The Cannabis Lab Crisis: Three States, Three Failed Labs, 19,000 Samples Pulled From Shelves

On March 19, 2026, the Oklahoma Medical Marijuana Authority issued a mandatory recall covering every cannabis product the lab Greenleaf Labs LLC tested between April 2023 and July 2025. Approximately 19,000 samples are in scope. The regulator's complaint: Greenleaf inaccurately calculated yeast and mold content for two years, and despite an August 2025 cease-and-desist order, failed to notify its customers that previously-passed product had failed retesting.

Three weeks earlier, on February 26, the New York Office of Cannabis Management issued its own recall: 55 product lots tested by Keystone State Testing New York, across 13 licensees, covering flower, pre-rolls, concentrates, edibles, and beverages. Fifty-four of the lots had incorrectly reported Aspergillus results. One had an incorrectly reported cadmium reading. Inspections conducted between December 2025 and January 2026 turned up the lab's errors.

On May 1, Maine's Office of Cannabis Policy issued a medical-cannabis patient advisory for two strains cultivated and sold by Northwoods Caregiver LLC in Piscataquis County. Blackberry Mint contained more than 18 times the state's safe mold threshold. Banana Punch contained nearly three times the acceptable level of piperonyl butoxide, a pesticide synergist. The advisory was triggered by a patient who suffered an adverse health reaction after smoking the product. (S1, S2, S5)

Three states. Three failed quality-assurance pipelines. Three different failure modes. And — across all three — operators paying for laboratory failures that were not theirs.

The Oklahoma case is the most consequential by volume. Greenleaf Labs is one of OMMA's accredited testing labs; for more than two years, its potency-and-contaminant testing protocols miscalculated yeast and mold. OMMA inspectors caught the issue in routine sampling and issued a cease-and-desist in August 2025. The lab agreed to voluntary retesting and customer notification. By March 2026, inspectors had found test-failed product still on dispensary shelves — meaning the voluntary-notification step had broken down. OMMA's response: skip voluntary and issue a mandatory recall.

The mandatory recall puts the operational burden squarely on the operators who bought Greenleaf's services. They must audit inventories, remove all test-failed product from shelves, dispose of it under OMMA rules, notify their downstream patients, and absorb the disposal costs themselves. Non-compliance, OMMA's order states, risks license revocation, suspension, and monetary penalties. The cost calculus is straightforward: any dispensary with an inventory mix that includes Greenleaf-tested product is now in defensive cleanup mode, and the cost of that cleanup is not recoverable from Greenleaf.

OMMA's recall language was direct: "Mold and yeast levels exceeding compliance thresholds may lead to adverse reactions." The 19,000-sample number does not translate to 19,000 affected SKUs at retail. Many samples cover the same product batch tested at different points in the supply chain. But the cleanup obligation cascades through every operator that processed, packaged, or sold any product Greenleaf had touched — and Greenleaf was a meaningful share of Oklahoma's licensed testing volume.

New York's situation is structurally similar but tighter in scope. Stephen Geskey, OCM's Executive Deputy Director for Licensing, Compliance and Laboratories, framed the agency's enforcement in a public statement: "When test results are inaccurate or unclear, product safety cannot be guaranteed." The OCM recall covers 13 licensees — Basin Mixtures Inc, Capital Region Co, Veterans Holdings Inc, High End Processing, Nanticoke Hemp Inc, Northeast Extracts LLC, Route 27 Hopyard, 1Off Manufacturing, Hudson Valley Jane, and others — across multiple product categories. The Aspergillus contamination matters because Aspergillus is a respiratory pathogen; smoking or vaporizing contaminated cannabis can drive serious infections in immunocompromised patients. The cadmium recall is similar — heavy-metal accumulation has chronic implications even at sub-acute exposure levels. (S2, S3)

By March 27, three lots in New York's recall had been re-tested by a permitted laboratory, came back clean, and were removed from the recall list. The other 52 stayed. No adverse health effects had been reported by the time the recall was issued — a near-miss, in regulator language, that the rapid agency response was designed to convert into a no-miss.

Maine's case is smaller in volume but illustrates a different failure mode. Northwoods Caregiver LLC, run by William Fortin, sold two strains at a single Piscataquis County operation. The contamination was caught by a patient who smoked the product, had an adverse reaction, and complained to the state. Maine's Office of Cannabis Policy followed up with testing that revealed mold at 18 times the recreational program's safe threshold and pesticide at nearly three times the permitted level. Fortin pulled the product from his shelves voluntarily after the advisory issued. (S4)

Maine's medical cannabis program has a structural quirk that matters here: medical cannabis in Maine is not subject to the same mandatory pre-sale lab testing that the state's recreational program requires. Operators self-attest to compliance, and lab testing on the medical side is voluntary or done on complaint. The Northwoods case did not surface through routine testing because there is no routine testing on the medical side. It surfaced through a patient's symptoms.

For operators, the three cases line up around a single question: who absorbs the cost when a third-party lab fails?

