IWA 37-3

Safety, security and sustainability of cannabis facilities and operations — Part 3: Good production practices (GPP)

This document specifies requirements and recommendations for organizations directly or indirectly involved in the cannabis supply chain, to enable them to: — plan, implement, operate, maintain and update a good production practice programme for providing products that are safe, according to their intended use; — demonstrate compliance with applicable statutory and regulatory requirements; — evaluate and assess mutually agreed customer requirements and demonstrate conformity to them; — effectively communicate with interested parties and demonstrate conformity to relevant interested parties; — demonstrate conformity to stated policies in a cannabis quality programme (CQP) for product safety, product quality, product security and facility safety; — support the evaluation of quality programmes by external organizations or to permit self-assessment or self-declaration of adherence to some or all of the guidance contained in this document. All requirements in this document are generic and intended to be applicable to all organizations in the cannabis supply chain, regardless of size and/or complexity. Organizations that are directly or indirectly involved include (but are not limited to) growers/cultivators, harvesters, primary processors, producers of cannabis, manufacturers of cannabis derivatives, cannabis edibles and/or cannabis products, testing providers, retailers and organizations providing transportation, storage and distribution services, suppliers of equipment, packaging materials and other contact materials. This document intended to enable any organization, including small and/or less developed organizations, to implement externally developed elements in its CQP. NOTE 1 Organizations in the cannabis supply chain are diverse in nature and not all the requirements specified in this document apply to each establishment or process. Justifications for exclusions or the use of alternative measures can be documented by a risk assessment/hazard analysis or other appropriate means. This document provides guidance related to the following categories of cannabis, cannabis derivatives and cannabis products: — cannabis plant seeds; — cannabis plants; — fresh cannabis; — dried cannabis; — cannabis derivatives; — cannabis topicals; — inhalable cannabis. NOTE 2 Annex B provides additional guidance on applying GPP to cannabis edibles with respect to requirements and recommendations in existing food safety standards. Where buildings or premises combine cultivation and processing of cannabis plants, including ancillary activities, along with other operational activities, the requirements and recommendations in this document apply only to that portion of the facility. NOTE 3 Where joint use activities are present in a common building, specific statutory and regulatory requirements can apply for each category. This document does not address the following: — requirements related to research and development activities for finished products; — general fire prevention or building construction features that are normally a function of local building and fire codes where applicable; — premises used exclusively for operational activities, such as office space, call centres and retail outlets, used for the distribution, marketing, or sale of cannabis; NOTE 4 Shipping and receiving of products from the production facility for further distribution are not considered as a retail outlet. — the safe consumption or use of the cannabis or cannabis products produced by organizations applying these good production practices; — occupational health and safety requirements governing cannabis workers and personnel except as identified in A.8.4 and A.8.6; — the protection of the environment; — security of the supply chain monitoring system, including cybersecurity and notifications; NOTE 5 Security and monitoring of the supply chain are dealt with specifically in IWA 37-2. — outdoor cultivation of cannabis and industrial hemp; — gr

Titre manque — Partie 3: Titre manque

General Information

• Status: Not Published
• ICS: 11.120.99 - Other standards related to pharmaceutics
• ICS: 65.020.20 - Plant growing
• ICS: 71.040.10 - Chemical laboratories. Laboratory equipment
• Technical Committee: ISO/TMBG - Technical Management Board - groups
• Drafting Committee: ISO/TMBG - Technical Management Board - groups
• Current Stage: 6000 - International Standard under publication
• Completion Date: 23-Sep-2022

RELATIONS

• Splited From: IWA 37-2 - Safety, security and sustainability of cannabis facilities and operations — Part 2: Requirements for the secure handling of cannabis and cannabis products
• Effective Date: 06-Jun-2022

Standards Content (sample)

Deleted: ¶
IWA 37-3:2022
ISO
Date: 2022-06-01 Deleted:
Deleted: 10
Secretariat: SCC
Deleted: ¶

Safety, security and sustainability of cannabis facilities and operations — Part 3:

ISO IWA 37-3¶
Good production practices (GPP)
ISO IWA 37/WG3¶
Deleted:
Deleted: ¶
Deleted: guide for cannabis
Deleted: Bonnes pratiques de production de cannabis¶
---------------------- Page: 1 ----------------------
ISO IWA 37-3:2022
© ISO 2022
Deleted: 2021
Deleted: ¶

All rights reserved. Unless otherwise specified, or required in the context of its implementation, no

part of this publication may be reproduced or utilized otherwise in any form or by any means,

Deleted: ¶

electronic or mechanical, including photocopying, or posting on the internet or an intranet, without

Deleted: www.iso.org

prior written permission. Permission can be requested from either ISO at the address below or ISO’s

