New York’s cannabis industry operates under strict regulations to protect public health and safety. The Office of Cannabis Management (OCM) under the Cannabis Control Board oversees licensing and compliance for growers (cultivators) and manufacturers (processors). Being licensed is just the beginning; to stay operational, cannabis businesses must adhere to a comprehensive set of rules governing everything from security to product testing.
Below, we break down a detailed compliance checklist for New York cannabis cultivators and processors, with guidance on how to meet each requirement. Short, actionable sections will help ensure your operation remains fully compliant, avoiding fines or license loss while delivering safe products to consumers.
The Need for an OCM License for Cannabis Businesses
Your OCM license defines exactly what you're allowed to do: grow, process, or distribute cannabis and where you can do it. If you operate outside those permissions, you risk fines, suspension, or losing your license entirely.
What Can Go Wrong
Licensed manufacturers often make mistakes like:
- Operating beyond license scope (e.g., distributing without a distribution license)
- Not reporting facility or ownership changes to OCM
- Using unlicensed partners for packaging, testing, or logistics
- Selling unapproved or unregistered products
- Sourcing cannabis from out-of-state suppliers (which is illegal in NY)
What to Do
- Know your license inside out. Stay within its limits.
- Report any business changes to OCM before making them.
- Use only OCM-approved vendors and labs.
- Register every product batch and format before sale.
- Source only from NYS-licensed suppliers.
- Keep detailed records of everything: processes, partners, product info, and communications.
Stay within scope. Stay transparent. Stay audit-ready. That’s how you protect your license and your business.
Cannabis Compliance Checklist for Businesses in New York
1. Maintain Licensing Compliance
Operate strictly within your OCM license. A processor cannot distribute or retail. Crossing license boundaries violates New York’s cannabis framework. A manufacturer recently nearly lost their license after subcontracting unlabeled pre-roll packaging to a non-permitted partner.
Update OCM before making changes. Changing address, ownership, or activities? File the amendment first via cannabis.ny.gov. Don’t assume minor shifts are exempt.
Renew on time. Most licenses require biennial renewal with fees. Set alerts and track deadlines. A lapse can shut you down instantly.
2. Secure Your Cannabis Manufacturing or Growing Facility
Install 24/7 surveillance. NY requires high-res cameras with 60-day storage, backup power, and full coverage of grow areas, labs, entries, and storage. OCM guidance expects redundancy and cloud backups.
Limit access. Only trained staff (21+) should enter sensitive areas. Use badges, biometrics, or access logs. Inventory must be locked when idle.
Alarm systems are mandatory. Use real-time alerts for failures, power loss, or tampering. Store logs and notify security vendors immediately if systems go down.
Maintain GMP conditions. Processing areas must be clean, ventilated, and compliant with fire codes. If you're using solvents, install certified detectors.
3. Implement Seed-to-Sale Tracking
Log everything in real time. New York mandates the use of BioTrack or a compatible system. Track from germination to packaging. Each plant or product gets a tag. Any movement needs a manifest sender, receiver, quantity, time, and employee ID.
Keep 5+ years of records. Record every transaction, lot, tax, and financial detail. OCM will audit your books. Notify OCM of your tracking system. Integration with BioTrack was required by Jan 2025. If you're still unaligned, act now since OCM updates tracking data constantly and expects you to sync.
4. Follow Labeling and Packaging Standards for Cannabis Products
Use child-resistant, tamper-evident packaging. Products must not appeal to minors, no bright colors, cartoons, or candy mimicry. Follow OCM packaging rules.
Include required label info:
- THC/CBD potency per serving and package
- Ingredient and allergen disclosure
- Batch number linked to your COA
- License number and packaging facility info
- Warnings about age, health risks, driving, pregnancy, and FDA non-approval
Avoid medical claims. NY forbids saying cannabis “treats” or “cures” anything. Stick to facts.
Keep certification proof. Store CRP test results from your packaging supplier and documentation that your designs match OCM label regulations.
5. Test Every Cannabis Batch with a Certified Lab
Use only OCM-permitted labs. Every batch of flower, extract, and edible must pass lab testing before sale. No COA = no compliance. We’ve helped several operators meet these requirements through our testing systems at DRS Testing.
Labs test for:
- THC/CBD potency to verify label accuracy
- Microbials like E. coli, Salmonella, and mold
- Mycotoxins such as aflatoxins and ochratoxins
- Heavy metals (lead, arsenic, cadmium, mercury)
- Pesticides, with strict residue limits
- Residual solvents for extracted products
- Terpenes, especially if you market flavor or aroma profiles
- Moisture & water activity for shelf stability
- Foreign materials like hair, fibers, or debris
Follow the latest OCM testing limits without exception. These change frequently.
Use a certified sampling firm. You cannot collect your samples. A licensed sampler must perform it on video, then deliver samples under seal to the lab. DRS once rejected a batch because the sampling footage was missing. Don’t skip this step.
Only sell if it passes. Failed batches require destruction or approved remediation. Never dilute, relabel, or mix failed batches. Doing so invites criminal charges.
6. Train Your Staff and Enforce SOPs
Train everyone. Every employee handling cannabis must be trained in OCM rules. Cover access control, hygiene, safety protocols, and data entry into BioTrack. Keep attendance logs. Regulators will ask for them.
Write SOPs and follow them. Have written protocols for growing, extraction, packaging, labeling, and cleaning. Update as laws change.
Require PPE. Gloves, gowns, goggles, and masks reduce contamination risks. Train for emergencies and log drills.
Build a compliance culture. Encourage reporting of issues. Appoint a Compliance Officer. DRS partners with clients quarterly to run mock audits. It’s the best way to surface silent risks.
7. Stay Inspection-Ready
OCM can inspect anytime. Unannounced visits are routine. Keep your license displayed. Maintain signage and make sure your records, cameras, and labels are up to date.
Avoid common violations:
- Inventory miscounts
- Mislabeling or missing warnings
- Broken surveillance or unlocked doors
- Selling to or buying from unlicensed sources
- Dirty or pest-infested environments
Document everything. If you fix an issue, log the correction. For minor problems, OCM may allow a Corrective Action Plan. For serious ones, like testing violations, expect suspension or worse.
Monitor OCM updates often. Regulations evolve. In May 2025, new analyte limits and terpene thresholds were issued. If you’re not adapting, you’re falling behind.
Final Thoughts
Compliance in New York’s cannabis industry isn’t optional; it’s your competitive edge. By embedding regulatory standards into every step of your operation from licensing and security to testing, packaging, and recordkeeping, you protect your business, build trust, and ensure long-term growth. Use the OCM guidelines and partners like DRS Testing to audit, adapt, and stay ahead. In a highly regulated market built on public health and safety, a clean compliance record isn’t just a legal necessity; it’s your foundation for earning loyalty, scaling sustainably, and thriving in the Empire State.
Leave a Comment