Cannabis Microbial Testing Limits: Health Canada Guide for QAPs

Can your QA team tell, from the COA alone, whether a lot is actually safe to release?

Canadian licensed producers must test every lot of cannabis against Health Canada microbial limits before release. Microbial failures are the most common reason a lot gets quarantined and the single biggest source of avoidable lost revenue in a well-run cultivation facility. This article lists the exact cannabis microbial testing limits by product format, names the root causes that drive most failures, and walks through what a QAP does when a lot fails: quarantine, investigation, retest, and notification.

If you are looking for the broader context on how to read a full certificate of analysis, our complete cannabis COA guide covers cannabinoids, heavy metals, pesticides, residual solvents, and the microbial section all in one reference.

What Health Canada Microbial Limits Apply to Cannabis Flower

Health Canada does not publish a single numeric table that is binding in the way the USP chapters bind the US pharmaceutical industry. Under the Cannabis Regulations (SOR/2018-144) and the Good Production Practices Guide for Cannabis, holders must establish and validate microbial limits appropriate to the intended route of administration, and must test every lot against those limits before release. In practice, Canadian LPs converge on the limits from the European Pharmacopoeia (Ph. Eur.) 2.6.12 and 5.1.4 for herbal drugs, which Health Canada inspectors accept as a defensible standard.

The table below summarises the limits most Canadian QAPs write into their specifications for inhaled dried flower. Units are CFU per gram unless noted.

These values map to Ph. Eur. 5.1.4 Category B (herbal medicinal products to which boiling water is not added before use). Some labs also report Aspergillus species (A. fumigatus, A. flavus, A. niger, A. terreus) separately. Health Canada has not mandated a specific Aspergillus limit at the federal level, but most export-facing Canadian LPs adopt the US state-level standard of absent in 1 g for those four species because EU GMP buyers increasingly require it.

How Limits Differ by Product Format

A lot of first-year QAPs get this wrong by applying flower limits to oils or edibles (or vice versa). The route of administration drives the limit, not the packaging. Inhaled products get the strictest herbal-drug limits because combustion is not a reliable kill step. Ingested products are allowed a higher TAC because stomach acid kills most vegetative bacteria, but pathogens (E. coli, Salmonella) remain at zero tolerance. Extracts and concentrates typically test below detection because the extraction process itself reduces bioburden.

These are the consensus limits in Canadian QA specifications. The binding values for any given LP live in that LP’s product specifications, approved as part of the licence. A mismatch between the internal spec and the lab’s reporting template is the fastest way to get a written inspection observation.

Why Microbial Tests Fail (Root Causes QAPs Should Know)

After a few hundred failure investigations across Canadian facilities, a pattern shows up. Nearly every TYMC failure is a drying or curing problem. Nearly every TAC failure is a handling or sanitation problem. Nearly every bile-tolerant gram-negative hit is a cross-contamination problem from a non-cannabis source. The failure mode tells you where to look before you even open the room logs.

Curing humidity over 65% RH

The single most common failure mode. Flower cured at 65% RH or above holds enough free water for Penicillium, Aspergillus, and Rhizopus to flourish. A lot that passes TYMC at packaging can fail at the shelf-life timepoint if moisture content drifts. Target 58 to 62% RH in the cure room, verify with a calibrated data logger (not the room HVAC display), and record humidity every 30 minutes for the full cure.

Trim room hygiene breakdown

Trimmers touching flower with ungloved hands or poorly sanitised scissors are a textbook TAC driver. The fix is boring: glove changes every 30 minutes, scissor sanitation every two hours with 70% isopropyl, smocks changed between shifts, and environmental swabs (TAC, TYMC, coliforms) on the trim table weekly. Most QAPs set a 50 CFU/surface alert limit for TAC on food-contact surfaces.

Cross-contamination from returned or requarantined stock

Returned product that is re-tested and re-released can be the source of a bile-tolerant gram-negative hit on fresh lots. Physical separation is the only reliable control. Returned stock goes to a dedicated quarantine room with its own air handling, and no cross-traffic with active production. Your COA review checklist should flag any lot sampled from mixed inventory for supplemental coliform testing.

Drying room airflow dead zones

Flower hung in a dead zone (bottom corners, behind HVAC returns) takes two to three days longer to dry. Those buds fail TYMC while the rest of the room passes. The fix is airflow mapping: a smoke-pencil walk once per quarter, vane anemometer readings at eight fixed points per room, and rotation of product between racks on day three.

Handling practices during packaging

Mylar bags opened in a room at ambient RH, then resealed without nitrogen flush, admit enough moisture and skin flora to push a borderline lot over TAC. Nitrogen flush, glove-and-sleeve discipline, and a packaging room held at 50% RH eliminate the variable.

What to Do When a Lot Fails Microbial Testing

Speed matters. A failing lot in an unlocked bin is a Health Canada observation waiting to happen. The workflow below is the one most well-run Canadian LPs use. It reads procedural because it has to be: a QAP who cannot reconstruct the failure response from records will not pass an inspection.

