Is your Costa Rican operation ready to meet the Law 10,113 seed-to-sale traceability mandate before the February 2027 deadline?
What You’ll Learn
- The complete Law 10,113 licensing checklist by category (import or export, manufacture of derivatives and medicines, cultivation and production) with the MAG application requirements line by line.
- The 24-month seed-to-sale traceability rollout plan with the unique-plant-ID, batch-record, and chain-of-custody requirements operators must hit before February 2027.
- The MAG, Ministry of Health, and ICD multi-agency oversight map showing which authority owns which workflow (cultivation, product registration, diversion control) and what each inspects.
- The GACP and GMP requirement set that unlocked the first Costa Rica to EU pharmaceutical-grade export in March 2026, including QMS, SOPs, batch records, and CoA chain of custody.
- The RTCR 515:2024 product-standards reference: sanitary registration, labeling, dosage, advertising restrictions, and the licensed-pharmacy distribution channel with digital prescriptions.
- The priority-action matrix for Q2 through Q4 2026: gap analysis, platform selection, GACP certification, QA/QC lab partnerships, and staff training before the traceability deadline.
Costa Rica’s Law 10,113 has moved from statute to active compliance regime: the implementing regulations were approved in February 2025, RTCR 515:2024 product standards have been in force since June 2025, and the seed-to-sale traceability mandate lands in roughly February 2027. This guide is built for Costa Rican licensees, LATAM operators evaluating Costa Rica as their next market, and cross-border compliance leads who need a single reference for MAG licensing, Ministry of Health product registration, and ICD inspection readiness.
What Is Law 10,113 and Why Does It Matter in 2026?
Law 10,113, formally the “Law on Cannabis for Medicinal and Therapeutic Use and Hemp for Food and Industrial Use,” was enacted in March 2022. For nearly three years it was a framework on paper. That changed in February 2025, when the implementing regulations were approved by the executive and the 24-month traceability clock started ticking. Costa Rica went from “regulated in principle” to “active compliance regime” in a single Gaceta publication, and every licensed operator (and every applicant in the queue) now has a fixed runway to meet the seed-to-sale mandate.
The market context is just as material as the statute. As of September 2024 only 57 hemp licenses had been awarded by MAG against a stated government target of 10,000, meaning the licensing pipeline is essentially greenfield. The projected annual medical-cannabis market is in the order of 35 million US dollars at maturity, and in March 2026 Costa Rica recorded its first GACP-certified pharmaceutical-grade cannabis export to the European Union. Three signals from the same regime: the door is open, the standards are real, and the operators who built compliance infrastructure first are the ones now booking export volume.
The Two Cannabis Verticals Under Law 10,113
Law 10,113 treats cannabis as two distinct regulatory products, and conflating them is the single most common scoping error among new applicants.
The first vertical is medicinal and therapeutic cannabis, which covers any plant or extract above the hemp THC ceiling. Medicinal product handling is split between MAG (cultivation and seed approval) and the Ministry of Health (product registration, sanitary controls, pharmacy distribution under RTCR 515:2024). The ICD adds a parallel layer of diversion-control inspection on top of both.
The second vertical is hemp (cáñamo) and industrial use, defined by a THC content of less than one percent. Hemp licenses are issued by MAG, valid for six years, renewable, and limited to one license per natural or legal person. Hemp is the vertical with the most active pipeline so far because the bar to operate is set by agricultural rather than pharmaceutical authorities.
How Does Law 10,113 Allocate Authority Between MAG, the Ministry of Health, and the ICD?
Three Costa Rican authorities share oversight of the cannabis sector, and operators must build a compliance program that satisfies all three concurrently rather than sequentially. Map them wrong and the audit calendar becomes unmanageable.
MAG (Ministerio de Agricultura y Ganadería)
MAG is the gatekeeper for everything that happens before the plant is processed. Cultivation licensing, seed approval, hemp licensing, food and industrial processing permits, and the underlying agronomic framework all live with MAG. If your project involves growing the plant, MAG is the first authority you engage and the one whose inspectors will walk your fields, greenhouses, or indoor rooms.
Ministry of Health (Ministerio de Salud)
The Ministry of Health owns the medical product. Sanitary registration, RTCR 515:2024 product standards, labeling, dosage controls, advertising restrictions, and the licensed-pharmacy distribution channel are all Ministry of Health workflows. If your operation includes a manufacturing site or a finished medical SKU, the Ministry of Health is your primary product regulator and the authority that signs off before pharmacies can dispense.
