Co‑Packer Contracts for THC Beverages: Recall Authority, Insurance, and IP Ownership in 2025–2026

In 2025, beverage brands using co-packers (co-manufacturers) are learning the hard way that a “standard” manufacturing agreement isn’t a cannabis compliance plan—especially when products are sold through sophisticated retailers that run supplier audits, QA document requests, and rapid recall drills.

Recalls and retailer QA escalations are trending upward across food and beverage broadly, and regulators continue to sharpen expectations around recall readiness, traceability, and label accuracy. When you add a psychoactive active ingredient—plus fast-moving multi-state label changes—the contract becomes your operational playbook.

This post focuses on federal-level frameworks and best-practice contracting concepts for a THC beverage co-packer agreement 2025 recall authority insurance—with practical clause ideas for brands, co-packers, and investors.

Informational only, not legal advice.

The 2025–2026 backdrop: what changed (and why contracts broke)

FDA’s expectations for “recall ready” systems are not optional

Even when a recall is “voluntary,” FDA expects firms to be prepared to initiate quickly, with defined internal roles, draft templates, and reliable distribution records. See FDA’s guidance on timely voluntary recall initiation under 21 CFR Part 7 and the 2022 guidance document (still the key reference in 2025–2026): https://www.fda.gov/regulatory-information/search-fda-guidance-documents/initiation-voluntary-recalls-under-21-cfr-part-7-subpart-c

For many beverage brands, the problem isn’t that they lack a recall SOP—it’s that the contract doesn’t say who can pull the trigger.

FSMA Preventive Controls puts “receiving facilities” on the hook

If your co-packer is the facility that manufactures/processes the beverage, it is typically the entity implementing the Food Safety Plan under the FSMA Preventive Controls rule (21 CFR Part 117). FDA’s continuing multi-chapter draft guidance (updated January 2024) remains a key roadmap for how FDA thinks about compliance: https://www.fda.gov/regulatory-information/search-fda-guidance-documents/draft-guidance-industry-hazard-analysis-and-risk-based-preventive-controls-human-food

Critically, 21 CFR 117.139 requires a written recall plan when a hazard requiring a preventive control is identified: https://www.law.cornell.edu/cfr/text/21/117.139

Co-manufacturer supply-chain control is a known pressure point

If the brand specifies and approves ingredient suppliers (common for cannabinoids, emulsions, flavors), the co-packer still needs clarity on who is responsible for supplier approval/verification under FSMA’s supply-chain program requirements. FDA has specific guidance addressing co-manufacturer supplier approval and verification: https://www.fda.gov/regulatory-information/search-fda-guidance-documents/guidance-industry-supply-chain-program-requirements-and-co-manufacturer-supplier-approval-and

Surprise inspections and records access are more real—especially for global supply

In May 2025, FDA announced plans to expand unannounced inspections at foreign manufacturing facilities (including foods). While this announcement is often discussed in the drug context, it signals a broader push toward “same level of oversight” expectations for imported supply chains.

A contract that assumes “we’ll have time to prepare” is a liability.

Retailer insurance and audit requirements hardened

Major retailers increasingly require:

• Additional insured status
• Products/completed operations coverage
• Primary and noncontributory wording
• Waiver of subrogation

As a concrete reference point, Kroger’s publicly posted vendor insurance requirements specify high limits and detailed COI wording, including primary/noncontributory and waiver of subrogation language: https://www.thekrogerco.com/wp-content/uploads/2018/03/Insurance-Requirements.pdf

These retailer requirements often exceed what early-stage brands assume is “standard.” If your co-packer agreement doesn’t align, you can lose distribution mid-rollout.

Recall authority: decide now, not during a crisis

Why recall authority is the first clause to negotiate

When a potency drift, contaminant failure, mislabeling event, or packaging defect happens, every hour matters:

• Retailers demand a single decision-maker
• Insurers demand immediate notice and controlled spend
• Regulators expect prompt action and consistent messaging

FDA’s voluntary recall initiation guidance stresses recall readiness and timely communications (including using electronic communications to speed outreach): https://www.fda.gov/media/123664/download

Two viable models (pick one—don’t “share” without a tiebreaker)

Model A: Brand has final recall authority

Use when:

• The brand owns the label and retail relationship
• The brand controls marketing claims and multi-state label updates
• The brand is the “responsible party” in retailer contracts

Contract essentials:

• Co-packer must notify brand within a short window (e.g., 4–24 hours) after learning of a potential recall condition
• Brand decides recall class/level and strategy, after consulting co-packer’s QA
• Co-packer must execute operational steps: quarantine, trace, hold, retrieve, destroy

Model B: Co-packer has final recall authority

Use when:

• Co-packer is a sophisticated food manufacturer with established recall infrastructure
• Co-packer’s facility registration, FSMA program, and distribution systems dominate execution

Contract essentials:

• Brand receives immediate notice
• Brand controls public statements and retailer communications, but cannot block safety actions

Mandatory recall authority exists—and the contract must anticipate it

FDA has statutory mandatory recall authority under 21 U.S.C. § 350l in certain circumstances. The key point for contracting is that FDA’s authority focuses on the “responsible party,” and your agreement should define who that is for your product and distribution channels.

Reference text: https://www.law.cornell.edu/uscode/text/21/350l

Recall cost allocation: separate “cause” from “execution”

A robust clause splits costs into:

• Execution costs (logistics, retrieval, disposal, effectiveness checks)
• Root-cause costs (testing failures, mislabeling, process deviations)
• Downstream costs (retailer chargebacks, penalties, lost placement)

Then it assigns costs based on fault and controllable scope:

• Co-packer pays when the cause is manufacturing, sanitation, packaging/label application error, or process deviation
• Brand pays when the cause is formula instructions, label content approval, marketing claims, or brand-supplied inputs
• Split when both contributed

Also add a cap on non-safety commercial withdrawals unless fault is established, and preserve emergency authority for safety.

Batch retention, release criteria, and “hold-and-release” discipline

The contract must define what “release” means

Retailer audits increasingly ask for:

• Lot genealogy
• COAs and method references
• Stability/shelf-life support
• Evidence that the released lot met spec at time of shipment

Key buildouts:

• Hold-and-release: no shipment until defined documents are complete
• Release authority: name the role (brand QA vs co-packer QA) and define what happens when they disagree
• Conditional release: prohibit “ship now, COA later” unless a written exception is signed

Retention samples: set quantities, conditions, and duration

Unlike pharma, FDA food rules are not always prescriptive about retention samples. That’s precisely why your agreement should.

Recommended contract terms:

• Retain finished-product samples by lot (and critical inputs such as emulsions) under defined storage conditions
• Retain for at least shelf-life plus a buffer (commonly 12–24 months depending on product and retailer requirements)
• Include clear chain-of-custody rules and access rights in the event of complaints or investigations

Define potency drift tolerances and sampling plans

“mg-per-serving drift” is a commercial and consumer-trust issue, but it becomes a compliance issue when labeling no longer matches reality.

Your agreement should include:

• Target potency, acceptable variance bands, and what method/lab must be used
• Composite sampling vs unit sampling rules
• Re-test triggers (e.g., out-of-trend stability results)
• A defined escalation path: investigation → CAPA → disposition

Map FSMA Preventive Controls responsibilities like a RACI chart (in prose)

A co-packer contract should read like a quality agreement, even if it isn’t called one.

Food Safety Plan ownership and PCQI accountability

Under 21 CFR 117.126, a facility must prepare (or have prepared) and implement a written food safety plan overseen by a Preventive Controls Qualified Individual (PCQI). Reference: https://www.law.cornell.edu/cfr/text/21/117.126

Contract drafting goals:

• Identify the party whose PCQI owns/oversees the plan for the facility
• Confirm brand’s right to review relevant plan sections affecting its product
• Require notice and approval for material plan changes that impact product risk profile

Corrective actions, corrections, and CAPA timelines

FSMA requires corrective actions and corrections when preventive controls aren’t properly implemented, including documentation under 21 CFR 117.150: https://www.law.cornell.edu/cfr/text/21/117.150

And reanalysis of the food safety plan at least every three years (or sooner when required) under 21 CFR 117.170: https://www.law.cornell.edu/cfr/text/21/117.170

Contract improvements:

• Define deviation reporting windows (e.g., same shift for critical deviations)
• Define investigation timelines (e.g., preliminary report within 5 business days, final within 30 days)
• Define CAPA effectiveness checks and closure requirements

Supply-chain program: clarify who approves suppliers

If the brand mandates a specific cannabinoid ingredient supplier, that can shift practical responsibility—but it doesn’t eliminate regulatory expectations.

