California generally requires licensed cannabis testing laboratories to maintain ISO/IEC 17025 accreditation, although it allows a 12-month interim license while a laboratory pursues it.[1] The badge matters. But it is easy to read it as a promise that every number on a lab’s reports is right, and it is not that. This guide explains what ISO 17025 accreditation is, who grants it, what it requires and what it does not guarantee.
What Is ISO/IEC 17025?
ISO/IEC 17025 is the international standard for testing and calibration laboratories. It sets out requirements for the competence, impartiality and consistent operation of a laboratory.[2] The current version is the third edition, published in November 2017, which replaced the 2005 edition; ISO reviewed and confirmed it in 2023, so it remains current.[2]
In practice, the standard covers the whole life of a result: how the lab stays impartial and protects client confidentiality, the competence of its staff, the suitability of its equipment and environment, how it selects and validates its methods, how it handles samples, how it checks its own results, and how it reports them. For how a lab proves that a method works in the first place, see our explainer on method validation.
Who Grants Accreditation?
Not ISO. The International Organization for Standardization writes the standard but does not accredit anyone. Accreditation is granted by independent accreditation bodies, which are themselves assessed against a separate standard, ISO/IEC 17011. Pennsylvania’s medical marijuana regulations spell this out: an accreditation body operates under ISO/IEC 17011 and determines a laboratory’s compliance with ISO/IEC 17025.[3]
In the United States, cannabis labs are accredited by bodies such as A2LA and ANAB. A2LA runs a dedicated cannabis and hemp program that accredits labs to ISO/IEC 17025:2017 and can also accredit the sampling that precedes testing.[4] Accreditation bodies that pass peer evaluation can sign the ILAC Mutual Recognition Arrangement. The arrangement is intended to make accredited results more readily accepted internationally and reduce unnecessary retesting. It does not guarantee that every regulator or customer will accept a report, since local laws and testing requirements still apply.[5]
Accreditation Has a Scope
Accreditation does not cover everything a laboratory does. It applies to the specific testing activities listed in its scope, typically identifying the analytes or tests, methods, matrices and applicable ranges or detection limits. The certificate together with that scope is the definitive statement of what the lab is accredited to do.[6] A lab can be accredited for potency in flower and not for terpenes, or for pesticides in plant material and not in edibles.
The practical advice follows directly. Ask for the scope document, not just the certificate, and check that the test you are paying for is on it. A certificate of analysis should also make clear which results fall inside the lab’s accreditation.
Proficiency Testing: Checking the Checkers
ISO/IEC 17025:2017 requires labs to monitor the validity of their results. Part of that is internal: reference materials, quality-control samples and repeat testing. Part is external: proficiency testing, in which a provider sends the same sample to many labs and compares their answers. ANAB requires accredited laboratories to participate in at least one proficiency test or interlaboratory comparison each calendar year and to cover every major sub-area of their accredited scope during each four-year period. Results outside the acceptance criteria must be investigated and, where necessary, corrected.[7]
An education-focused NIST interlaboratory exercise shows why such comparisons matter. For two hemp oils, between-laboratory variability in delta-9 THC results was only 2.2% and 2.7%, yet 57% and 54% of laboratory means fell outside NIST’s narrow tolerance ranges. About 17% of laboratories fell outside the broader consensus ranges for both oils, and laboratories that measured high on one sample tended to measure high on the other, a pattern NIST said often indicates calibration bias.[8] The exercise was similar to proficiency testing but did not assign pass-or-fail grades, and the report does not say whether participating laboratories were accredited.
What Accreditation Does Not Guarantee
Accreditation is an assessment of a lab’s systems and competence, carried out periodically. It is not a check on each result. It does not promise that two accredited labs will agree; our article on why two labs give different THC numbers shows how far apart results can land. It says nothing about whether the sample sent to the lab represented the batch on the shelf. And it does not prevent a lab from failing its own standard between assessments. For a practitioner’s view of what goes wrong in labs and how good ones catch it, see our conversation with Josh Wurzer of SC Labs.
Is It Required?
For licensed cannabis labs, often yes. California requires its cannabis testing labs to obtain and maintain ISO/IEC 17025 accreditation, with a 12-month interim license available while they work toward it.[1] Pennsylvania requires applicants to become approved medical marijuana laboratories to submit their most recent certificate of accreditation, with procedures approved by the accreditation body that issued it, under regulations effective March 2023.[3,9] Requirements differ from state to state, so check the current rules where you operate.
How Labs Get Accredited
The route is broadly the same everywhere. A lab studies the standard and commits management to it; builds and documents a quality management system covering its policies, procedures and records; validates its methods; trains its staff; runs internal audits and fixes what they find; participates in suitable proficiency-testing schemes or interlaboratory comparisons where available; and then applies to an accreditation body, which assesses it on site and defines its scope. The lab is then reassessed at intervals to keep it.
None of this makes a lab infallible. What it does is require systems designed to make errors more detectable and traceable: documented records, quality controls, corrective actions and outside assessment. For the wider picture of how cannabis testing works, start with our complete guide to cannabis testing.
References
- California Department of Cannabis Control. Testing laboratory license types; Testing laboratories.
- International Organization for Standardization. ISO/IEC 17025:2017 General requirements for the competence of testing and calibration laboratories. Edition 3, November 2017.
- 28 Pa. Code § 1141a.21, Definitions. Via Legal Information Institute, Cornell Law School.
- A2LA. Cannabis testing accreditation.
- ILAC. ILAC MRA and signatories; Benefits.
- Irish National Accreditation Board. PS 34: Policy Statement on Scope Format for Testing Laboratories Accredited to ISO/IEC 17025. Issue 3, May 2025.
- ANAB. Accreditation frequently asked questions (proficiency testing).
- Abdul-Rahman M, Phillips MM, Wilson WB. Cannabis Quality Assurance Program: Exercise 1 Final Report. NIST IR 8385. July 2021. doi:10.6028/NIST.IR.8385
- 28 Pa. Code § 1171a.23, Approval of laboratories. Via Legal Information Institute, Cornell Law School.
Editor’s note: This article was originally published on January 16, 2019, by Lance Griffin. In October 2026 the editors rebuilt it on the same page and merged two earlier articles on the same subject into it.
Last updated October 2026 · Originally published January 16, 2019.