ICD (Instituto Costarricense sobre Drogas)
The ICD is the diversion-control authority. Random and routine inspections of cultivation operations, custody verification, transport oversight, and monitoring against illicit-market diversion are all ICD responsibilities. The ICD is the agency that may show up unannounced, which is why “audit-ready at all times” is not a slogan in this market but a documented operational state. The ICD is also explicit that self-cultivation is prohibited, meaning only licensed producers may cultivate cannabis in Costa Rica at all.
What multi-agency oversight means in practice
Operators must maintain documentation that is simultaneously accessible to MAG, the Ministry of Health, and the ICD on demand. A single set of digital batch records, a single chain-of-custody trail, and a single source of cultivation data have to satisfy three different inspectors with three different mandates. The implication is straightforward: any platform you select for compliance has to generate reports for all three agencies natively, not as a custom export.
The toughest part of Law 10,113 isn’t any single requirement. It’s keeping MAG, the Ministry of Health, and the ICD looking at the same set of records from three different angles, on the same morning, without re-keying anything. GrowerIQ Compliance Team
What Is the Operator Pre-Launch Licensing Checklist?
The Law 10,113 framework establishes three license categories for psychoactive cannabis operations. Before submitting any application, operators must determine which of the three applies (or whether multiple are required for an integrated operator):
- Import and export of derivatives and finished products.
- Manufacture of derivatives and medicines.
- Cultivation, production, and related activities.
For hemp, the operative requirement is a separate hemp license (THC less than one percent) valid for six years with renewal permitted, and a one-license-per-person ceiling that prevents operators from stacking licenses through a single entity.
Application Requirements at a Glance
Every applicant, regardless of category, has to deliver the same evidentiary package to MAG and (where the activity is downstream) to the Ministry of Health:
- Costa Rican legal entity: foreign investors must participate through locally registered companies or partnerships. There is no fast-track for foreign-only corporate structures.
- Sworn declaration that no legal prohibitions affect the applicant or key personnel.
- Detailed project description covering scope, production capacity, facility footprint, equipment, and projected output.
- Environmental registration from the relevant Costa Rican environmental authority.
- Local government permits: municipal operating license and land-use compliance.
- Employer registration with CCSS (Caja Costarricense de Seguro Social).
- Export licensing extension: present current contracts with destination countries that allow legal cannabis trade.
Most application rejections in any new regulated market trace back to one of two things: missing local-government documentation (municipal permits, land-use letters), or environmental registration submitted as a placeholder rather than a finalised authorisation. Treat both as long-lead items and start them before the MAG file is opened.
Which SOPs and Records Are Mandatory Under the Implementing Regulations?
The February 2025 implementing regulations specify the cadence and the substance of the recordkeeping operators must maintain. A useful way to think about it is in three layers: cultivation, manufacturing, and product release.
Cultivation Records (GACP-Aligned)
GACP is mandated for any operator targeting EU export, and it is the de facto floor for serious domestic operators as well, since the European Medicines Agency framework for botanical raw materials is the recognised reference standard. The cultivation SOP set must cover:
- Documentation of all cultivation inputs including seeds, growing media, nutrients, pesticides, and water sources with full traceability.
- Harvest protocols documenting timing, methods, handling, and transport of plant material.
- Drying and storage SOPs covering temperature, humidity, pest control, and contamination prevention.
- Complete cultivation records including environmental data, batch records, pest-management logs, and personnel training records.
- GACP certification from an accredited third-party auditor for any EU-export-bound material.
Manufacturing Records (GMP-Aligned)
The manufacturing layer requires a full Quality Management System covering manufacturing, processing, and packaging operations. The required SOP set includes extraction, formulation, packaging, labeling, and lot release. Every production lot must carry a digital Master Batch Record with a full audit trail, and every batch must ship with a Certificate of Analysis that traces cannabinoid potency, heavy metals, pesticide residues, microbiology, and mycotoxins back to an accredited laboratory.
