Cannabis Lab 101: ISO/IEC 17025 Accreditation vs. State Licensing, What Each One Requires and Why Cannabis Labs Need Both

A cannabis testing lab can be technically brilliant and still illegal, or fully licensed and technically unreliable. The state license and the ISO/IEC 17025 accreditation scope are two separate documents issued by two separate bodies for two entirely different purposes, and understanding the difference matters whether you are a lab director preparing for an audit, a regulator reviewing a lab’s credentials, or a cultivator deciding whether to trust a certificate of analysis.

Whether you are a lab director building your quality system from scratch, a compliance officer verifying a testing partner’s credentials, or a grower who has ever wondered why the lab sends you a two-page scope document alongside their license number, this article is for you. It is not for dispensary shoppers or investors.

Here is what this article covers:

• What a state cannabis testing license is and what it does not cover
• What ISO/IEC 17025:2017 accreditation is and how its scope document works
• The five clause areas of ISO/IEC 17025:2017 that generate the most audit findings in cannabis labs: impartiality, method verification and validation, measurement uncertainty, proficiency testing, and corrective action
• How to read and verify an accreditation scope
• Why holding both is necessary and how to confirm a lab has both

A state license tells you the lab is permitted to operate; the accreditation scope tells you which results you can actually trust.

Step 1: Understand what a state cannabis testing license does and does not do

A state cannabis testing-laboratory license is a regulatory authorization created by the applicable jurisdiction’s cannabis regulator. It permits the laboratory to legally accept cannabis samples, perform testing, and issue certificates of analysis that regulators and licensees can rely on for compliance decisions. Without it, a lab is operating outside the cannabis program entirely, regardless of how good its chemistry is.

What the license does not do is assess technical competence. Most state cannabis programs specify which analytes must be tested and which action limits apply, and some states require that the lab hold accreditation as a condition of licensure. But the license itself is not a technical assessment. It is a permission slip.

Because cannabis is regulated at the state level in the United States, the specific requirements for a testing-laboratory license vary by jurisdiction. There is no single national checklist. If you are setting up a lab or verifying a lab’s credentials, you need to go directly to your state’s cannabis regulatory agency and read the codified rules. I cannot give you a universal application checklist because one does not exist. What I can tell you is that most programs require proof of a physical location, a quality manual, personnel records, and, increasingly, evidence of ISO/IEC 17025 accreditation or a plan to obtain it.

Note: Hemp testing sits under a different federal framework. If your lab tests hemp for compliance purposes, check your state’s department of agriculture rules separately from the cannabis program rules. The two licensing tracks are often administered by different agencies.

The license is the floor, not the ceiling. It tells you the lab cleared the regulatory minimum. It says nothing about whether the lab’s HPLC method for potency is properly validated or whether its measurement uncertainty is fit for the decision being made.

Step 2: Understand what ISO/IEC 17025:2017 accreditation actually covers

ISO/IEC 17025:2017, titled “General requirements for the competence of testing and calibration laboratories,” is an international standard against which accreditation bodies assess laboratories. It is not a cannabis-specific document. It applies to any testing or calibration laboratory in any field. What makes it relevant to cannabis is that it is the standard most state regulators point to when they require accreditation, and it is the framework that accreditation bodies use when they issue a scope.

The accreditation scope is the technical statement identifying the laboratory activities for which an accreditation body has found the laboratory competent. For a cannabis lab, that scope might list potency testing of flower by HPLC, residual solvent testing by GC-MS, and heavy metals by ICP-MS, each tied to a specific matrix and method reference. If an analyte or matrix does not appear on the current scope, the lab should not represent that result as accredited.

This is the point that trips up growers and even some regulators. A lab can be accredited for potency but not for mycotoxins. A lab can be accredited for flower but not for concentrates. The scope is not a blanket endorsement of everything the lab does. It is a line-item list.

Note: Scope verification requires pulling the accreditation body’s current certificate and detailed scope document directly from the accreditation body’s public registry. A logo on a certificate of analysis or a statement on the lab’s website that it is “ISO certified” is not verification. ISO/IEC 17025 does not use the term “certified” for laboratories; the correct term is “accredited.”

When you receive a certificate of analysis, the first thing to check is whether the analyte and matrix on that COA appear on the lab’s current accreditation scope. See our lab directory for links to accreditation body registries by state.