The legal answer, currently, is: the operator. Cannabis lab agreements typically include hold-harmless provisions that protect the lab from downstream liability if the operator's product fails post-test inspection. Some lab agreements include indemnification for lab error, but those clauses are inconsistent and rarely tested in court. In Oklahoma, OMMA's mandatory recall language makes the burden explicit: "Operators bear all waste disposal costs." In New York, the cost falls in the same place. Operators carry the recall load while the lab — in both Oklahoma and New York — faces only the regulatory consequence of losing its operating license.

The financial impact varies by operator size. For a small single-state operator that bought heavily from Greenleaf, the disposal and replacement-testing cost can run into the hundreds of thousands of dollars. For a multistate operator with diversified lab relationships, the dollar exposure is contained but the reputational drag — patients seeing their dispensary's name on a state recall list — is harder to model.

Insurance coverage is uneven. General-liability policies for cannabis operators often exclude product recall by exclusion clause, and dedicated product-recall insurance is expensive and limit-capped. The handful of operators that pre-purchased lab-failure coverage in 2024 and 2025 are now collecting; the rest are eating it.

The broader regulatory direction is harder enforcement. Every mature cannabis market has, since 2025, tightened its laboratory oversight. ISO 17025 accreditation — the international standard for laboratory competence and impartiality — is now a mandatory prerequisite for cannabis testing labs in a growing number of states. California and Colorado have implemented new sample-tracking requirements designed to make lab-shopping — the practice of sending the same sample to multiple labs and reporting only the most favorable result — harder to hide. Florida has authorized its regulator to issue immediate stop-sale orders against Medical Cannabis Treatment Centers when post-shelf testing diverges from a product's certificate of analysis. (S6)

Lab shopping is the operator-side mirror of lab error. Labs miscalibrating their assays, and operators choosing favorable labs to mask weak product, are two halves of the same data-integrity problem. Regulators have stopped treating them as separate. The Oklahoma cease-and-desist on Greenleaf, the New York revocation of Keystone State Testing's permit, and the Maine advisory all reflect a market that has decided to enforce the chain of evidence rather than rely on operator self-attestation.

For investors, the lab-quality crisis is a vendor-concentration risk that has been underweighted in cannabis financial models. Operators with concentrated testing exposure to a single lab carry meaningful tail risk that does not show up in quarterly disclosures. The capital markets have not, historically, required cannabis issuers to disclose which labs they use. That disclosure pattern is likely to change in the next twelve months as the recall lists in New York and Oklahoma accumulate documentary evidence of which operators bought from which labs.

Industry voices have been measured, with the loudest commentary coming from regulators rather than operators.

New York OCM's Stephen Geskey, in announcing the Keystone State Testing recall, framed the agency's posture as patient-protective: "When test results are inaccurate or unclear, product safety cannot be guaranteed." Dr. June Chin, OCM's Chief Medical Officer, signed the public-facing advisory and emphasized the absence of adverse reports — the rapid recall, in her framing, was designed to keep that absence intact.

Oklahoma's OMMA, in its mandatory recall order, did not single out the lab by name beyond Greenleaf Labs LLC. The order's operational language placed the burden squarely on operators and instructed them to bear all waste disposal costs, notify impacted businesses and patients, and audit inventories within a tight compliance window.

Operator-side commentary has been quieter. The licensees named in the New York recall have largely declined to comment publicly, with most directing customers to OCM's product-lookup page and accepting returns of recalled product even when opened. The Oklahoma operators with significant Greenleaf exposure are working through their disposal obligations on the regulator's clock.

Lab-quality consultants have begun pitching audit services more aggressively. ISO 17025 conformity audits, which run roughly $15,000 to $40,000 per lab depending on scope, are becoming a normal pre-purchasing diligence step for sophisticated operators evaluating their testing partners. That diligence step did not exist as standard practice in the cannabis industry as recently as 2024.

Three concrete dates and one open question.

Through June 2026 — operators in Oklahoma must complete their inventory audits and disposals under OMMA's mandatory recall. Expect monthly inspection reports from OMMA on which operators are in compliance. Operators that miss the window face license-status review.

Mid-2026 — New York OCM expected to issue updated lab-licensing standards in the wake of the Keystone State Testing failure. The agency has signaled that the standards will include stricter sample-chain-of-custody requirements and may move toward mandatory ISO 17025 for all permitted labs. Operators should expect that the cost of compliant testing rises as the supply of qualified labs contracts.

Year-end 2026 — the first wave of cannabis-operator insurance renewals fully reflecting the 2026 recall cycle. Premium increases for product-recall coverage are widely anticipated, and exclusions for lab-error events may become standard. Operators that have not priced this into 2027 plans should.

The open question is whether any of the three failed labs faces criminal exposure. The Oklahoma case has the cleanest fact pattern for a criminal investigation: a two-year window of inaccurate testing, a cease-and-desist order that the lab failed to comply with, and continued shipment of contaminated product. State prosecutors have not announced an investigation as of this writing, but the regulatory record is now substantial enough that one would not be surprising. Across the three states, the industry's question is the same: what level of consequence does a failed lab actually face, beyond the loss of its operating license?