Product-Release Records (RTCR 515:2024)
Once a product is intended for the domestic market, RTCR 515:2024 governs the release. Sanitary registration with the Ministry of Health is required for all THC-based medical cannabis products. Labeling must specify product details, dosage information, cannabinoid content, and storage conditions. Advertising is constrained by the same RTCR. Distribution is locked to the licensed-pharmacy channel, and dispensation requires a valid digital prescription. There is no direct-to-consumer pathway and no pharmacy-bypass mechanism.
What Does the 24-Month Traceability Mandate Actually Require?
The February 2025 implementing regulations gave operators a 24-month runway to put a seed-to-sale traceability system in place, with the deadline landing in roughly February 2027. The runway is intentionally gradual, but the deadline is firm and the platform requirements are concrete.
Seed-to-Sale System Scope
A compliant system must cover the entire production chain from seed or clone through final sale. That means:
- Individual plant tracking: unique ID, cultivar, planting date, growing environment, nutrients applied, and harvest date.
- Processing and manufacturing tracking: extraction, formulation, packaging, labeling, and lot release each tied back to the originating plant material.
- Distribution and sales tracking: transport, pharmacy delivery, and patient dispensation against the digital prescription.
- Automated compliance reporting generated on demand for MAG, the Ministry of Health, and the ICD without manual data assembly.
Documentation and Records Standards
Digital Master Batch Records are required for every lot, capturing raw materials, process parameters, QC results, and release authorisation. Digital signatures must carry author traceability, timestamps, and record integrity equivalent to the standard set by US 21 CFR Part 11 (the practical reference even though Costa Rica does not formally cite it). Chain of custody must be unbroken from seed to final product delivery into the pharmacy or onto the export shipping document, and all documentation must be organised so it can be produced for any of the three regulators on inspection day.
Infrastructure and Security Controls
The physical envelope around the data matters as much as the data itself. The implementing regulations require access control, camera coverage, 24/7 monitoring, and visitor logs as conditions of ICD inspection readiness. Environmental monitoring (temperature, humidity, lighting) must be continuously logged with alert capability. Transport protocols for plant material and finished product must align with ICD requirements, and waste destruction of non-compliant lots must be documented with chain of custody and witness verification.
The two-year runway sounds generous on paper. In implementation reality, gap analysis takes a quarter, platform selection and procurement take a quarter, deployment and validation take two quarters, and operator training takes a quarter on its own. The window from May 2026 to February 2027 is not a year. It is one deployment cycle, and it is already on the clock. Primary-source background on the regulatory regime and the Gaceta where the implementing regulations were published is available via the Imprenta Nacional at https://www.imprentanacional.go.cr/ and via the Costa Rican government portal at https://www.gob.go.cr/.
Watch Out: Paper Records Will Not Survive the 2027 Traceability Mandate
Several Costa Rican operators are still running cultivation logs in spreadsheets and batch records in paper binders. That model worked under the pre-implementing-regulation regime. It will not survive an ICD inspection after February 2027, and it does not meet the practical bar that has emerged across MAG, Ministry of Health, and ICD inspections in 2025 and 2026: any record, retrieved in under fifteen minutes, with author attribution and timestamp. Plan the platform decision in Q2 or early Q3 2026, not the quarter before the deadline.
Get the Complete Costa Rica Compliance Checklist
Get the full PDF: the 32-item licensing and GACP/GMP checklist by phase, an RTCR 515:2024 product-standards reference table, the MAG, Ministry of Health, and ICD inspection-readiness matrix, and worked examples for the seed-to-sale traceability rollout.
What Can Costa Rican Operators Actually Export, and to Where?
Costa Rica is a small domestic market by any measure (the projected annual medical market sits in the order of 35 million US dollars at maturity), so for serious operators the export thesis is part of the licensing thesis. The Law 10,113 framework anticipates that. The import and export category is one of the three license types, and it is contingent on presenting current contracts with destination countries that allow legal cannabis trade. The licence does not by itself open a corridor: it ratifies that the operator has secured one.
The EU Corridor Is Real and Already Tested
The most consequential export precedent landed in March 2026, when Costa Rica recorded its first GACP-certified pharmaceutical-grade cannabis export to the European Union. That single shipment validated three things at once: the GACP standard layered on top of Law 10,113 is sufficient to clear EU import controls, Costa Rica is on the EMA-recognised botanical-raw-materials path for member-state pharmacy distribution, and a Costa Rican operator can compete on documentation quality with Colombian, Portuguese, and Swiss producers already serving EU pharmacies.
