In 2025, U.S. food brands using hemp seed, hemp seed oil, or hemp protein increasingly ran into a compliance reality that looks simple on paper but messy in practice:

• Food ingredients must comply with EPA pesticide tolerances (or a tolerance exemption) under the Federal Food, Drug, and Cosmetic Act (FFDCA).
• Many state programs publish crop-specific “allowed/prohibited pesticide” lists built for state-regulated cannabinoid supply chains, not conventional food plants.
• FSMA Preventive Controls for Human Food (21 CFR Part 117) puts the burden on the receiving facility to run a documented, risk-based supplier approval and verification program when hazards are controlled before receipt.

When recalls and enforcement actions cite pesticide residues, the root cause is often not “no testing,” but misaligned specifications (what the buyer thought they were buying vs. what the supplier tested), method inconsistency across laboratories, and weak supplier verification (no periodic validation that the control system still works).

This article is informational only—not legal advice. It focuses on the U.S. market and the practical compliance intersection between EPA tolerances, state pesticide lists, and FSMA Part 117 supply-chain controls.

EPA tolerances are the legal backbone for food-grade hemp ingredients

For food-grade hemp ingredients, the key question is not whether a pesticide appears on a state list—it’s whether there is an applicable EPA tolerance (maximum legal residue limit) or tolerance exemption for the residue in food.

What “tolerance” means in practice

Under EPA’s tolerance framework (codified in 40 CFR Part 180), a pesticide residue in or on a food is generally unlawful unless:

• A tolerance exists for that pesticide on that commodity (or a relevant commodity group), or
• There is an exemption from the requirement of a tolerance for that pesticide residue.

Start your federal legal limit analysis at the official tolerance regulations:

• 40 CFR Part 180 (tolerances and exemptions)

Hemp-specific tolerance history (why buyers still get surprised)

EPA has emphasized that tolerances must be supported by data and risk assessment. Notably, EPA highlighted the first hemp-specific tolerance (ethalfluralin on hemp seed) as a milestone, illustrating how new and evolving the tolerance landscape is for hemp compared to major commodity crops:

• EPA: Establishes first pesticide tolerance for hemp

The compliance takeaway: even if a pesticide is commonly used in agriculture, it may be noncompliant for hemp intended for human food unless the tolerance/tolerance exemption path is clear.

Why state “cannabis-only pesticide lists” don’t map cleanly to food plants

State-regulated cannabinoid programs often manage pesticide risk using lists (allowed/prohibited) plus action limits that may be:

• Different from EPA tolerances
• Based on different exposure assumptions (e.g., inhalation vs ingestion)
• Paired with state-specific lab methods and reporting rules

For example, Oregon publishes a “Guide List for Pesticides and Cannabis,” updated regularly:

• Oregon ODA: Guide List for Pesticides and Cannabis (PDF)

Kentucky’s hemp pesticide guidance underscores a key concept that matters for food-grade uses: pesticides must be used per label, and products intended for human consumption need label support for food crops (and, where applicable, state mechanisms like SLNs):

• Kentucky Department of Agriculture: Pesticides and Hemp (PDF)

The core mismatch

If your hemp ingredient flows into a conventional food facility, your compliance reference point should be:

• FIFRA labeling (was the pesticide legally used as labeled?)
• EPA tolerances/exemptions for residues in food
• FSMA hazard analysis and supply-chain controls

State lists can still be useful—but treat them as supplemental risk intelligence, not the legal ceiling for a food ingredient.

FSMA Part 117: where “food-grade hemp” wins or loses

If you’re a manufacturer receiving hemp ingredients, FSMA requires a written food safety plan when applicable, including hazard analysis and preventive controls. When a hazard is controlled before receipt, you need a supply-chain program.

The regulatory home base:

• 21 CFR Part 117 Subpart G (Supply-Chain Program)

FDA has also published guidance on how supply-chain programs work, including co-manufacturer scenarios:

• FDA Guidance: Supply-Chain Program Requirements and Co-Manufacturer Supplier Approval and Verification (PDF)

A 2025 reality check: COAs aren’t controls by themselves

In 2025, multiple enforcement headlines in regulated markets reminded the broader industry that pesticide contamination events can be missed when testing is inconsistent or strategically timed.

In food supply chains, the analogous failure mode is: COA says “Pass” → buyer stops verifying → contamination drifts upward due to changes in grower practices, new fields, new pest pressure, or a new lab method.

FSMA’s supply-chain program is designed to prevent exactly that drift.

FSMA Part 117 supply-chain program blueprint (pesticide residues + mycotoxins)

Below is a practical blueprint you can adapt for hemp seed, hemp protein, and hemp seed oil used in conventional foods.