Deleted: ¶
member body in the country of the requester.
Deleted: Section Break (Next Page)
ISO copyright office
Contents ¶
Contents ¶
Introduction iii¶
CP 401 • Ch. de Blandonnet 8
Foreword ix¶
1 Scope 1¶
CH-1214 Vernier, Geneva
2 Normative references 3¶
3 Terms and definitions 3¶
Phone: [phone]
4 Quality System- General 10¶
4.1 Understanding the organization and its context 10¶
4.2 Understanding the needs and expectations of
Email: [e-mail]
interested parties 11¶
4.3 Establishing the CQP 11¶
Website: www.iso.org
4.3.1 Control of externally provided processes, products
or services 11¶
Published in Switzerland
4.4 Licences 12¶
4.5 Policy 12¶
4.5.1 Establishing the CQP policy 12¶
4.5.2 Communicating the CQP policy 12¶
4.6 Organizational roles, responsibilities and
authorities 12¶
4.6.1 Quality & Safety Team Leader 12¶
4.6.2 Product Security 13¶
4.7 Planning of changes 14¶
5 Support 14¶
5.1 Resources 14¶
5.1.2 People 14¶
5.1.3 Infrastructure 14¶
5.1.4 Work environment 15¶
5.2 Documented information 15¶
5.2.1 General 15¶
5.2.2 Creating and updating 15¶
5.2.3 Control of documented information 15¶
5.2.4 Data Integrity and Backup 16¶
6 Designing and Implementing GPPs within the
Operation 16¶
6.1 Development of Processes 16¶
6.2 Establishing Criteria for processes 16¶
6.2.1 Characteristics of raw materials, ingredients and
product contact materials 16¶
6.2.2 Characteristics of end products (finished
products) 17¶
6.2.3 Intended use 17¶
6.2.4 Flow diagrams and description of processes 18¶
6.3 Risk assessment/Hazard analysis 19¶
6.3.1 General 19¶
6.3.2 Hazard identification and determination of
acceptable levels 19¶
6.3.3 Hazard assessment 20¶
6.3.4 Selection and categorization of control
measure(s) 21¶
6.4 Implementing process controls 22¶
6.4.1 Good production practices (GPPs) 22¶
6.4.2 Control measures for significant hazards 22¶
6.4.3 Validation of control measures for significant
hazards 23¶
...
2 © ISO 2022 – All rights reserved
---------------------- Page: 2 ----------------------
ISO IWA 37-3:2022
Contents

Introduction ...................................................................................................................................................... vi

1 Scope ....................................................................................................................................................... 1

2 Normative references ....................................................................................................................... 2

3 Terms and definitions ...................................................................................................................... 3

4 General ................................................................................................................................................. 11

4.1 Understanding the organization and its context .................................................................. 11

4.2 Understanding the needs and expectations of interested parties ................................. 11

4.3 Establishing the CQP ....................................................................................................................... 12

4.3.1 General ................................................................................................................................................. 12

4.3.2 Control of externally provided processes, products or services .................................... 12

4.4 Licences ............................................................................................................................................... 12

4.5 Policy .................................................................................................................................................... 13

4.5.1 Establishing the CQP policy .......................................................................................................... 13

4.5.2 Communicating the CQP policy ................................................................................................... 13

4.6 Organizational roles, responsibilities and authorities ...................................................... 13

4.6.1 General ................................................................................................................................................. 13

4.6.2 Quality and safety team leader ................................................................................................... 13

4.6.3 Product security ............................................................................................................................... 14

4.7 Planning of changes ........................................................................................................................ 14

5 Support ................................................................................................................................................ 15

5.1 Resources ............................................................................................................................................ 15

5.1.1 General ................................................................................................................................................. 15

5.1.2 People ................................................................................................................................................... 15

5.1.3 Infrastructure .................................................................................................................................... 15

5.1.4 Work environment .......................................................................................................................... 15

5.2 Documented information .............................................................................................................. 16

5.2.1 General ................................................................................................................................................. 16

5.2.2 Creating and updating .................................................................................................................... 16

5.2.3 Control of documented information ......................................................................................... 16

5.2.4 Data integrity and backup ............................................................................................................ 17

6 Designing and implementing GPP within the operation ................................................... 17

6.1 Development of processes ............................................................................................................ 17

6.2 Establishing criteria for processes ............................................................................................ 17

6.2.1 Characteristics of raw materials, ingredients and product contact materials .......... 17

6.2.2 Characteristics of end products (finished products) .......................................................... 18

6.2.3 Intended use ...................................................................................................................................... 18

6.2.4 Flow diagrams and description of processes ......................................................................... 18

6.3 Risk assessment/Hazard analysis ............................................................................................. 19

6.3.1 General ................................................................................................................................................. 19

6.3.2 Hazard identification and determination of acceptable levels ....................................... 19

6.3.3 Hazard assessment .......................................................................................................................... 21

6.3.4 Selection and categorization of control measures ............................................................... 21

6.4 Implementing process controls .................................................................................................. 22

6.4.1 Good production practices (GPP)............................................................................................... 22

6.4.2 Control measures for significant hazards ............................................................................... 22

6.4.3 Validation of control measures for significant hazards ..................................................... 23

6.4.4 Control of monitoring and measuring methods ................................................................... 23

6.5 Process control documentation .................................................................................................. 24

© ISO 2022 – All rights reserved 3
---------------------- Page: 3 ----------------------
ISO IWA 37-3:2022

6.5.1 Master manufacturing records (MMRs) .................................................................................. 24

6.5.2 Batch manufacturing records ...................................................................................................... 25

6.6 Verification related to GPP and the hazard control plan ................................................... 26

6.6.1 Verification ......................................................................................................................................... 26

6.6.2 Verification results .......................................................................................................................... 26

6.6.3 Analysis of results of verification activities ........................................................................... 27

6.7 Laboratory system/Product testing .......................................................................................... 27

6.7.1 Testing for phytocannabinoids ................................................................................................... 27

6.7.2 Testing for contaminants .............................................................................................................. 27

6.7.3 Testing for pesticides ..................................................................................................................... 28

6.7.4 Sample retention .............................................................................................................................. 28

6.7.5 Durable life/Durable life date ..................................................................................................... 28

6.8 Control of product and process nonconformities ................................................................ 29

6.8.1 General ................................................................................................................................................. 29

