The Missing Link in Medical Cannabis Quality: From Cultivation to Certificate of Analysis

Medical Cannabis Awareness Month in the UK provides an opportune moment to address a critical question: when physicians prescribe cannabis-based products for medicinal use, what level of confidence can they have regarding the contents of the package delivered to patients?

The UK regulatory framework appears stringent on paper. Cannabis-based products for medicinal use (CBPMs) are subject to Medicines and Healthcare products Regulatory Agency (MHRA) and Home Office oversight, require Good Manufacturing Practice (GMP) compliance, secure controlled drug handling protocols, and a valid Certificate of Analysis (CoA) prior to supply.

In practice, however, the pathway from cultivation to CoA remains fragmented. Data traverses multiple platforms - emails, spreadsheets, and disconnected systems - with each transfer point representing a potential vulnerability for quality assurance, traceability, and ultimately, patient safety.

This article examines the points of failure within this chain and argues that the "missing link" is not additional regulation, but rather an integrated, rule-based quality infrastructure that connects cultivation, processing, testing, and release in a manner that satisfies regulatory requirements and provides transparency for clinicians.

The UK Medical Cannabis Landscape: Current State

Medical cannabis has been legally available in the UK since November 2018, yet awareness and accessibility continue to lag behind the legislative framework.

Several data points illustrate this disparity between potential and reality:

• Prescription growth: Private prescriptions for unlicensed cannabis-based medicines increased by approximately 118% between 2021 and 2023.

• Patient numbers: Freedom of Information data from late 2024 indicated approximately 300,000 medical cannabis items prescribed since legalization, with an estimated 35,000 or more active patients.

• Public awareness deficit: A 2023 survey revealed that approximately 59% of UK adults were unaware of medical cannabis legalization, while roughly 35% incorrectly believed it remained illegal.

• Eligible population: A nationally representative survey of over 4,000 participants suggested that approximately 50.2% of the population experiences conditions such as chronic pain, anxiety, or depression that could potentially qualify them for medical cannabis therapy, though many have not explored this treatment option.

• Economic implications: Economic modeling indicates that expanded NHS access to medical cannabis could generate up to £13.3 billion for the UK economy over a decade through reduced hospital utilization and improved workforce participation.

Demand exists, awareness remains incomplete, and the system faces pressure to scale safely. This convergence makes quality assurance and traceability strategically critical, not merely technical considerations.

The Limitations of Certificates of Analysis

The CoA serves as the final, most visible indicator of product quality. For CBPMs, MHRA guidance stipulates that supply chains maintain a valid CoA, supported by GMP certification, comprehensive documentation, and adverse event reporting procedures.

A standard CoA for medical cannabis products typically includes:

• Identification and quantification of primary cannabinoids and terpenes

• Specifications for impurities, residual solvents, and pesticide residues

• Microbiological quality parameters and mycotoxin levels

• Batch identification, manufacturing site details, and testing laboratory information

However, a CoA's reliability is fundamentally dependent on the underlying data, processes, and controls. Several challenges commonly emerge in operational settings:

Data fragmentation across the supply chain: Cultivators maintain plant batch records, environmental monitoring data, and agronomic intervention logs. Manufacturers track blending operations, extraction processes, and packaging. Laboratories document analytical procedures. Pharmacies record dispensing activities. These datasets frequently reside in isolated systems without interoperability.

Manual data transfer and version control errors: Specifications are often transcribed into spreadsheets or static PDF documents. Modifications in one system (such as revised cannabinoid specifications or updated impurity limits) may not propagate uniformly across platforms. Manual data handling represents an underappreciated risk factor.

Limited information access for prescribers and patients: While manufacturers and importers possess detailed CoAs, prescribers typically receive only summary product information. Patients have even more restricted access to batch-specific quality data, relying primarily on product labeling and systemic trust.

Variability in laboratory practices: Many cannabis testing laboratories operate under ISO/IEC 17025 accreditation standards, which establish competency requirements for testing and calibration. However, when analytical methodologies differ or sample handling protocols lack harmonization, different laboratories may generate disparate results for identical products.

The CoA is essential but insufficient. The critical question is whether a continuous, verifiable digital record exists linking cultivation initiation through to the analytical values documented in that certificate.

Supply Chain Vulnerabilities: From Cultivation to Certificate

Cannabis intended for medicinal use is classified as a herbal starting material. In Europe, Good Agricultural and Collection Practice (GACP) guidelines establish quality expectations for herbal substances, with the 2025 revision strengthening requirements for indoor cultivation, documentation standards, and facility controls.