Use FDA’s co-manufacturer supply-chain guidance as the organizing reference and bake it into the contract: https://www.fda.gov/regulatory-information/search-fda-guidance-documents/guidance-industry-supply-chain-program-requirements-and-co-manufacturer-supplier-approval-and

Unannounced audit rights and access to raw data (COA isn’t enough anymore)

Retailer-driven audits are becoming “FDA-like”

Many national chains now expect GFSI-benchmarked certifications (e.g., SQF, BRCGS, FSSC 22000) and may require unannounced audit capability. Even when the certification body controls formal unannounced audits, the brand contract can still require brand-initiated unannounced visits.

Drafting considerations:

• Permit unannounced audits for cause (complaints, out-of-spec results, regulatory inquiry)
• Permit scheduled audits for routine qualification
• Define safety, confidentiality, and photography rules

Access to COA raw data and lab documentation

Retailer QA teams increasingly ask for:

• Lab accreditation (often ISO/IEC 17025)
• Method identification
• Raw data or at least detailed chromatograms / calibration records (depending on test)

Your contract should require:

• Brand access to underlying test data sufficient to evaluate reliability
• Data retention obligations consistent with the lab’s standards (ISO/IEC 17025 requires controlled technical records and retention periods defined by the lab)

Also note that FDA’s LAAF program is being implemented in phases for certain imported-food testing circumstances (not beverage potency testing, but relevant when co-packers import higher-risk ingredients and need accredited lab results for specific analytes): https://www.fda.gov/food/food-safety-modernization-act-fsma/laboratory-accreditation-analyses-foods-laaf-program-final-rule

Insurance: align co-packer coverage with retailer demands (and recall reality)

The basic stack you should expect

At minimum, brands often require co-packers to carry:

• Commercial General Liability (CGL) including products/completed operations
• Product liability (if separate)
• Umbrella/excess
• Professional / E&O (for label review or formulation services, where applicable)
• Product recall / contamination coverage (separate policy)

Additional insured endorsements: don’t accept vague promises

Retailers frequently require the downstream seller (the brand) to be an additional insured under upstream vendor policies.

In contracting, require:

• Additional insured for ongoing and completed operations
• Primary and noncontributory
• Waiver of subrogation
• Notice of cancellation

Concrete example language expectations are shown in Kroger’s insurance requirements (including the primary/noncontributory wording): https://www.thekrogerco.com/wp-content/uploads/2018/03/Insurance-Requirements.pdf

Recall expense insurance: define minimum limits tied to channel requirements

A core gap exposed in 2025: brands assumed CGL would pay recall costs. In many cases, it won’t.

Contract best practices:

• Require recall expense coverage (often called product recall or product contamination insurance)
• Set minimum limits based on:
• retailer contracts (chargebacks and withdrawal fees)
• geographic footprint
• daily throughput and average on-hand inventory
• Define whether the policy covers:
• customer notification
• retrieval and disposal
• business interruption / extra expense
• third-party testing
• crisis management

Also require the co-packer to list the brand as a loss payee or otherwise ensure the brand can directly claim when the co-packer is at fault.

IP ownership: formulas, emulsions, improvements, and switching facilities

Treat formulas and emulsions as trade secrets—contractually

Most beverage recipes and emulsions are protected as trade secrets (not patents). Protection depends on maintaining secrecy and documenting “reasonable efforts.” USPTO’s trade secret toolkit is a helpful framing reference: https://www.uspto.gov/sites/default/files/documents/tradesecretsiptoolkit.pdf

Your co-packer contract should:

• Define Brand Background IP (existing formulas, trademarks, specs)
• Define Co-packer Background IP (equipment know-how, standard processes)
• Define Foreground IP (improvements developed during the relationship)

Improvements: decide who owns what—by category

This is where deals get messy. Common compromise positions:

• Brand owns improvements to the formula, product specs, sensory targets, and consumer-facing attributes
• Co-packer owns improvements to its general manufacturing processes that are not unique to the brand and do not disclose the brand’s confidential information
• Joint developments get a defined license structure

Key drafting tip: include an explicit rule for “improvements that are necessary to manufacture the product at any facility” versus “improvements that are specific to this co-packer’s line.”

Tech transfer: require a clean exit path

If you have to move facilities (capacity, quality incident, pricing), tech transfer becomes existential.

Contract clauses to include:

• Co-packer must maintain a technology transfer package (master batch record, critical process parameters, QC methods, packaging specs, sanitation procedures unique to the product)
• Co-packer must support a defined number of tech transfer hours at pre-negotiated rates
• A deadline for delivering documentation after termination (e.g., 10–30 days)

Also address what happens to specialized ingredients (emulsions, flavor systems) that the co-packer helped source.