6.8.2 Corrections ......................................................................................................................................... 29

6.8.3 Corrective actions ............................................................................................................................ 30

6.8.4 Handling of potentially unsafe products ................................................................................. 30

6.9 Complaint management ................................................................................................................ 32

6.10 Identification and traceability .................................................................................................... 32

6.11 Packaging system ............................................................................................................................. 33

6.11.1 General ................................................................................................................................................. 33

6.11.2 Packaging: Sustainability, safety and quality ........................................................................ 33

6.11.3 Packaging: Containers and wrappers ....................................................................................... 34

6.11.4 Packaging labelling: Product identifiers ................................................................................. 34

6.11.5 Packaging labelling: Advertising ................................................................................................ 35

Annex A (normative) GPP for cannabis and cannabis product quality and safety ................ 37

Annex B (informative) Guidance on applying GPP to cannabis edibles .................................... 58

Bibliography..................................................................................................................................................... 70

4 © ISO 2022 – All rights reserved
---------------------- Page: 4 ----------------------
ISO IWA 37-3:2022
Foreword

ISO (the International Organization for Standardization) is a worldwide federation of national

Deleted: ¶

standards bodies (ISO member bodies). The work of preparing International Standards is normally

Deleted: ISO's technical

carried out through ISO technical committees. Each member body interested in a subject for which a

Deleted: in which each ISO

technical committee has been established has the right to be represented on that committee.

International organizations, governmental and non-governmental, in liaison with ISO, also take part in

the work. ISO collaborates closely with the International Electrotechnical Commission (IEC) on all

matters of electrotechnical standardization.

The procedures used to develop this document and those intended for its further maintenance are

Deleted: ¶
In order to respond to urgent market requirements, ISO

described in the ISO/IEC Directives, Part 1. In particular, the different approval criteria needed for the

has also introduced the possibility of preparing

different types of ISO documents should be noted. This document was drafted in accordance with the

documents through a workshop mechanism, external to
editorial rules of the ISO/IEC Directives, Part 2 (see www.iso.org/directives).
its normal committee processes. These documents are
published by ISO as International Workshop Agreements.

Attention is drawn to the possibility that some of the elements of this document may be the subject of Proposals to hold such workshops may come from any

source and are subject to approval by the ISO Technical

patent rights. ISO shall not be held responsible for identifying any or all such patent rights. Details of

Management Board which also designates an ISO member

any patent rights identified during the development of the document will be in the Introduction and/or

body to assist the proposer in the organization of the
on the ISO list of patent declarations received (see www.iso.org/patents).
workshop. International Workshop Agreements are
approved by consensus amongst the individual

Any trade name used in this document is information given for the convenience of users and does not participants in such workshops. Although it is permissible

that competing International Workshop Agreements exist
constitute an endorsement.
on the same subject, an International Workshop
Agreement shall not conflict with an existing ISO or IEC

For an explanation of the voluntary nature of standards, the meaning of ISO specific terms and

standard.¶

expressions related to conformity assessment, as well as information about ISO's adherence to the

World Trade Organization (WTO) principles in the Technical Barriers to Trade (TBT), see An International Workshop Agreement is reviewed after

three years, under the responsibility of the member body
www.iso.org/iso/foreword.html.
designated by the Technical Management Board, in order
to decide whether it will be confirmed for a further three

International Workshop Agreement IWA 37 was approved was approved at a series of workshops

years, transferred to an ISO technical body for revision, or

hosted by the Standards Council of Canada (SCC), in association with Underwriters Laboratories of

withdrawn. If the International Workshop Agreement is

Canada (ULC), held virtually between December 2020 and June 2021. confirmed, it is reviewed again after a further three years,

at which time it must be either revised by the relevant ISO
technical body or withdrawn.¶
A list of all parts in the IWA 37 series can be found on the ISO website.
Deleted: ¶

Any feedback or questions on this document should be directed to the user’s national standards body.

A complete listing of these bodies can be found at www.iso.org/members.html.
Deleted: ¶
This document, ISO IWA 37-3 is one of the set of
documents prepared by the ISO International Workshop
Agreements on the Safety, security and sustainability of
cannabis facilities and operations (ISO IWA 37) and was
developed by Working Group 3, ISO IWA 37/WG3. The
Workshop was conducted virtually from December 2020
through June 2021.¶
Deleted: ¶
Supporting material to accompany this
Deleted: is available
Deleted: following
Deleted: :
Deleted: ISO - IWA 37 - Safety, security and sustainability
of cannabis facilities and operations
Deleted: ¶
Page Break
© ISO 2022 – All rights reserved 5
---------------------- Page: 5 ----------------------
ISO IWA 37-3:2022
Introduction

While cannabis has been fully legalized in Canada and in many states in the USA, it is a new and emerging

Deleted: ¶
...

industry that is moving at a very fast pace in many other parts of the world. While legalization is being

deliberated by governments and legislative bodies, companies are creating their own infrastructure in

anticipation of legal approval. Meanwhile, government regulators and the societies they serve are

grappling with the lack of consistent rules and guidance to deliver safety, security and sustainability of

cannabis facilities and operations, while growers and producers use their own judgment on how to

establish and operate facilities.

It has become very clear that the global cannabis market is opening up very rapidly. The cannabis

Deleted: ¶
...

product and the industry will become more and more ubiquitous as the global barriers start to lower

and come down. If the current trend continues, it is predicted that well over one third of the globe will

accommodate cannabis by 2024.

