The Cannabis Lab Crisis: Three States, Two Failed Labs, 19,000 Samples Pulled From Shelves

On March 19, 2026, the Oklahoma Medical Marijuana Authority issued a mandatory recall covering every cannabis product the lab Greenleaf Labs LLC tested between April 2023 and July 2025. Approximately 19,000 samples are in scope. The regulator's complaint: Greenleaf inaccurately calculated yeast and mold content for two years, and despite an August 2025 cease-and-desist order, failed to notify its customers that previously-passed product had failed retesting.

Three weeks earlier, on February 26, the New York Office of Cannabis Management issued its own recall: 55 product lots tested by Keystone State Testing New York, across more than a dozen licensees, covering flower, pre-rolls, concentrates, edibles, and beverages. Fifty-four of the lots had incorrectly reported Aspergillus results. One had an incorrectly reported cadmium reading.

On May 1, Maine's Office of Cannabis Policy issued a medical-cannabis patient advisory for two strains cultivated and sold by Northwoods Caregiver LLC in Piscataquis County. Blackberry Mint contained more than 18 times the state's safe mold threshold. Banana Punch contained nearly three times the acceptable level of piperonyl butoxide, a pesticide synergist.

Three states. Three failed quality-assurance pipelines. Three different failure modes. And — across all three — operators paying for laboratory failures that were not theirs.

The Oklahoma case is the most consequential by volume. Greenleaf Labs is one of OMMA's accredited testing labs; for more than two years, its potency-and-contaminant testing protocols miscalculated yeast and mold. OMMA inspectors caught the issue in routine sampling and issued a cease-and-desist in August 2025. The lab agreed to voluntary retesting and customer notification. By March 2026, inspectors had found test-failed product still on dispensary shelves — meaning the voluntary-notification step had broken down. OMMA's response: skip voluntary and issue a mandatory recall.

The mandatory recall puts the operational burden squarely on the operators who bought Greenleaf's services. They must audit inventories, remove all test-failed product from shelves, dispose of it under OMMA rules, notify their downstream patients, and absorb the disposal costs themselves. Non-compliance, OMMA's order states, risks license revocation, suspension, and monetary penalties.

New York's situation is structurally similar but tighter in scope. The OCM recall covers more than a dozen licensees — Basin Mixtures Inc, Capital Region Co, Veterans Holdings Inc, High End Processing, Nanticoke Hemp Inc, Northeast Extracts LLC, Route 27 Hopyard, 1Off Manufacturing, Hudson Valley Jane, and others — across multiple product categories. The Aspergillus contamination matters because Aspergillus is a respiratory pathogen; smoking or vaporizing contaminated cannabis can drive serious infections in immunocompromised patients.

Maine's case illustrates a different failure mode. Northwoods Caregiver LLC, run by William Fortin, sold two strains at a single Piscataquis County operation. The contamination was caught by a patient who smoked the product, had an adverse reaction, and complained to the state. Maine's medical cannabis program does not require the same mandatory pre-sale lab testing the state's recreational program requires. The Northwoods case did not surface through routine testing because there is no routine testing on the medical side. It surfaced through a patient's symptoms.

For operators, the three cases line up around a single question: who absorbs the cost when a third-party lab fails?

The legal answer, currently, is: the operator. Cannabis lab agreements typically include hold-harmless provisions that protect the lab from downstream liability if the operator's product fails post-test inspection. Some lab agreements include indemnification for lab error, but those clauses are inconsistent and rarely tested in court. In Oklahoma, OMMA's mandatory recall language makes the burden explicit: operators bear all waste disposal costs.

The broader regulatory direction is harder enforcement. Every mature cannabis market has, since 2025, tightened its laboratory oversight. ISO 17025 accreditation — the international standard for laboratory competence and impartiality — is now a mandatory prerequisite for cannabis testing labs in a growing number of states. California and Colorado have implemented new sample-tracking requirements designed to make lab-shopping harder to hide.

New York OCM's Stephen Geskey, Executive Deputy Director for Licensing, Compliance and Laboratories, framed the agency's enforcement in a public statement.

“When test results are inaccurate or unclear, product safety cannot be guaranteed.”

— Stephen Geskey, Executive Deputy Director, NY OCM

Operator-side commentary has been quieter. The licensees named in the New York recall have largely declined to comment publicly, with most directing customers to OCM's product-lookup page and accepting returns of recalled product even when opened. The Oklahoma operators with significant Greenleaf exposure are working through their disposal obligations on the regulator's clock.

1. Through June 2026 — Oklahoma operators must complete inventory audits and disposals under OMMA's mandatory recall. Operators that miss the window face license-status review.
2. Mid-2026 — New York OCM expected to issue updated lab-licensing standards in the wake of the Keystone State Testing failure. Likely mandatory ISO 17025 for all permitted labs.
3. Year-end 2026 — first wave of cannabis-operator insurance renewals fully reflecting the 2026 recall cycle. Premium increases for product-recall coverage are widely anticipated.
4. Criminal exposure for the failed labs — the Oklahoma case has the cleanest fact pattern for prosecution: a two-year window of inaccurate testing, a cease-and-desist order the lab failed to comply with, continued shipment of contaminated product.

The industry's question across all three states is the same: what level of consequence does a failed lab actually face, beyond the loss of its operating license?