Step 1: Ingredient hazard analysis (build it like an auditor will read it)

For each hemp-derived ingredient, document:

• Intended use (ready-to-eat vs further processed)
• Supplier and origin (domestic/import; farm/processor)
• Process controls at your facility (do you have any kill step? filtration? refining?)
• Known/foreseeable hazards requiring a control

Typical hazards to evaluate:

• Chemical: pesticide residues, process solvents (if applicable), heavy metals (depending on source), allergen cross-contact (if processed in shared plants)
• Biological: Salmonella (especially for seeds/proteins handled as low-moisture ingredients), environmental pathogens depending on process
• Physical: stones, metal, glass
• Naturally occurring toxins: mycotoxins such as aflatoxins (especially where storage conditions allow mold)

Your hazard analysis conclusion should clearly state whether pesticide residues and mycotoxins are hazards requiring a supply-chain-applied control.

Step 2: Decide whether the control is supply-chain-applied

If you do not have a validated internal step that reliably reduces pesticide residues to compliant levels (most food plants don’t), then pesticide residues are typically controlled only by:

• Legal pesticide use at the farm level
• Post-harvest segregation and handling
• Supplier testing and release
• Buyer verification

That means the control is commonly supply-chain-applied.

Step 3: Supplier approval (documented criteria)

Create written approval criteria and apply them consistently:

• Regulatory eligibility: supplier is permitted to produce and sell the ingredient for intended food use
• GAP/GMP maturity: documented agricultural practices, sanitation, storage controls
• Pesticide management: spray records; integrated pest management; restricted materials controls
• Traceability: lot definition, field-to-lot linkage, ability to execute a mock recall
• Testing controls: lab accreditation scope, method SOPs, QC, PT participation

FSMA requires you to approve suppliers when you rely on them to control hazards.

Step 4: Set COA specifications that align to EPA tolerances (not just state lists)

This is where many programs fail.

Build COA specs around:

1. Residue limits

• Use EPA tolerance/tolerance-exemption logic for the relevant commodity and ingredient form.
• Where tolerances are unclear for a specific pesticide/commodity pairing, treat it as a spec gap and resolve it through regulatory review and risk decision-making.

1. Analyte list

• Start with pesticides reasonably likely to be used on the crop (based on agronomy) plus high-risk “misuse” pesticides.
• Use state lists as a secondary input: if a pesticide is frequently flagged in state programs, add it as a verification analyte even if your primary compliance frame is EPA tolerances.

1. Mycotoxins

• Establish internal action limits and align to applicable FDA action levels/guidance where relevant. FDA’s mycotoxin approach is often communicated through compliance programs and action levels rather than universal limits across all foods.
• Make your expectation explicit: which aflatoxins, which units, which method.

1. Decision rules

• Define how results near LOQ are treated.
• Define rounding rules.
• Define what constitutes a “detect” vs “quantified.”

Step 5: Verification activities (FSMA Subpart G)

FSMA supplier verification tools commonly include:

• Onsite audit
• Sampling and testing
• Review of relevant food safety records (including COAs)

A practical approach for pesticide residues/mycotoxins:

• Every lot: receive a COA meeting your specs, from an approved lab, tied to the shipped lot
• Periodic verification testing: buyer-directed third-party testing at a defined frequency (e.g., quarterly per supplier per ingredient, then adjusted based on performance)
• Risk-based audits: annually or every 2 years depending on risk and history

FSMA also requires documented action when a supplier is not controlling hazards (see Subpart G requirements).

Step 6: Corrective actions and supplier controls when results fail

Write your decision tree before you need it:

• Immediate containment: quarantine on-site; notify distribution partners if released
• Stop-sale triggers (see retailer section below)
• Supplier notification with a defined response window
• Root cause analysis: pesticide application records, field mapping, drift events, storage conditions, lab method review
• Disposition: reject, rework (if possible), divert to non-food use (if lawful), or destroy
• Supplier status: increased testing frequency, conditional approval, or delisting

Under FSMA, if you determine through verification that the supplier is not controlling hazards, you must take prompt action and document it.

Treating state cannabis pesticide lists when hemp enters conventional food manufacturing

Here’s a defensible way to handle the mismatch without ignoring valuable state intelligence.

Use a “three-layer” specification model

1. Layer 1 (Legal): EPA tolerances/exemptions

• Your acceptance criteria should never allow residues that exceed EPA tolerances.

1. Layer 2 (Contractual): buyer policy limits

• You may choose tighter internal limits (e.g., “not detected” for certain high-hazard pesticides) based on brand risk, customer requirements, or retailer standards.