What is unique about this new and emerging industry is that it is coming from an illicit status into

Deleted: ¶
...

decriminalization and evolving into a legitimate burgeoning business. Due to its pioneering status, very

Deleted: ¶

little exists in terms of research, studies, historical experience and best practices. Standardization is

All of these provide…here are therefore distinct

likewise very slow on the uptake and the cannabis industry remains severely underserved.

challenges for the safety, security and sustainability of

There are therefore distinct challenges for the safety, security and sustainability of cannabis facilities cannabis buildings, premises, …acilities and operations.

...
and operations, which the IWA 37 series seeks to address as follows:
Deleted: ¶
Following approval by the Technical Management Board

— Part 1: Requirements for the safety of cannabis buildings, equipment and oil extraction operations;

of ISO, the Standards Council of Canada (SCC) and UL in
Canada, have organized a workshop to develop an

— Part 2: Requirements for the secure handling of cannabis and cannabis products;

International Workshop Agreement (IWA 37) on the
Safety, Security and Sustainability of Cannabis Facilities
and Operations. ¶
— Part 3 (this document): Good production practices (GPP).
Workshop document #1 - Technical guide

The good production practices (GPP) specified in this document are intended to ensure product quality

Deleted: ¶

by mitigating threats of mislabelling or adulterating cannabis products. These practices are compatible

Workshop document #… Part 2 - Technical guide…

with the requirements for safety, product security and facility safety specified in IWA 37-1 and IWA 37-

Requirements for the secure handling of cannabis and
cannabis products; and
...

To align with international best practices, this document builds upon the internationally recognized

Deleted: ¶

framework and principles used in good manufacturing practices (GMP) and GPP, which comprise a

Workshop document #… Part 3 – Technical guide for
good production practices for cannabis products, with

system of processes, procedures and documentation that help to ensure products are consistently

Annex B specifically dedicated to the unique aspects

produced and controlled in accordance with quality standards. These practices are typically required

related to cannabis edibles. ¶

to conform to guidelines and regulations recommended by agencies that control authorization and

licensing for the manufacture and sale of food, drug products and active pharmaceutical products. The

This International Workshop Agreement, prepared by
ISO IWA 37-3,

application of these guidelines require that manufacturers, processors and packagers of drugs, medical

...

devices and food take proactive steps to ensure that their products are safe, pure and effective.

Deleted: Guide …GPP) for cannabis was developed by
ISO IWA 37/WG3.
...

The production of cannabis products presents unique and challenging hazards and requires additional

Deleted: ¶

control measures and prerequisite programmes, from the perspectives of safety, product quality and

A “cannabis product” is a packaged good which includes

safety, product security and facility safety, as well as from the perspective of compliance with statutory

cannabis or cannabis derivative available in multiple

or regulatory requirements, which in most jurisdictions are in addition to those governing conventional

formats for commercial and or retail distribution. A
product manufacturing.
Moved down [1]: cannabis product

The production and sale of cannabis products encompasses the full supply chain from the cultivation

Deleted: may also include a ‘cannabis edible” or “food”

and harvesting of the cannabis plant, through the processing of the plants and the extraction of

which is infused with a cannabis derivative, most often an

concentrated oils to the manufacturing of cannabis products using conventional methods, and it extracted oil, of the cannabis plant. ¶

includes the storage, handling, distribution and retailing of these products. ...

Deleted: ¶
...

Given the unique aspects associated with cannabis edibles, this sub-set of cannabis products is

considered separately. It is felt that the most effective approach for the development of future ISO Deleted: ¶

...

standards for cannabis edibles is to build upon the strong foundation for food safety management

Deleted: ¶
...

systems set out in ISO 22000 and in ISO/TS 22002-1 together with the technical guidance contained in

Deleted: ¶
...
6 © ISO 2022 – All rights reserved
---------------------- Page: 6 ----------------------
ISO IWA 37-3:2022

the main body of this document, rather than to develop a new set of GPP exclusively for cannabis edibles. Deleted: the IWA 37-3

Annex B outlines this approach in more detail.
Deleted: . The outcomes of

Supporting material to accompany the IWA 37 series is available at the following website: IWA 37 — Deleted: are contained in Annex B – Additional Guidance

on Applying GPPs to Cannabis Edibles.
Safety, security and sustainability of cannabis facilities and operations.

A list of workshop participants is available from the Standards Council of Canada (SCC).

This document provides both new requirements and
guidance for
Deleted: management of the unique needs
Deleted: this new category of products. Such technical
guidance must be considered in the development and
production of cannabis products and is driven by quality
systems designed to assure the highest standards of
quality
© ISO 2022 – All rights reserved 7
---------------------- Page: 7 ----------------------
International Workshop Agreement IWA 37-3:2022(E)
Deleted: efficacy of such products.¶
Safety, security and sustainability of cannabis facilities and
Deleted: guide for cannabis
operations — Part 3: Good production practices (GPP)
Deleted: ¶
Deleted:
Deleted: ¶
Deleted: provides
1 Scope
Deleted: guidance to enable an organization that is
Deleted: ¶

This document specifies requirements and recommendations for organizations directly or indirectly ...

involved in the cannabis supply chain, to enable them to: Deleted: Good Production Practice (GPP) Programme

...
Deleted: ¶

— plan, implement, operate, maintain and update a good production practice programme for ...

providing products that are safe, according to their intended use;
Deleted: ¶
...
Deleted: with
— demonstrate compliance with applicable statutory and regulatory requirements;
Deleted: ¶
...

