New York’s cannabis industry operates under strict regulations to protect public health and safety. The Office of Cannabis Management (OCM) under the Cannabis Control Board oversees licensing and compliance for growers (cultivators) and manufacturers (processors). Being licensed is just the beginning; to stay operational, cannabis businesses must adhere to a comprehensive set of rules governing everything from security to product testing.
Below, we break down a detailed compliance checklist for New York cannabis cultivators and processors, with guidance on how to meet each requirement. Short, actionable sections will help ensure your operation remains fully compliant, avoiding fines or license loss while delivering safe products to consumers.
Your OCM license defines exactly what you're allowed to do: grow, process, or distribute cannabis and where you can do it. If you operate outside those permissions, you risk fines, suspension, or losing your license entirely.
Licensed manufacturers often make mistakes like:
Stay within scope. Stay transparent. Stay audit-ready. That’s how you protect your license and your business.
Operate strictly within your OCM license. A processor cannot distribute or retail. Crossing license boundaries violates New York’s cannabis framework. A manufacturer recently nearly lost their license after subcontracting unlabeled pre-roll packaging to a non-permitted partner.
Update OCM before making changes. Changing address, ownership, or activities? File the amendment first via cannabis.ny.gov. Don’t assume minor shifts are exempt.
Renew on time. Most licenses require biennial renewal with fees. Set alerts and track deadlines. A lapse can shut you down instantly.
Install 24/7 surveillance. NY requires high-res cameras with 60-day storage, backup power, and full coverage of grow areas, labs, entries, and storage. OCM guidance expects redundancy and cloud backups.
Limit access. Only trained staff (21+) should enter sensitive areas. Use badges, biometrics, or access logs. Inventory must be locked when idle.
Alarm systems are mandatory. Use real-time alerts for failures, power loss, or tampering. Store logs and notify security vendors immediately if systems go down.
Maintain GMP conditions. Processing areas must be clean, ventilated, and compliant with fire codes. If you're using solvents, install certified detectors.
Log everything in real time. New York mandates the use of BioTrack or a compatible system. Track from germination to packaging. Each plant or product gets a tag. Any movement needs a manifest sender, receiver, quantity, time, and employee ID.
Keep 5+ years of records. Record every transaction, lot, tax, and financial detail. OCM will audit your books. Notify OCM of your tracking system. Integration with BioTrack was required by Jan 2025. If you're still unaligned, act now since OCM updates tracking data constantly and expects you to sync.
Use child-resistant, tamper-evident packaging. Products must not appeal to minors, no bright colors, cartoons, or candy mimicry. Follow OCM packaging rules.
Include required label info:
Avoid medical claims. NY forbids saying cannabis “treats” or “cures” anything. Stick to facts.
Keep certification proof. Store CRP test results from your packaging supplier and documentation that your designs match OCM label regulations.
Use only OCM-permitted labs. Every batch of flower, extract, and edible must pass lab testing before sale. No COA = no compliance. We’ve helped several operators meet these requirements through our testing systems at DRS Testing.
Labs test for:
Follow the latest OCM testing limits without exception. These change frequently.
Use a certified sampling firm. You cannot collect your samples. A licensed sampler must perform it on video, then deliver samples under seal to the lab. DRS once rejected a batch because the sampling footage was missing. Don’t skip this step.
Only sell if it passes. Failed batches require destruction or approved remediation. Never dilute, relabel, or mix failed batches. Doing so invites criminal charges.
Train everyone. Every employee handling cannabis must be trained in OCM rules. Cover access control, hygiene, safety protocols, and data entry into BioTrack. Keep attendance logs. Regulators will ask for them.
Write SOPs and follow them. Have written protocols for growing, extraction, packaging, labeling, and cleaning. Update as laws change.
Require PPE. Gloves, gowns, goggles, and masks reduce contamination risks. Train for emergencies and log drills.
Build a compliance culture. Encourage reporting of issues. Appoint a Compliance Officer. DRS partners with clients quarterly to run mock audits. It’s the best way to surface silent risks.
OCM can inspect anytime. Unannounced visits are routine. Keep your license displayed. Maintain signage and make sure your records, cameras, and labels are up to date.
Avoid common violations:
Document everything. If you fix an issue, log the correction. For minor problems, OCM may allow a Corrective Action Plan. For serious ones, like testing violations, expect suspension or worse.
Monitor OCM updates often. Regulations evolve. In May 2025, new analyte limits and terpene thresholds were issued. If you’re not adapting, you’re falling behind.
Compliance in New York’s cannabis industry isn’t optional; it’s your competitive edge. By embedding regulatory standards into every step of your operation from licensing and security to testing, packaging, and recordkeeping, you protect your business, build trust, and ensure long-term growth. Use the OCM guidelines and partners like DRS Testing to audit, adapt, and stay ahead. In a highly regulated market built on public health and safety, a clean compliance record isn’t just a legal necessity; it’s your foundation for earning loyalty, scaling sustainably, and thriving in the Empire State.
Submit your sample for testing.