The Evolution of Cannabis Testing Regulations: Navigating State and Federal Requirements

Testing rules have changed a great deal as more states legalized cannabis. They protect the safety and quality of what people consume, and they also create real work for labs and businesses. This post covers the split between state and federal rules, how testing requirements have changed over time, and what that means for the industry and for consumers. It was updated in September 2026, because the federal picture has moved a long way since 2023.

State and federal rules

Under federal law, cannabis that isn’t hemp is “marijuana”, a controlled substance. When this post was first written, all of it was in Schedule I. Most of it still is, but the ground has shifted.

Federal changes since 2023Checked Sep 28, 2026

Date	What changed
Aug 29, 2023	HHS recommends moving cannabis from Schedule I to Schedule III.
May 21, 2024	DOJ proposes the move to Schedule III (89 FR 44597).
Nov 12, 2025	Congress narrows the federal definition of hemp, effective a year later (Public Law 119-37, §781).
Dec 18, 2025	Executive Order 14370 directs the Attorney General to expedite rescheduling (EO 14370).
Apr 28, 2026	Cannabis in FDA-approved drugs, and cannabis under a state medical license, moves to Schedule III (91 FR 22714).
Jun 29 to Jul 15, 2026	DEA holds a hearing on moving the rest of cannabis to Schedule III (91 FR 22777). The decision is pending.
Sep 2, 2026	Congress delays most of the hemp change to December 11, 2026 (H.R. 6500, §2019).
Nov 12, 2026	Hemp products containing cannabinoids the plant can’t produce lose their federal hemp status.
Dec 11, 2026	The rest of the new hemp definition applies, unless Congress acts again.

Rescheduling. Since April 28, 2026, cannabis in an FDA-approved drug, or covered by a state medical license, sits in Schedule III. Everything else, including adult-use cannabis, “remains a schedule I controlled substance” in the words of the order itself. That order is being challenged in the D.C. Circuit. Whether the rest of cannabis moves to Schedule III is up to DEA after this summer’s hearing, and as of late September 2026 the judge’s recommended decision had not been issued. Even then, Schedule III would not make adult-use sales legal: the 2024 proposal says manufacture, distribution and possession “would remain subject to the applicable criminal prohibitions” of the Controlled Substances Act (89 FR 44597).

Hemp. The 2018 Farm Bill defined hemp as cannabis with no more than 0.3% delta-9 THC on a dry-weight basis. Public Law 119-37 changes that test to total THC, including THCA. It also excludes cannabinoids synthesized outside the plant, and caps final hemp-derived products at 0.4 mg per container of total THC plus any cannabinoids with THC-like effects (§781). For labs, that puts the federal line on the same total-THC calculation used for potency, but at trace levels: 0.4 mg in a 355 mL drink is about 1.1 mg/L, roughly a thousandth of the 1.0 mg/g limit of quantitation California sets for cannabinoid methods (Cal. Code Regs. tit. 4, §15724).

The FDA has approved one cannabis-derived drug, Epidiolex (purified CBD), and three synthetic cannabinoid drugs: Marinol, Syndros and Cesamet. It says THC and CBD can’t be added to food sold across state lines or sold as dietary supplements (FDA).

Federal oversight of testing itself is still limited. USDA sets testing rules for hemp crops: total THC, measured after decarboxylation or calculated from THCA, reported with its measurement uncertainty (7 CFR 990.25). For state-licensed cannabis there’s no federal standard, so each state writes its own rules (J AOAC Int., 2022). Rescheduling doesn’t change that. New Mexico’s regulator told licensees in June 2026 that federal actions “do not automatically modify” its testing requirements (CCD Industry Bulletin 26-07).

State rules cover testing methods and standards, requirements for testing laboratories, labeling and packaging, and allowable limits for cannabinoids and contaminants. They vary a lot in stringency. New Mexico, for example, still doesn’t require residual pesticide testing for topical products, while flower, concentrates and extracts must be tested (16.8.7.15 NMAC, Table 1). To see the rules for your state, use our state regulations explorer.

This patchwork is hard on businesses operating in several states and on consumers looking for consistent products. Part of our business is helping testing labs understand what they have to test, writing the SOPs to do it, and getting the laboratory state certified: that’s our accreditation and compliance work.

How testing rules have changed

In the early stages of legalization, testing requirements were often minimal, with a focus on basic potency testing for THC and CBD. As the industry has matured, the rules have become more stringent and more comprehensive.

Many states now require testing for a broader range of cannabinoids and contaminants, including pesticides, heavy metals, residual solvents and microbial contaminants. Testing laboratories must meet specific standards for accreditation, equipment and personnel qualifications. Some states also mandate third-party testing, where an independent laboratory tests the product instead of the business that made it, to keep results unbiased. That’s for the best: nobody wants to inhale a big puff of Salmonella and mercury.

States also change action limits and add tests. California has revised its pesticide action levels: the new limits take effect on October 1, 2026, and a second set applies from April 1, 2028 (DCC rulemaking DCC-2025-03-R). Other changes follow the same pattern. If a state was too permissive about the mercury a sample could carry and still pass, it can lower the action limit. A state may launch its program without treating mycotoxins as a hazard, then decide to add them to the required panel. Mycotoxins are often, but not only, run on an LC-MS the lab already owns, so adding them can be expensive, but not prohibitively so.

If you’re facing a changing landscape and struggling to keep up, that’s where we help: finding the cheapest route to a new test such as mycotoxins, the method that’s easiest to run day to day, or second-hand equipment that protects your budget. See Instruments & methods.

Some states also regulate terpene profiling, the analysis of the aromatic compounds behind a strain’s flavor, aroma and potential effects. Nevada lists terpene analysis among the required tests for flower (NCCR 11.050); California tests terpenoids only on request (tit. 4, §15725). Terpene profiles help consumers choose products by flavor or desired effect.

What it means for the industry and for consumers

For the industry, compliance is complex and costly. Businesses invest in equipment, people and quality control to meet each state’s rules, and those rules keep changing, which tests morale, budgets and understanding.

For consumers, testing is an assurance of safety and quality. Potency, contaminant and terpene results help people choose what they consume. Not everyone wants to drink 100-proof clear alcohol, and not everyone wants 30% THC cannabis without knowing its terpene profile. But every change in requirements means changing well-established methods, and that almost always creates confusion in testing laboratories.

Testing rules will keep moving at both levels: states revise their panels and limits, and federal law is partway through changes on rescheduling and on hemp. Keep your methods validated, your SOPs current and an eye on your regulator.