— evaluate and assess mutually agreed customer requirements and demonstrate conformity to them;

Deleted: to
Deleted: ¶
...

— effectively communicate with interested parties and demonstrate conformity to relevant interested

Deleted: for
parties;
Deleted: Cannabis Quality Programme

— demonstrate conformity to stated policies in a cannabis quality programme (CQP) for product

Deleted:
safety, product quality, product security and facility safety;
Deleted: and

— support the evaluation of quality programmes by external organizations or to permit self-

Deleted: ¶
...

assessment or self-declaration of adherence to some or all of the guidance contained in this

Deleted: enable the
document.
Deleted: ¶
Deleted: of

All requirements in this document are generic and intended to be applicable to all organizations in the

cannabis supply chain, regardless of size and/or complexity. Organizations that are directly or

Deleted:

indirectly involved include (but are not limited to) growers/cultivators, harvesters, primary processors,

Deleted: ,

producers of cannabis, manufacturers of cannabis derivatives, cannabis edibles and/or cannabis

Deleted:

products, testing providers, retailers and organizations providing transportation, storage and

distribution services, suppliers of equipment, packaging materials and other contact materials. Deleted: ¶

Deleted: allows

This document intended to enable any organization, including small and/or less developed

organizations, to implement externally developed elements in its CQP.
Deleted: their
Deleted:

NOTE 1 Organizations in the cannabis supply chain are diverse in nature and not all the requirements specified

in this document apply to each establishment or process. Justifications for exclusions or the use of alternative

Deleted: ¶

measures can be documented by a risk assessment/hazard analysis or other appropriate means.

Deleted: of

This document provides guidance related to the following categories of cannabis, cannabis derivatives Deleted: an individual

and cannabis products:
Deleted: Where
— cannabis plant seeds; Deleted: are made
Deleted: implemented, justification should
— cannabis plants;
Deleted:
— fresh cannabis; Deleted: ¶
Deleted: including, but not limited to:
— dried cannabis;
Deleted: ¶
...
© ISO 2022 – All rights reserved 1
---------------------- Page: 8 ----------------------
IWA 37-3:2022
Deleted: ISO
Deleted:
— cannabis derivatives;
— cannabis topicals;
Deleted: B – Additional Guidance on Applying GPPs to
— inhalable cannabis.
Cannabis Edibles

NOTE 2 Annex B provides additional guidance on applying GPP to cannabis edibles with respect to requirements

Deleted: considerations related to the unique application
and recommendations in existing food safety standards. of pre-
Deleted: Food Safety Standards to the production of

Where buildings or premises combine cultivation and processing of cannabis plants, including ancillary

cannabis edibles.

activities, along with other operational activities, the requirements and recommendations in this

Deleted: ¶
document apply only to that portion of the facility.
Deleted: of

NOTE 3 Where joint use activities are present in a common building, specific statutory and regulatory

Deleted: Technical Guide are intended to
requirements can apply for each category.
Deleted:
This document does not address the following:
Deleted: ¶
Note: (Informative), Clause A.1.1. ¶

— requirements related to research and development activities for finished products;

A 1.1 In many cases a building or facility may be utilized

— general fire prevention or building construction features that are normally a function of local

for both the cultivation of cannabis plants and processing

building and fire codes where applicable; of cannabis products, along with a retail store front, call

centre, or office administration s
...

INTERNATIONAL IWA
WORKSHOP 37-3
AGREEMENT
First edition
Safety, security and sustainability of
cannabis facilities and operations —
Part 3:
Good production practices (GPP)
PROOF/ÉPREUVE
Reference number
IWA 37-3:2022(E)
© ISO 2022
---------------------- Page: 1 ----------------------
IWA 37-3:2022(E)
COPYRIGHT PROTECTED DOCUMENT
© ISO 2022

All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication may

be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting on

the internet or an intranet, without prior written permission. Permission can be requested from either ISO at the address below

or ISO’s member body in the country of the requester.
ISO copyright office
CP 401 • Ch. de Blandonnet 8
CH-1214 Vernier, Geneva
Phone: [phone]
Email: [e-mail]
Website: www.iso.org
Published in Switzerland
PROOF/ÉPREUVE © ISO 2022 – All rights reserved
---------------------- Page: 2 ----------------------
IWA 37-3:2022(E)
Contents Page

Foreword ..........................................................................................................................................................................................................................................v

Introduction .............................................................................................................................................................................................................................. vi

1 Scope ................................................................................................................................................................................................................................. 1

2 Normative references ..................................................................................................................................................................................... 2

3 Terms and definitions .................................................................................................................................................................................... 2

4 General ........................................................................................................................................................................................................................10

4.1 Understanding the organization and its context .................................................................................................. 10

4.2 Understanding the needs and expectations of interested parties ........................................................ 10

4.3 Establishing the CQP ...................................................................................................................................................................... 11

4.3.1 General ..................................................................................................................................................................................... 11

4.3.2 Control of externally provided processes, products or services .......................................... 11

4.4 Licences ...................................................................................................................................................................................................... 11

4.5 Policy ............................................................................................................................................................................................................ 11

4.5.1 Establishing the CQP policy ................................................................................................................................... 11

4.5.2 Communicating the CQP policy ..........................................................................................................................12

4.6 Organizational roles, responsibilities and authorities ....................................................................................12

4.6.1 General .....................................................................................................................................................................................12

4.6.2 Quality and safety team leader ...........................................................................................................................12

4.6.3 Product security .............................................................................................................................................................. 13