Labeling and mislabeling: allocate risk for the highest-frequency recall cause

Undeclared allergens and labeling errors are a top driver of recalls across food and beverage. For THC beverages, the label complexity multiplies (serving size, potency statements, warnings, state-by-state icons, and restricted claims).

Draft a “label control” section like a preventive control

Even if your co-packer isn’t legally responsible for label content, it is often operationally responsible for label application and label inventory management.

Contract should include:

• Brand controls label content approval
• Co-packer controls label application, line clearance, reconciliation, and destruction of obsolete labels
• Dual sign-off for first production runs and label changeovers

Multi-state label change SLAs

If you sell across multiple states with different warning language and potency caps, you need a contract-driven SLA:

• timelines for artwork implementation
• timelines for exhausting old inventory
• “stop ship” triggers

Also consider FDA’s general labeling framework under 21 CFR Part 101 (food labeling): https://www.ecfr.gov/current/title-21/chapter-I/subchapter-B/part-101

Contaminants, sanitation, and environment: contract for the hazards you actually face

Environmental monitoring and Listeria control concepts

For ready-to-eat foods, FDA has detailed expectations around environmental control of Listeria in the processing environment. While beverages vary in risk profile, any facility running RTE operations should have a defensible sanitation and environmental monitoring posture.

FDA’s draft guidance on Listeria monocytogenes control in RTE foods is a strong reference point for expectations: https://www.fda.gov/regulatory-information/search-fda-guidance-documents/draft-guidance-industry-control-listeria-monocytogenes-ready-eat-foods

Acidified and shelf-stable processes: don’t ignore 21 CFR 114/113

If your beverage is shelf-stable and acidified, process authority work and scheduled process controls can be decisive for safety and recall prevention.

Regulatory references:

• Acidified foods: https://www.ecfr.gov/current/title-21/chapter-I/subchapter-B/part-114

Your contract should require:

• documented process authority determinations
• pH and critical factor records access
• defined deviation disposition rules

Choice of law and venue: match where you sell, not where the co-packer is

It’s common to default to the co-packer’s home state law, but for brands selling nationally through major retailers, dispute venue matters for speed and predictability.

Drafting goals:

• Align venue with your principal retail footprint or headquarters
• Add emergency injunctive relief for IP leaks and recall cooperation
• Don’t let limitation-of-liability clauses swallow recall and indemnity obligations

For context on commercial limits and consequential damages, see UCC 2-719: https://www.law.cornell.edu/ucc/2/2-719

A practical checklist: what your 2025–2026 co-packer agreement should contain

Use this as a contract-scoping guide for internal alignment between legal, QA, operations, and finance:

• Final recall authority and escalation triggers
• Recall plan integration aligned to FSMA recall plan expectations (21 CFR 117.139)
• Hold-and-release with defined release documentation
• Retention samples and data retention requirements
• Unannounced audit rights and access to COA raw data
• Deviation and CAPA timelines aligned to 21 CFR 117.150 and 117.170
• Indemnities for mislabeling, contaminants, allergen failures, and potency drift
• Insurance: additional insured, products/completed ops, primary/noncontributory, recall expense coverage with channel-tied limits
• IP ownership: formulas, emulsions, improvements, and tech transfer on exit
• Multi-state label change SLAs
• Choice of law/venue aligned to the business reality

Takeaways for brands, co-packers, and investors

• A “friendly” relationship is not a substitute for a recall-ready contract. Decide authority and communication rules now.
• Insurance is a sales enablement tool in 2025–2026, not just a risk transfer mechanism. Retailers publish requirements—mirror them in your co-packer agreement.
• IP and tech transfer clauses are your continuity plan. If you can’t switch facilities cleanly, you don’t truly own your product.
• FSMA concepts (PCQI oversight, corrective actions, recall plans, supply-chain controls) should be translated into contract obligations, timelines, and records access.

Next step: make your agreement “audit-ready” before your next retailer meeting

If you’re building or renegotiating a co-packer relationship for THC beverages, CannabisRegulations.ai can help you map cannabis compliance requirements, retailer QA expectations, and multi-jurisdiction rollout needs into a contract-ready checklist—so your dispensary rollout or mainstream retail expansion doesn’t get derailed by preventable documentation gaps.

Get practical compliance support at https://www.cannabisregulations.ai/ (informational support—no legal advice).