Almost every Colombian cannabis producer says it is “GACP” or “EU-GMP”. Very few buyers take that at face value. This guide explains what the two standards are, how they fit together, and what evidence actually satisfies a European pharmaceutical customer.
The short version
- GACP (Good Agricultural and Collection Practice) covers growing and harvesting the plant.
- EU-GMP (Good Manufacturing Practice) covers processing, packaging, testing and release of the finished pharmaceutical material.
- For dried flower, the line between them usually falls after harvest. Drying, trimming, packaging and release are typically expected under GMP.
- A grower can work to GACP on its own. An EU-GMP certificate belongs to a specific site that has been inspected by an EU or EEA authority.
GACP: what it covers
In Europe, the reference is the European Medicines Agency’s Guideline on Good Agricultural and Collection Practice for starting materials of herbal origin. The World Health Organization publishes similar GACP guidelines. Neither is a law that issues certificates. They describe the practices a pharmaceutical manufacturer expects from its plant suppliers.
In practice, GACP means being able to show:
- Genetics and propagation: identified, consistent cultivars with traceable origin.
- Site and environment: documented soil, water and environmental risks, and controls for contamination.
- Inputs: records of every fertiliser and plant-protection product used, when, and in what quantity.
- Personnel and hygiene: trained staff, hygiene rules and records that prove they are followed.
- Harvest: defined harvest criteria, batch identification and handling that prevents mix-ups.
- Documentation: a batch record that lets anyone trace a lot of flower back to the plants and inputs that produced it.
GACP certificates are usually issued by private certification bodies after an audit, or confirmed by the GMP manufacturer’s own supplier audit. In Colombia, the agricultural institute ICA also runs a Good Agricultural Practice (BPA) scheme. BPA is related to GACP but is not the same thing, so buyers will want to see how one maps to the other.
EU-GMP: what it covers
EU Good Manufacturing Practice is set out in EudraLex Volume 4, with specific guidance for herbal medicinal products. GMP is about controlling the processes that turn harvested plant material into a pharmaceutical product of consistent, documented quality: premises, equipment, validated processes, quality control testing, deviation handling and release.
Two points catch many producers out:
- EU-GMP certificates are issued by authorities, not consultants. A site outside the EU gets one only after an inspection by an EU or EEA competent authority. Certificates are recorded in the EU’s EudraGMDP database.
- The certificate belongs to a site, not a brand. A grower may supply an EU-GMP-certified processor without holding a certificate itself. That can be a perfectly good model, but it should be described accurately.
Product then has to meet pharmaceutical quality specifications, for example pharmacopoeial standards for cannabis flower in the destination market, and be certified for release by a Qualified Person in the EU before it reaches patients.
Where GACP ends and GMP begins
| Stage | Typical standard | Evidence a buyer expects |
|---|---|---|
| Propagation and cultivation | GACP | Cultivar records, input logs, SOPs, training records, GACP audit or certificate |
| Harvest | GACP | Harvest criteria, batch numbering, harvest records |
| Drying, curing, trimming | Usually GMP (confirm with the importing authority) | Validated drying process, environmental monitoring, GMP certificate for the site |
| Packaging and labelling | GMP | Packaging records, labelling controls, line clearance |
| Testing and release | GMP | Certificates of analysis, stability data, Qualified Person release |
Where exactly GMP starts can depend on the product, the process and the importing country’s authority. Always confirm with the GMP manufacturer and its regulator.
The evidence checklist
When a European importer or GMP processor evaluates a Colombian supplier, these are the documents it is likely to ask for:
- Current Ministry of Justice cultivation licence and evidence of allocated quota
- ICA registration of the cultivars used
- GACP certificate or audit report, with the certifying body and date
- For any processing site: the EU-GMP certificate number, verifiable in EudraGMDP
- Standard operating procedures and recent batch records
- Certificates of analysis from an accredited laboratory (cannabinoids, microbiology, heavy metals, pesticides, mycotoxins)
- Corporate documents: company registration (RUES), ownership and legal representative
- References from previous regulated customers, where they exist
Red flags
- “EU-GMP certified” with no certificate number, issuing authority or site address.
- GACP claims with no audit report or certifying body.
- Certificates belonging to a different company, with no written supply agreement.
- Licences that don’t appear on the current Ministry of Justice register.
- Reluctance to allow a site visit.
How Cordavira uses this
When we assess an operator, we record each claim separately from the evidence behind it and verify certificates with the body that issued them. That discipline protects everyone, including the grower, whose credibility is its most valuable asset.
This guide is general information, not legal or regulatory advice. Requirements change and vary by country. Confirm current requirements with the relevant authority and qualified advisers. Last reviewed 6 November 2026.
Sources
- European Medicines Agency, Guideline on Good Agricultural and Collection Practice (GACP) for starting materials of herbal origin (EMEA/HMPC/246816/2005).
- World Health Organization, WHO guidelines on good agricultural and collection practices (GACP) for medicinal plants (2003).
- European Commission, EudraLex Volume 4: Good Manufacturing Practice guidelines.
- EudraGMDP database (European Medicines Agency).