4.7 Planning of changes ........................................................................................................................................................................13

5 Support ........................................................................................................................................................................................................................13

5.1 Resources ................................................................................................................................................................................................. 13

5.1.1 General .....................................................................................................................................................................................13

5.1.2 People ........................................................................................................................................................................................ 14

5.1.3 Infrastructure .................................................................................................................................................................... 14

5.1.4 Work environment ......................................................................................................................................................... 14

5.2 Documented information ........................................................................................................................................................... 14

5.2.1 General ..................................................................................................................................................................................... 14

5.2.2 Creating and updating ................................................................................................................................................ 15

5.2.3 Control of documented information .............................................................................................................. 15

5.2.4 Data integrity and backup ...................................................................................................................................... 15

6 Designing and implementing GPP within the operation ........................................................................................15

6.1 Development of processes ......................................................................................................................................................... 15

6.2 Establishing criteria for processes .................................................................................................................................... 16

6.2.1 Characteristics of raw materials, ingredients and product contact materials ........ 16

6.2.2 Characteristics of end products (finished products) ...................................................................... 16

6.2.3 Intended use ........................................................................................................................................................................ 17

6.2.4 Flow diagrams and description of processes ........................................................................................ 17

6.3 Risk assessment/Hazard analysis ..................................................................................................................................... 18

6.3.1 General ..................................................................................................................................................................................... 18

6.3.2 Hazard identification and determination of acceptable levels .............................................. 18

6.3.3 Hazard assessment ........................................................................................................................................................ 19

6.3.4 Selection and categorization of control measures ............................................................................ 19

6.4 Implementing process controls ............................................................................................................................................ 20

6.4.1 Good production practices (GPP) ..................................................................................................................... 20

6.4.2 Control measures for significant hazards ................................................................................................ 21

6.4.3 Validation of control measures for significant hazards ............................................................... 21

6.4.4 Control of monitoring and measuring methods ..................................................................................22

6.5 Process control documentation ...........................................................................................................................................22

6.5.1 Master manufacturing records (MMRs) ....................................................................................................22

6.5.2 Batch manufacturing records .............................................................................................................................. 23

6.6 Verification related to GPP and the hazard control plan ............................................................................... 24

iii
© ISO 2022 – All rights reserved PROOF/ÉPREUVE
---------------------- Page: 3 ----------------------
IWA 37-3:2022(E)

6.6.1 Verification ........................................................................................................................................................................... 24

6.6.2 Verification results ........................................................................................................................................................ 24

6.6.3 Analysis of results of verification activities ........................................................................................... 25

6.7 Laboratory system/Product testing ................................................................................................................................ 25

6.7.1 Testing for phytocannabinoids ........................................................................................................................... 25

6.7.2 Testing for contaminants ......................................................................................................................................... 25

6.7.3 Testing for pesticides .................................................................................................................................................. 26

6.7.4 Sample retention .............................................................................................................................................................26

6.7.5 Durable life/Durable life date .............................................................................................................................. 26

6.8 Control of product and process nonconformities ................................................................................................. 27

6.8.1 General ..................................................................................................................................................................................... 27

6.8.2 Corrections ........................................................................................................................................................................... 27

6.8.3 Corrective actions ..........................................................................................................................................................28

6.8.4 Handling of potentially unsafe products ...................................................................................................28

6.9 Complaint management ...............................................................................................................................................................30

6.10 Identification and traceability ............................................................................................................................................... 30

6.11 Packaging system ........................................................................................................................................... ................................... 31

6.11.1 General ..................................................................................................................................................................................... 31

6.11.2 Packaging: Sustainability, safety and quality ........................................................................................ 31

6.11.3 Packaging: Containers and wrappers ........................................................................................................... 31

6.11.4 Packaging labelling: Product identifiers .................................................................................................... 32

6.11.5 Packaging labelling: Advertising ...................................................................................................................... 33

Annex A (normative) GPP for cannabis and cannabis product quality and safety ..........................................34

Annex B (informative) Guidance on applying GPP to cannabis edibles ......................................................................54

Bibliography .............................................................................................................................................................................................................................66

PROOF/ÉPREUVE © ISO 2022 – All rights reserved
---------------------- Page: 4 ----------------------
IWA 37-3:2022(E)
Foreword

ISO (the International Organization for Standardization) is a worldwide federation of national standards

bodies (ISO member bodies). The work of preparing International Standards is normally carried out

through ISO technical committees. Each member body interested in a subject for which a technical

committee has been established has the right to be represented on that committee. International

organizations, governmental and non-governmental, in liaison with ISO, also take part in the work.

ISO collaborates closely with the International Electrotechnical Commission (IEC) on all matters of

electrotechnical standardization.

The procedures used to develop this document and those intended for its further maintenance are

described in the ISO/IEC Directives, Part 1. In particular, the different approval criteria needed for the

different types of ISO documents should be noted. This document was drafted in accordance with the

editorial rules of the ISO/IEC Directives, Part 2 (see www.iso.org/directives).

Attention is drawn to the possibility that some of the elements of this document may be the subject of

patent rights. ISO shall not be held responsible for identifying any or all such patent rights. Details of

any patent rights identified during the development of the document will be in the Introduction and/or

on the ISO list of patent declarations received (see www.iso.org/patents).

Any trade name used in this document is information given for the convenience of users and does not

constitute an endorsement.

For an explanation of the voluntary nature of standards, the meaning of ISO specific terms and

expressions related to conformity assessment, as well as information about ISO's adherence to

the World Trade Organization (WTO) principles in the Technical Barriers to Trade (TBT), see

www.iso.org/iso/foreword.html.