1. Physical quarantine within 24 hours. Move the lot to a locked, signed quarantine area. Apply red QUARANTINE tags on every container. Log the movement with two-person verification.
2. System quarantine the same day. In your seed-to-sale system, change the lot status to Quarantined. If your system uses positional inventory, also change the location to the quarantine room so the lot cannot be selected by packaging, shipping, or sales modules.
3. Preserve the retain sample. Lock the retain sample from the affected lot. Do not dip into it for the retest. The retain is your evidence that the lot’s actual state at release matched the failing COA.
4. Root cause investigation within 5 business days. A formal deviation report with 5-Whys or fishbone analysis, signed by the QAP. Check the cure room humidity log, the trim room environmental monitoring trend, and the personnel roster for the handling shift. Pull the COAs for the three previous lots from the same harvest batch to see if the failure is isolated or trending.
5. Decide: retest, rework, or destroy. Ph. Eur. allows for retest if the original failure can be attributed to a documented analytical error. Most Canadian QAPs do not retest to change a decision: they retest to confirm the failure. Rework (irradiation) is allowed but must be validated for the specific failing organism group. Destruction is the simplest path and the one a cautious QAP defaults to.
6. Notify Health Canada if required. Under Section 242 of the Cannabis Regulations, a mandatory recall obligation kicks in if failing product has already been distributed. A pre-release failure that stays in quarantine does not trigger a notification, but it must be logged and available on inspection. If any unit of the failing lot has left the facility, initiate recall procedures immediately.
7. CAPA and effectiveness check. Corrective and preventive actions are written against the root cause, not the symptom. A failing lot because of high cure RH does not get a CAPA of “retrain trimmers”. It gets a CAPA of “install new RH control on cure room 2, verify with three lots”. Effectiveness is confirmed when the next three lots from the same area pass.

Paperwork matters as much as the fix. On inspection, Health Canada reviews the deviation file, the investigation, the retest data, and the CAPA effectiveness record. A spotless COA library with a thin deviation file is a red flag: it implies failures are being hidden.

Using Microbial COA Data as an Early Warning

Most QAPs treat the COA as a pass-fail gate. The better approach is to treat it as a sensor for the production environment. TYMC counts trending upward over 90 days, even if each lot still passes, tell you the cure room is drifting. TAC numbers that spike every Thursday correlate with the trimmer rotation that works Wednesdays.

Build three charts into the monthly quality review:

• TAC and TYMC by lot, rolling 12 months, per cultivar. Expect genetic variance, expect the cultivar baseline to stay flat. A rising slope is a hygiene drift.
• TYMC by cure room, monthly average. The room that climbs 0.5 log per quarter will fail within a year.
• Failure causes by category, rolling 12 months. If 70% of failures are TYMC, the facility has a moisture problem. If 70% are TAC, it is a handling problem.

A mature quality system links the COA line item to the seed-to-sale record, the cure room data logger, the trimmer shift log, and the sanitation checklist. A QAP who can pivot across those four tables from one dashboard catches drift months before an inspector does. The GrowerIQ cannabis potency testing playbook applies the same instrumentation logic to cannabinoid variance.

How Do Irradiation and Other Post-Harvest Treatments Change the Limits?

Gamma irradiation at 10 kGy and electron beam treatment at similar doses both bring TYMC and TAC down by three to five orders of magnitude, which is why irradiated flower ships with tighter spec limits. Health Canada accepts irradiation as a validated kill step provided the dose is mapped, dosimetry is documented, and terpene loss is characterised (typically 5 to 12% loss of volatile monoterpenes). Ozone treatment, HPP, and cold plasma show partial efficacy but are not broadly adopted in Canada because validation files are thinner. If a facility routinely irradiates, the specification must be the post-irradiation limit, not the pre-treatment limit, and the COA must identify the treatment. For broader compliance context, see our resources on ISO 17025 cannabis lab accreditation and cannabis heavy metals testing limits.

Frequently Asked Questions

What is the Health Canada TYMC limit for cannabis flower?

For non-irradiated inhaled dried flower, the consensus TYMC limit in Canadian QA specifications is 10,000 CFU/g, aligned with Ph. Eur. 5.1.4 Category B for herbal medicinal products not prepared with boiling water. For irradiated flower the limit tightens to 100 CFU/g. Health Canada does not publish a single federal numeric ceiling: each LP sets the limit in its product specifications, and the inspector verifies that every lot COA passes against that specification.

Does irradiated cannabis have different microbial limits?

Yes. Irradiation is a validated kill step, so Canadian LPs routinely tighten the TYMC spec for irradiated flower to 100 CFU/g and the TAC spec to 10,000 CFU/g. The COA must identify the treatment and the lab must test post-irradiation. Selling irradiated flower against a non-irradiated specification, or vice versa, is a labelling and quality system failure that Health Canada will flag on inspection.

What happens when a cannabis lot fails microbial testing?

The lot is physically quarantined in a locked area and system-quarantined in the seed-to-sale platform within 24 hours. The QAP opens a deviation report and conducts a root cause investigation, typically within 5 business days. Options are retest (to confirm the failure), rework via irradiation (if validated), or destruction. If any unit of the failing lot has already shipped, mandatory recall obligations under Section 242 of the Cannabis Regulations apply.

Can a cannabis producer retest and release after a microbial failure?

Only under narrow conditions. A retest is justified if the original failure can be traced to a documented analytical error at the lab (chain-of-custody break, contaminated media, equipment fault). A retest is not justified simply because the producer wants a second chance. Most Canadian QAPs retest to confirm the failure, not to overturn it, and proceed to rework or destruction based on the second result and the root cause investigation.