal medicines. The distinction was critical: if it’s an API, the manufacturer needed an EU GMP Part II (API) certificate; if it’s a finished product, they’d need EU GMP Part I compliance, which is more stringent in certain aspects. Ultimately, since the CBD was >99% pure and intended as an ingredient for drug formulation, it fell under API status. This meant the facility had to pass an EU ICH Q7-based GMP inspection. During that audit by European inspectors, compliance with ICH Q7 was thoroughly checked, from raw material controls to purification process validation. I had prepared the team extensively on Q7’s expectations, such as establishing a Quality Unit independent from production, robust batch documentation, and impurity carryover studies.

One nuance we encountered: EU GMP for APIs does not explicitly require a Qualified Person (QP) batch release for exported APIs, whereas a finished product would need QP release in the EU. This reduced some administrative burden – our German importer’s QP only needed to do a technical retest of the CBD API, not a full release like a finished drug. However, had any German state classified this CBD as a “herbal drug product” instead, a QP certification in the EU would have been mandatory. This uncertainty taught us to always double-check local interpretations. We proactively obtained a statement from German authorities on the classification to ensure the correct GMP pathway.

Pharmacopeial Considerations: The timing coincided with Ph. Eur. drafting its CBD monograph. We aligned the product specifications to the draft Ph. Eur. 3151 Cannabidiol monograph, targeting impurity limits tighter than 0.8% total to future-proof compliance. We also adhered to the existing German DAC monograph for CBD, which required demonstrating the CBD was derived from approved sources (controlled hemp cultivation) or otherwise via synthesis. To satisfy EU requirements, the API was tested against the latest European Pharmacopoeia methods, including those for residual solvents and elemental impurities. By the time of export, the European Pharmacopoeia monograph for CBD became official (implemented July 2024), and our batch documentation proudly showed compliance with Ph. Eur. specs – a big confidence booster for the German importer and regulators.

Narcotic Control Issues: A major question was whether pure CBD (with THC non-detectable) would trigger any narcotics control in transit or import. The European Court of Justice ruled in 2020 that CBD is not a narcotic under the UN drug conventions if it has no psychoactive THC. Germany follows this interpretation: our product, being THC-free, was not subject to narcotics law restrictions. However, we still had to document THC content on the CoA as “<0.01%” and ensure shipping and import paperwork clearly indicated the THC level to avoid any confusion at customs. This case taught me that even a compliant GMP product can be waylaid by narcotics regulations if documentation isn’t crystal clear. In the end, the CBD API batch reached Germany under cover of an import permit that cited its non-narcotic status, and it was used in formulation trials successfully.

This cross-jurisdiction journey – from a hemp field in North America to a German pharmacy shelf – showcases the need to integrate ICH Q7 GMP compliance with pharmacopeial standards and local legal classifications. We had to be part quality experts, part diplomats, aligning our operations with multiple rulebooks to achieve a smooth export.

Case Study 2: THC-Containing APIs – Canada’s Cannabis Act vs. Pharmaceutical QMS

In another engagement, I worked with a Canadian company developing a THC-containing API for a investigational drug product. Canada presents a unique regulatory environment because it has a federal Cannabis Act (since 2018) regulating cannabis production (medical and recreational) in parallel with the traditional pharmaceutical regulations. This case exemplifies how a producer of a controlled cannabinoid can straddle two regulatory worlds: the cannabis framework and the pharmaceutical GMP framework.

Cannabis Act and GPP: The facility was initially licensed under Health Canada’s Cannabis Act as a Licensed Producer for medical cannabis extracts. Under this regime, they had to follow Good Production Practices (GPP), which are quality standards specific to cannabis in Canada. GPP shares some similarities with cGMP but is generally considered a bit less extensive. For instance, GPP requires testing of each lot for contaminants and potency – including residual solvents, heavy metals, pesticides, aflatoxins, microbial contamination, and cannabinoid content (THC, THCA, CBD, etc.). These tests mirror the pharmacopeial quality requirements discussed earlier, ensuring basic product safety. The company’s QA Person (a role mandated by the Cannabis Act) was used to overseeing these tests and keeping detailed records for Health Canada inspections. However, GPP does not mandate some of the more advanced GMP elements like full validation of all analytical methods, comprehensive equipment qualification, or an ongoing stability program akin to ICH guidelines.