International Workshop Agreement IWA 37 was approved was approved at a series of workshops

hosted by the Standards Council of Canada (SCC), in association with Underwriters Laboratories of

Canada (ULC), held virtually between December 2020 and June 2021.
A list of all parts in the IWA 37 series can be found on the ISO website.

Any feedback or questions on this document should be directed to the user’s national standards body. A

complete listing of these bodies can be found at www.iso.org/members.html.
© ISO 2022 – All rights reserved PROOF/ÉPREUVE
---------------------- Page: 5 ----------------------
IWA 37-3:2022(E)
Introduction

While cannabis has been fully legalized in Canada and in many states in the USA, it is a new and emerging

industry that is moving at a very fast pace in many other parts of the world. While legalization is being

deliberated by governments and legislative bodies, companies are creating their own infrastructure

in anticipation of legal approval. Meanwhile, government regulators and the societies they serve are

grappling with the lack of consistent rules and guidance to deliver safety, security and sustainability

of cannabis facilities and operations, while growers and producers use their own judgment on how to

establish and operate facilities.

It has become very clear that the global cannabis market is opening up very rapidly. The cannabis

product and the industry will become more and more ubiquitous as the global barriers start to lower

and come down. If the current trend continues, it is predicted that well over one third of the globe will

accommodate cannabis by 2024.

What is unique about this new and emerging industry is that it is coming from an illicit status into

decriminalization and evolving into a legitimate burgeoning business. Due to its pioneering status, very

little exists in terms of research, studies, historical experience and best practices. Standardization is

likewise very slow on the uptake and the cannabis industry remains severely underserved.

There are therefore distinct challenges for the safety, security and sustainability of cannabis facilities

and operations, which the IWA 37 series seeks to address as follows:

— Part 1: Requirements for the safety of cannabis buildings, equipment and oil extraction operations;

— Part 2: Requirements for the secure handling of cannabis and cannabis products;

— Part 3 (this document): Good production practices (GPP).

The good production practices (GPP) specified in this document are intended to ensure product quality

by mitigating threats of mislabelling or adulterating cannabis products. These practices are compatible

with the requirements for safety, product security and facility safety specified in IWA 37-1 and IWA 37-

To align with international best practices, this document builds upon the internationally recognized

framework and principles used in good manufacturing practices (GMP) and GPP, which comprise

a system of processes, procedures and documentation that help to ensure products are consistently

produced and controlled in accordance with quality standards. These practices are typically required

to conform to guidelines and regulations recommended by agencies that control authorization and

licensing for the manufacture and sale of food, drug products and active pharmaceutical products. The

application of these guidelines require that manufacturers, processors and packagers of drugs, medical

devices and food take proactive steps to ensure that their products are safe, pure and effective.

The production of cannabis products presents unique and challenging hazards and requires additional

control measures and prerequisite programmes, from the perspectives of safety, product quality and

safety, product security and facility safety, as well as from the perspective of compliance with statutory

or regulatory requirements, which in most jurisdictions are in addition to those governing conventional

product manufacturing.

The production and sale of cannabis products encompasses the full supply chain from the cultivation

and harvesting of the cannabis plant, through the processing of the plants and the extraction of

concentrated oils to the manufacturing of cannabis products using conventional methods, and it

includes the storage, handling, distribution and retailing of these products.

Given the unique aspects associated with cannabis edibles, this sub-set of cannabis products is

considered separately. It is felt that the most effective approach for the development of future ISO

standards for cannabis edibles is to build upon the strong foundation for food safety management

systems set out in ISO 22000 and in ISO/TS 22002-1 together with the technical guidance contained

in the main body of this document, rather than to develop a new set of GPP exclusively for cannabis

edibles. Annex B outlines this approach in more detail.
PROOF/ÉPREUVE © ISO 2022 – All rights reserved
---------------------- Page: 6 ----------------------
IWA 37-3:2022(E)

Supporting material to accompany the IWA 37 series is available at the following website:

IWA 37 — Safety, security and sustainability of cannabis facilities and operations.

A list of workshop participants is available from the Standards Council of Canada (SCC).

vii
© ISO 2022 – All rights reserved PROOF/ÉPREUVE
---------------------- Page: 7 ----------------------
International Workshop Agreement IWA 37-3:2022(E)
Safety, security and sustainability of cannabis facilities and
operations —
Part 3:
Good production practices (GPP)
1 Scope

This document specifies requirements and recommendations for organizations directly or indirectly

involved in the cannabis supply chain, to enable them to:

— plan, implement, operate, maintain and update a good production practice programme for providing

products that are safe, according to their intended use;
— demonstrate compliance with applicable statutory and regulatory requirements;

— evaluate and assess mutually agreed customer requirements and demonstrate conformity to them;

— effectively communicate with interested parties and demonstrate conformity to relevant interested

parties;

— demonstrate conformity to stated policies in a cannabis quality programme (CQP) for product

safety, product quality, product security and facility safety;

— support the evaluation of quality programmes by external organizations or to permit self-assessment

or self-declaration of adherence to some or all of the guidance contained in this document.

All requirements in this document are generic and intended to be applicable to all organizations in the

cannabis supply chain, regardless of size and/or complexity. Organizations that are directly or indirectly

involved include (but are not limited to) growers/cultivators, harvesters, primary processors, producers

of cannabis, manufacturers of cannabis derivatives, cannabis edibles and/or cannabis products, testing

providers, retailers and organizations providing transportation, storage and distribution services,

suppliers of equipment, packaging materials and other contact materials.