For cannabis, the typical supply chain comprises:

1. Cultivation under GACP-aligned controls

• Genetic material and mother plant registration

• Environmental parameter monitoring (illumination, temperature, humidity)

• Documentation of fertilization and plant protection measures

2. Post-harvest processing and GMP manufacturing

• Drying, curing, and trimming operations

• Blending to achieve target potency specifications

• Extraction, formulation, and packaging under GMP conditions

3. Quality control laboratory testing

• Identity, potency, and purity analysis under ISO/IEC 17025 or equivalent standards

• Stability studies to establish shelf-life parameters

4. Release for supply and distribution as unlicensed medicinal products

• Compliance with MHRA guidance for unlicensed CBPMs

• Import and supply under controlled drugs licenses with mandatory record-keeping

While regulatory requirements appear clearly defined at each stage, vulnerabilities emerge at interface points.

Common Failure Modes

Batch identification discrepancies: When batch identifiers, barcodes, and plant grouping systems lack harmonization across cultivation, manufacturing, and testing phases, risks arise for incorrect CoA linkage or product mislabeling.

Insufficient environmental-quality correlation: Environmental deviations during cultivation (such as sustained elevated humidity) may correlate with subsequent microbiological issues. When data remains siloed and disconnected from quality control results, trend analysis becomes challenging.

Fragmented change control: Modifications to cultivation protocols, extraction parameters, or analytical methods may receive approval within individual systems without cross-referencing, complicating root cause investigations when deviations occur.

Inadequate pharmacovigilance feedback: As CBPM patient populations expand, real-world safety data accumulates through registries and observational studies. However, adverse event signals rarely feed into structured quality risk assessments at the batch or methodology level.

The result is a supply chain that appears regulated on paper but remains operationally vulnerable.

The Imperative for Robust Quality Systems

Cannabis is recognized as the most widely used controlled substance in Europe, with concerns regarding potency trends and contamination in illicit markets.

In the UK context, this matters for two key reasons:

1. Patient comparisons with illicit products: Research demonstrates that illicit cannabis frequently contains mold and other contaminants, whereas legally prescribed medical cannabis must satisfy defined quality and safety standards. Should prescribed products fail to meet these standards, rebuilding patient trust becomes extremely difficult.

2. Awareness campaigns highlighting access gaps: National Medical Cannabis Awareness initiatives have emphasized that many eligible patients still lack access to or understanding of CBPMs, six years post-legalization. Concurrently, broader healthcare system pressures and medication shortages are driving some patients to more actively seek alternatives, including medical cannabis.

This creates a straightforward equation: increasing patient numbers, rising prescription volumes, and intensifying quality scrutiny.

In mature pharmaceutical markets, quality defects and recalls are unavoidable realities. European regulatory systems process numerous such cases annually across all therapeutic categories, addressing packaging failures, stability concerns, and manufacturing deviations.

The objective for medical cannabis is not to claim immunity from such events, but to design systems capable of:

• Early issue detection

• Rapid identification of affected batches (minutes rather than days)

• Comprehensive root cause tracing across cultivation, processing, and analytics

• Provision of credible explanations and corrective action plans to patients and prescribers

This remains challenging with dispersed spreadsheets and isolated information systems.

The Missing Link: Integrated, Rule-Based Quality Infrastructure

The regulatory components for CBPM quality exist: GACP for cultivation, EU GMP principles for manufacturing, ISO/IEC 17025 for laboratory operations, MHRA guidance for unlicensed specials, and Home Office controlled drug licensing.

What continues to emerge is the digital infrastructure connecting these components.

A contemporary regulatory technology approach to medical cannabis quality typically encompasses:

End-to-End Batch Genealogy

Every final product batch should be traceable to:

• Specific cultivation facilities and growth cycles

• Source mother plants or clone populations

• Processing steps and equipment utilized

• Precise samples analyzed and analytical instruments employed

This transcends conventional production documentation, providing structured batch genealogy that enables genuine root cause analysis when specification deviations occur.

Automated Rule Sets Aligned with Regulatory Requirements

Rather than relying exclusively on manual review, configurable rule engines can:

• Verify completeness of critical cultivation data before releasing harvest batches for processing

• Confirm that manufacturing parameters (e.g., extraction yields, in-process potency) fall within validated ranges

• Validate laboratory results against both regulatory limits and product specifications before CoA generation

• Enforce mandatory stability data review before shelf-life extensions

These rules operationalize MHRA expectations for documented control while minimizing human oversight errors.