Step 3: Work through the five clause areas that drive cannabis lab audit findings

ISO/IEC 17025:2017 has eight sections. In cannabis labs, five clause areas generate the majority of nonconformities during accreditation audits. Here is what each one requires and why it matters on the bench.

Clause 4.1, Impartiality. The standard requires laboratories to identify, analyze, and eliminate or minimize risks to impartiality as a continuing responsibility, not a one-time declaration. In cannabis, the classic impartiality risk is a lab that has a financial relationship with a cultivator whose samples it tests, or a lab director who holds an ownership stake in a dispensary. The standard requires documented analysis of these risks and evidence that they are managed. A policy statement in the quality manual is not enough; the auditor will ask for the risk register and the evidence of review.

Clause 7.2, Method verification and validation. ISO/IEC 17025:2017 distinguishes verification from validation: clause 7.2.1.5 requires verification that the laboratory can properly perform methods before introducing them, while clause 7.2.2.1 requires validation of non-standard methods, laboratory-developed methods, and standard methods used outside their intended scope or otherwise modified. If you are running a published AOAC or USP method without modification, you verify it. If you have modified the extraction, changed the column, or developed the method in-house, you validate it. The validation study must be documented and must cover the performance characteristics relevant to the intended use. For more on what a full validation study looks like, see our method validation deep-dive.

Clause 7.6, Measurement uncertainty. The standard requires laboratories to identify and evaluate significant contributions to measurement uncertainty, including sampling contributions where relevant. In cannabis potency testing, typical contributors include calibration standard purity, volumetric preparation, instrument response variability, and sample homogeneity, though the specific contributors depend on the validated method. A lab may use reproducibility data from an interlaboratory validation study as an estimate of measurement uncertainty, provided its own repeatability and reproducibility are not larger than the corresponding study values. The uncertainty estimate must appear in or be available with the test report when the client needs it for a compliance decision.

Clause 7.7, Ensuring the validity of results (proficiency testing). The standard requires laboratories to monitor the validity of their results. For cannabis labs, the primary tool is proficiency testing (PT), where multiple laboratories test identical samples to monitor whether they can correctly use a method. Passing a PT round is not the same as completing an internal method-verification study, and the two are not interchangeable. Most accreditation bodies require participation in PT for each analyte category on the scope at a defined frequency. An unsatisfactory PT result triggers a corrective-action requirement under Clause 8.7.

Clause 8.7, Corrective actions. When a nonconformity occurs, whether from a failed PT round, an out-of-control QC sample, or an audit finding, the standard requires the laboratory to determine the cause and prevent recurrence. Clause 8.7.1 requires evaluating the need to eliminate the cause so the nonconformity does not recur, determining the causes, implementing needed action, and reviewing corrective-action effectiveness. Clause 8.7.3 requires retaining records of the nature of the nonconformities, causes, subsequent actions, and results of corrective action. A corrective action that says “retrained staff” with no effectiveness check is a finding waiting to happen.

Note: Clause 7.10 covers nonconforming work, including control of nonconforming work, evaluation of significance, decisions about acceptability, and notification to the customer. Corrective action is addressed separately in Clause 8.7. Auditors look for evidence that both clauses are addressed appropriately.

The five clauses above are where I see labs lose accreditation or fail surveillance audits. The equipment and traceability clauses (6.4 and 6.5) matter too, but they are usually easier to document because they map directly to calibration records.

Step 4: Read an accreditation scope the way an auditor does

When a lab hands you its accreditation scope, or when you pull it from the accreditation body’s registry, you are looking at a technical document with a specific structure. Here is how to read it.

First, confirm the accreditation body. In the United States, accreditation bodies that operate in the cannabis space include ANAB (ANSI National Accreditation Board) and Perry Johnson Laboratory Accreditation (PJLA), among others. The accreditation body must itself be recognized, typically through a mutual recognition arrangement. The scope is only as credible as the body that issued it.

Second, check the effective date and expiration. Accreditation is not permanent. Surveillance audits and reassessments happen on cycles. A scope that expired six months ago is not a current credential.

Third, read the line items. Each line should identify an analyte or analyte class, the matrix or matrices, and the method or technology. If you are sending flower for pesticide testing, confirm that pesticides in flower appear on the scope, not just pesticides in concentrate or pesticides in a generic “cannabis” matrix that your state’s program does not accept as equivalent.

Fourth, check the reporting clause. ISO/IEC 17025:2017 Clause 7.8 requires results to be reported accurately, clearly, unambiguously, and objectively, and specifies report-content requirements. If a COA carries an accreditation logo on a result that is not within the scope, that is a nonconformity.