This document intended to enable any organization, including small and/or less developed

organizations, to implement externally developed elements in its CQP.

NOTE 1 Organizations in the cannabis supply chain are diverse in nature and not all the requirements

specified in this document apply to each establishment or process. Justifications for exclusions or the use of

alternative measures can be documented by a risk assessment/hazard analysis or other appropriate means.

This document provides guidance related to the following categories of cannabis, cannabis derivatives

and cannabis products:
— cannabis plant seeds;
— cannabis plants;
— fresh cannabis;
— dried cannabis;
— cannabis derivatives;
— cannabis topicals;
© ISO 2022 – All rights reserved PROOF/ÉPREUVE
---------------------- Page: 8 ----------------------
IWA 37-3:2022(E)
— inhalable cannabis.

NOTE 2 Annex B provides additional guidance on applying GPP to cannabis edibles with respect to

requirements and recommendations in existing food safety standards.

Where buildings or premises combine cultivation and processing of cannabis plants, including ancillary

activities, along with other operational activities, the requirements and recommendations in this

document apply only to that portion of the facility.

NOTE 3 Where joint use activities are present in a common building, specific statutory and regulatory

requirements can apply for each category.
This document does not address the following:

— requirements related to research and development activities for finished products;

— general fire prevention or building construction features that are normally a function of local

building and fire codes where applicable;

— premises used exclusively for operational activities, such as office space, call centres and retail

outlets, used for the distribution, marketing, or sale of cannabis;

NOTE 4 Shipping and receiving of products from the production facility for further distribution are not

considered as a retail outlet.

— the safe consumption or use of the cannabis or cannabis products produced by organizations

applying these good production practices;

— occupational health and safety requirements governing cannabis workers and personnel except as

identified in A.8.4 and A.8.6;
— the protection of the environment;

— security of the supply chain monitoring system, including cybersecurity and notifications;

NOTE 5 Security and monitoring of the supply chain are dealt with specifically in IWA 37-2.

— outdoor cultivation of cannabis and industrial hemp;
— growing of cannabis intended for personal use;

— the use of cannabinoids as ingredients that are derived from plants other than cannabis, or derived

from other organisms, or created synthetically.
2 Normative references
There are no normative references in this document.
3 Terms and definitions
For the purposes of this document, the following terms and definitions apply.

ISO and IEC maintain terminology databases for use in standardization at the following addresses:

— ISO Online browsing platform: available at https:// www .iso .org/ obp
— IEC Electropedia: available at https:// www .electropedia .org/
PROOF/ÉPREUVE © ISO 2022 – All rights reserved
---------------------- Page: 9 ----------------------
IWA 37-3:2022(E)
3.1
acceptable level

level of a safety hazard (3.38) not to be exceeded in the end product (3.18) provided by the organization

(3.27)
[SOURCE: ISO 22000:2018, 3.1]
3.2
audit

systematic, independent and documented process (3.32) for obtaining audit evidence and evaluating it

objectively to determine the extent to which the audit criteria are fulfilled

Note 1 to entry: An audit can be an internal audit (first party) or an external audit (second party or third party),

and it can be a combined audit (combining two or more disciplines).

Note 2 to entry: An internal audit is conducted by the organization (3.27) itself, or by an external party on its

behalf.
Note 3 to entry: “Audit evidence” and “audit criteria” are defined in ISO 19011.

Note 4 to entry: Relevant disciplines are, for example, food safety management, quality management or

environmental management.
[SOURCE: ISO 22000:2018, 3.3]
3.3
cannabis

genus of flowering plants made up of many different phytocannabinoids and chemical compounds

Note 1 to entry: Research into cannabis by governing bodies and organizations is ongoing around the world,

and drug classifications are constantly under review. Regulation of cannabis legalization frameworks can vary

between jurisdictions, based on the levels of tetrahydrocannabinol (THC) available in the plant.

3.4
cannabis derivative

secondary product (3.33) that can be extracted or obtained from a cannabis (3.3) biomass

Note 1 to entry: Classification of synthetically derived cannabinoids can vary between jurisdictions.

3.5
cannabis edible

food (3.19) which includes cannabis (3.3) or cannabis derivative (3.4) as an ingredient

Note 1 to entry: Dried cannabis, fresh cannabis, cannabis plants or cannabis plant seeds are not in themselves

considered food.
3.6
cannabis product

packaged goods containing cannabis (3.3) or cannabis derivative (3.4), available in multiple formats for

commercial and/or retail distribution
3.7
cannabis waste

solid, liquid or gaseous material that is a cannabis product (3.6), contains cannabis (3.3) or has come

into contact with cannabis, destined for disposal and not intended for sale or for use in any way other

than for agronomic purposes such as compost

Note 1 to entry: Definitions of cannabis waste can vary between jurisdictions. For example, in a jurisdiction that

sets a specific tetrahydrocannabinol (THC) threshold to define cannabis waste at a specific concentration of THC

(e.g. 10 μg/g), waste that has a concentration below that threshold is not considered to be cannabis waste.

© ISO 2022 – All rights reserved PROOF/ÉPREUVE
---------------------- Page: 10 ----------------------
IWA 37-3:2022(E)
3.8
competence
ability to apply knowledge and skills to achieve intended results
[SOURCE: ISO 22000:2018, 3.4]
3.9
conformity
fulfilment of a requirement (3.35)
[SOURCE: IS
...