Transition to Pharmaceutical GMP (DEL): As the company aimed to supply their THC oil as an API for clinical trials (and eventually for a drug product), they needed to elevate their quality system to pharmaceutical GMP compliance. This meant obtaining a Drug Establishment License (DEL) from Health Canada, which is essentially Canada’s certification that the site operates under Part C, Division 2 of the Food and Drug Regulations (the drug GMPs). In 2021, they achieved this – becoming one of the first cannabis companies to get a DEL, which “confirmed compliance to GMP standards” for manufacturing and testing of cannabis APIs. I was involved in the gap assessment: we identified areas where GPP wasn’t enough. For example, we implemented full process validation for the THC extraction and purification steps, introduced IQ/OQ/PQ for critical equipment, enhanced the change control system, and instituted an environmental monitoring program in the production areas (to meet pharmaceutical cleanroom standards). We also had to retrain staff from a “GPP mindset” to a “GMP mindset,” emphasizing predictive risk management and documentation rigor beyond what the Cannabis Act required.

Controlled Substance Controls: THC is psychoactive and internationally scheduled, so even as the company moved into pharma GMP, it still had to comply with narcotic control measures. In Canada, the Cannabis Act itself is the legal control framework (replacing the need for a separate narcotics license for cannabis). Practically, that meant security requirements (guarded vaults, 24/7 surveillance), strict inventory tracking, and reporting of all THC quantities produced, used, or destroyed. These controls operated in parallel with GMP. When exporting or collaborating with foreign firms (e.g., sending samples to a U.S. FDA-authorized trial), additional import/export permits under international drug conventions were needed. We coordinated those permits to align with GMP shipping procedures (qualified shippers, temperature control, chain-of-custody documentation). This dual compliance – Cannabis Act controls and GMP – was resource-intensive, but essential for a THC API which by nature falls under controlled substance laws globally.

PIC/S and International Reach: A silver lining of getting the Canadian DEL (GMP certification) was international recognition. Canada is a PIC/S member and has Mutual Recognition Agreements with the EU and others. Indeed, Health Canada’s GMP certificate is recognized by EMA, TGA, MHRA, etc., as equivalent. This meant our client could in the future export their THC API for drug use in Europe without each country’s inspectors re-auditing the site immediately. It essentially opened the door for global supply of their API for clinical research and even commercial drugs down the line. The company also obtained EU-GMP certification via an inspection by an EU QP, which further assured European customers of compliance.

This Canadian case study highlights how different the treatment of THC vs CBD can be: in Canada, both CBD and THC are under the Cannabis Act if derived from cannabis, but you can bring them into the pharmaceutical realm by layering GMP requirements on top. In the EU or U.S., by contrast, THC APIs are handled as Schedule I/controlled drugs with special licenses, whereas CBD (if devoid of THC) skirts narcotic status but has its own regulatory gray area (like novel food status in EU or unapproved dietary ingredient in US). Regardless of region, any THC-containing medicine will demand both a strong QMS (to meet drug GMP) and strict controlled substance compliance.

Remember the Basics of Sourcing CBD

The global cannabis market offers vast opportunities for companies involved in sourcing CBD APIs for pharmaceutical use. However, the fragmented regulatory landscape and complex supply chain requirements present significant challenges. By adhering to best practices in quality assurance, procurement, and regulatory compliance, companies can position themselves for success in this growing industry. Understanding the unique challenges and opportunities in sourcing CBD APIs is critical for staying competitive and compliant.

Brought to you by The Distrio