1. Layer 3 (Intelligence): state list monitoring

• Maintain a watchlist from state programs and enforcement trends and use it to update your analyte list and verification frequency.

Avoid a common pitfall: “state list compliant” ≠ “food compliant”

A COA formatted for a state-regulated cannabinoid market might:

• Test a limited panel that doesn’t reflect food-use pesticides
• Use different LOQs than food buyers expect
• Apply different action limits

For conventional food plants, rewrite requirements into your own supplier specification and COA template.

Lab method validation: getting consistent results across time and labs

In 2025, many supply chains learned that the same sample can yield different pesticide numbers depending on extraction approach, matrix effects, and calibration practices.

What to require from laboratories (minimum expectations)

Ask labs to document:

• Accreditation (e.g., ISO/IEC 17025 scope covering pesticide residues in similar matrices)
• Method performance: LOQ, LOD, recovery, precision, linearity, matrix-matched calibration
• Measurement uncertainty and reporting rules
• Proficiency testing participation for relevant analytes/matrices

Aligning on consensus methods: AOAC CASP as an anchor

AOAC INTERNATIONAL’s Cannabis Analytical Science Program (CASP) is a key forum advancing method standardization and proficiency testing infrastructure for hemp/cannabinoid matrices:

• AOAC: Cannabis Analytical Science Program (CASP)

Even if your end product is conventional food, CASP resources can help you evaluate whether your supplier’s lab methods are robust for hemp matrices.

Use NIST reference materials to reduce method drift

NIST has released hemp plant reference material with values for cannabinoids and toxic elements, intended to support laboratory quality systems and comparability:

• NIST: RM 8210 Hemp Plant reference material

While RM 8210 is not a pesticide reference material, it’s still valuable for demonstrating that a lab’s calibration/QC practices are mature for challenging hemp matrices. For pesticide residues, insist on matrix-appropriate QC (spikes, surrogates, internal standards) and, where possible, reference materials relevant to residues.

Retailer acceptance checklist (COA review, traceability, stop-sale triggers)

Retailers and downstream brand owners often become the “last line of defense” when a supplier’s controls are weak. Use this checklist to standardize receiving decisions for hemp-containing foods.

COA review checklist

• Lot match: COA lot number matches received lot number(s) and packaging codes
• Lab identity: lab name/address; accreditation status; method reference
• Sample representativeness: composite vs grab; sample size; date sampled
• Analyte list: includes your required pesticide panel and mycotoxins (if required)
• Units: consistent (e.g., mg/kg or ppb); avoid ambiguous “ppm” without context
• LOQs: fit-for-purpose (not so high that “ND” is meaningless)
• Pass/Fail logic: clearly indicates compliance with your limits (not just lab defaults)
• Any detects: reviewed and risk-triaged (especially restricted pesticides)

Lot traceability checklist

• One-step-forward/one-step-back records available within hours
• Supplier lot ↔ retailer lot mapping documented
• Receiving date, quantity, storage location recorded
• Ability to isolate remaining inventory by lot and location

Stop-sale triggers (write these into SOPs)

Initiate stop-sale / quarantine when any of the following occur:

• Missing COA or COA does not match the lot
• COA from a lab outside approved scope or with unclear methods
• Any pesticide residue reported above your acceptance limit (including EPA tolerance where applicable)
• Mycotoxin result above your internal action limit
• Customer complaint trend suggesting chemical taint or adverse reaction (treat as a signal requiring escalation)
• Regulator bulletin, public recall notice, or supplier notification tied to the same lot family

Key 2025 takeaways for hemp pesticide tolerances FSMA 2025 compliance

• EPA tolerances/exemptions are the legal floor for pesticide residues in food ingredients.
• State pesticide lists are useful intelligence but often do not translate into a food-grade acceptance specification.
• Under FSMA Part 117 Subpart G, if your hazard analysis relies on suppliers to control pesticide residues and mycotoxins, you need a documented supplier approval and verification program—not just COAs.
• Method consistency matters: require accreditation, transparent performance data, and ongoing proficiency testing; leverage consensus efforts like AOAC CASP and reference materials such as those from NIST to reduce variability.

Next steps

If your business is buying, processing, or selling hemp ingredients for human food, now is the time to tighten specs, harmonize COA requirements, and operationalize your FSMA supply-chain verification—before a failed lot forces a reactive stop-sale.

Use https://cannabisregulations.ai/ to track regulatory updates, build supplier verification workflows, and maintain auditable compliance documentation across your ingredient supply chain.