I suggest labs take it a step further and keep a copy of their current scope in the client portal alongside each COA, so growers and manufacturers can verify the credential without making a phone call. For a broader look at how to prepare for the accreditation audit itself, see our ISO 17025 audit preparation guide.

Note: Some state programs maintain their own list of approved laboratories and publish the scope or approved analyte list directly on the regulator’s website. Where that exists, it is a faster verification path than contacting the accreditation body directly. Check your state regulator’s laboratory approval page first.

Step 5: Confirm a lab holds both credentials before you rely on its results

Verifying a lab’s credentials is a two-step process, and both steps are necessary.

For the state license, go to the cannabis regulatory agency’s official database or license lookup for the jurisdiction where the lab operates. Confirm the license is active, covers testing (not just cultivation or retail), and has not been suspended or conditioned. Because cannabis is regulated state by state, there is no single national database. You must go to the specific state’s regulator.

For the accreditation, go to the accreditation body’s public registry, not the lab’s website. Pull the current certificate and the detailed scope. Confirm the analyte and matrix you care about appear on the scope. Confirm the scope has not expired. If the lab claims accreditation from a body you have not heard of, verify that the body is itself recognized through a mutual recognition arrangement.

ISO/IEC 17025 accreditation does not establish that a laboratory holds every license, permit, registration, or approval required by a cannabis regulator, and a state license does not establish technical competence. The two credentials answer different questions and must be verified separately.

A cultivator or manufacturer who skips either check is trusting a result they cannot actually validate. For context on what compliance testing covers and why it costs what it costs, see our compliance testing overview and our cost-per-sample breakdown.

Quick answers

What is the difference between a cannabis lab license and ISO 17025 accreditation? A state cannabis testing license is a regulatory authorization from the jurisdiction’s cannabis regulator that permits the laboratory to legally accept and report on cannabis samples. ISO/IEC 17025:2017 accreditation is a separate, internationally recognized competence assessment confirming the lab produces technically valid results. A lab can hold one without the other, but most state programs now require both before a certificate of analysis carries legal weight.

What does an ISO 17025 accreditation scope actually list for a cannabis lab? An accreditation scope identifies the specific laboratory activities for which an accreditation body has found the laboratory competent, including the analytes tested, the sample matrices, the methods or technologies used, and the reporting activities covered. If an analyte or matrix does not appear on the current scope document, the lab should not represent that result as accredited. You verify the scope by pulling the accreditation body’s live certificate, not the lab’s own website.

Which clauses of ISO/IEC 17025:2017 are most critical for cannabis labs to satisfy? The clauses that generate the most audit findings in cannabis labs are Clause 4.1 (impartiality), Clause 7.2 (method verification and validation), Clause 7.6 (measurement uncertainty), Clause 7.7 (validity of results, which covers proficiency testing), and Clause 8.7 (corrective actions). Each clause requires specific documented evidence, not just a policy statement in the quality manual.

What is the difference between method verification and method validation under ISO 17025? Verification demonstrates that a laboratory can correctly perform an already-published, adopted method in its own hands. Validation establishes that a method is fit for its intended use and is required for laboratory-developed, non-standard, or modified methods before results can be reported. Passing a proficiency test is not a substitute for either study.

How do I verify that a cannabis lab is actually accredited for the test I care about? Contact the accreditation body directly and request the lab’s current certificate and detailed scope document. Check that the specific analyte, matrix, and method you need appear on that scope, because accreditation applies only to the activities listed. A lab’s website, a logo on a certificate of analysis, or a verbal claim of being “ISO certified” is not sufficient verification.

Does ISO 17025 accreditation replace a state cannabis lab license? No. ISO/IEC 17025 accreditation demonstrates technical competence against an international standard but does not authorize the laboratory to operate under a state cannabis program. State licensing and accreditation are parallel requirements issued by different bodies for different purposes, and a lab must satisfy both independently.

Sources

• ISO/IEC 17025:2017, General requirements for the competence of testing and calibration laboratories
• ISO overview page for ISO/IEC 17025 (2005 edition reference)
• ISO publication PUB100424, method validation guidance
• ISO TC34/SC9 FAQ on ISO 16140-3 method verification and proficiency testing
• ISO 19036 measurement uncertainty technical presentation, ISO TC34/SC9 WG2
• ANAB ISO/IEC 17025 cannabis testing accreditation