System Integration Across Cultivation, Manufacturing, and Laboratory Operations

Rather than functioning as isolated platforms, cultivation management tools, manufacturing execution systems, and Laboratory Information Management Systems (LIMS) can be interconnected through well-defined interfaces:

• Automated sharing of batch and sample identifiers

• Seamless CoA data flow without manual transcription

• Cross-chain visibility of deviations throughout the product lifecycle

• 
  

Audit-Ready Documentation and Reporting

Every modification to specifications, methods, master data, or batch records receives time-stamps, attribution, and review documentation. When inspectors inquire about specification changes or batch release decisions, responses derive from a single source of truth rather than requiring searches through distributed file systems.

Pharmacovigilance and Registry Feedback Mechanisms

As observational safety and effectiveness data accumulates in registries and clinical databases, structured integration into quality risk management enables manufacturers to:

• Identify correlations between specific quality attributes and clinical outcomes

• Adjust control strategies transparently

• Justify specification refinements using real-world evidence

This represents the "missing link": not additional paperwork, but a connected, rule-aware infrastructure ensuring every CoA reflects a controlled, traceable process from initial cultivation through final release.

Practical Implementation Example

Consider a representative scenario for a UK CBPM imported from Europe:

Cultivation

Indoor cultivation follows GACP principles with documentation of environmental parameters and crop protection measures. Each plant batch receives unique identification encoded in labels used from propagation through harvest.

Processing and Manufacturing

Upon biomass entry to the GMP facility, batch identifiers are scanned and linked to manufacturing orders. Extraction and formulation parameters are captured directly in electronic batch records. Automated checks compare in-process test results against validated ranges, with any deviation triggering mandatory deviation records requiring resolution before continuation.

Quality Control and CoA Generation

Samples transfer to ISO/IEC 17025 accredited laboratories where method parameters, instrument calibration status, and analyst information are recorded. Laboratory information systems transmit final results to manufacturing quality systems through secure interfaces. Rule engines verify identity, potency, impurity, and microbiological results against pre-configured specifications and regulatory limits. CoAs are generated for quality approval only upon satisfying all rule-based criteria.

Import, Supply, and Pharmacovigilance

Importers confirm valid CoAs, verify supply chain compliance, and document movements consistent with MHRA guidance for unlicensed CBPMs. Pharmacies dispense against prescriptions with batch-level dispensing documentation. Adverse events and product complaints are logged with batch references, feeding both pharmacovigilance and quality systems.

In such systems, if subsequent stability studies reveal emerging impurities or if adverse event clusters appear in registries, affected batches and patients can be identified rapidly. Corrective actions are supported by traceable data rather than assumptions.

Stakeholder Benefits

For patients and clinicians, this operational complexity translates into three tangible outcomes:

Consistent product performance: Stable potency profiles, minimal contamination, and reliable shelf-life reduce patient frustration stemming from inconsistent experiences with illicit market products.

Transparent incident communication: When batch recalls or use restrictions become necessary, data-backed explanations build trust. Rather than vague "quality defect" notifications, manufacturers can explain the specific issue, detection method, and why other batches remain unaffected.

Enhanced real-world evidence generation: Linking batch-specific quality data with clinical outcomes in registries enables evidence-based understanding of which patients benefit, at what dosages, and with what risk profiles, moving beyond theoretical discussions.

For regulators and inspectors, integrated regulatory technology approaches offer:

• More efficient, risk-informed inspections

• Simplified compliance verification across GACP, GMP, specials regulations, and controlled drugs requirements

• Richer datasets informing policy decisions regarding expanded NHS access

For industry, this infrastructure reduces rework, manual verification requirements, and emergency investigations while positioning organizations to meet evolving expectations as guidelines are updated and new quality considerations emerge.

Medical cannabis exists within a broader ecosystem of highly regulated products requiring robust traceability and quality evidence, including advanced therapy medicinal products, biologics, and clinical trial materials.

Regulatory technology providers in this domain, such as Simpleafied, develop the connected, audit-ready infrastructure described above for medical cannabis and related sectors. The objective is not regulatory framework replacement, but rather enabling organizations of all sizes to achieve scalable compliance.

For UK Medical Cannabis Awareness Month, the regulatory technology perspective is clear:

• Quality extends beyond end-process certification

• Patient safety requires more than stringent regulations on paper

• The missing link is operational transparency between cultivation and CoA (transparency that prescribers, patients, and regulators can trust)

As patient populations grow and expectations rise, organizations investing in this integrated quality infrastructure will help establish a medical cannabis market that is not merely larger, but demonstrably safer and more reliable.