Operators chasing this corridor have a concrete documentation expectation. GACP per WHO guidelines is the underlying standard. The certifying body must be an accredited third-party auditor, not a self-attestation. The CoA per batch must trace cannabinoid potency, heavy metals, pesticide residues, microbiology, and mycotoxins through an accredited lab. The Master Batch Record must be digital, signed, and tamper-evident. None of that is optional for an EU buyer’s qualified person, and none of it can be retro-built after the fact.
What Cross-Border Activity Is Not Permitted
There is no consumer-facing cross-border channel. There is no recreational export. There is no “tourist” market embedded in the regime. Pharmacy distribution requires a valid digital prescription written in Costa Rica for a Costa Rican patient, and there is no pharmacy-bypass mechanism in RTCR 515:2024. Operators planning a business case should treat domestic supply as the licensing-validating revenue and EU export as the volume thesis, not the reverse.
How Should Operators Build an Audit-Readiness Workflow for Three Agencies?
The single hardest operational problem in Costa Rica is not any one regulator, it is the concurrency. MAG can ask for cultivation logs and seed-source provenance on a routine site visit. The Ministry of Health can request product registration files and stability data tied to a specific lot. The ICD can arrive unannounced and ask for chain-of-custody verification against the physical inventory in the vault. Operators that satisfy any one inspector but cannot satisfy all three on the same morning are at risk.
The “Single Source, Three Views” Pattern
The pattern that has worked in every multi-regulator market the GrowerIQ team has supported (Canada, Colombia, Germany, South Africa, Switzerland, Portugal) is the same one Costa Rica’s framework rewards: a single seed-to-sale database with role-based reporting views. Cultivation data flows in once, batch data flows in once, sales and dispensation data flow in once. The system then renders three different reports: a cultivation and seed-provenance view for MAG, a product registration and dosage view for the Ministry of Health, and a chain-of-custody and diversion-control view for the ICD. The data is the same. The lens is different.
The Quarterly Internal Audit Cadence
An effective preparation rhythm runs on a quarterly internal-audit cadence even in the absence of an external inspection. Each quarter, the compliance lead pulls a random batch and reconciles its full life from seed-source through pharmacy dispensation, with one of the three agency lenses applied each cycle. Over a year, every agency view is exercised twice. The point is not the report itself: it is to surface gaps in the underlying record while there is still time to correct them.
Document Retention and Access
Costa Rican operators should treat document retention as a separate workstream from operational records. The implementing regulations require that all documentation be available for inspection by MAG, the Ministry of Health, or the ICD at any time, and the practical bar that has emerged is “any record, retrieved in under fifteen minutes, with attribution.” That bar is met by digital systems with author traceability and timestamps. It is not met by paper binders or shared drives without access control.
What Are the Most Common Pitfalls Costa Rican Operators Should Avoid?
The pattern of compliance failures in Costa Rica during the first year of implementing regulations mirrors what played out in Colombia and Portugal at the same stage. Several Costa Rican licensees and applicants have hit the same predictable potholes, and they are worth flagging.
Watch Out: Hemp Licences Do Not Carry Forward Into Medicinal
The most expensive mistake from the first wave of Costa Rica applicants has been assuming a hemp licence (THC under one percent) creates a head start on medicinal. It does not. MAG and the Ministry of Health treat the two verticals as fully separate envelopes with their own facility, security, product-registration, and GACP requirements. The build-out cost of converting a hemp facility into a medicinal facility, mid-build, has run two to three times higher than building to the medicinal spec from day one.
Pitfall 1: Vertical Scope Creep
Operators apply for a hemp licence (THC less than one percent) intending to expand into medicinal later, and start building hybrid infrastructure on a hemp envelope. When the medicinal application is submitted, MAG and the Ministry of Health treat it as a separate vertical with its own facility, security, and product-registration requirements. The hemp envelope does not carry over. The fix is to plan the medicinal facility from day one if medicinal is the long-term thesis, even if hemp is the first revenue.
Pitfall 2: Recordkeeping Gaps in the Cultivation-to-Manufacturing Handoff
Cultivation records and manufacturing records are often built by different teams using different systems. The handoff (the point at which harvested material becomes a manufacturing input) is the single most common point of chain-of-custody failure. An ICD inspector can reasonably ask the operator to trace a finished product back to the originating plant lot, and several operators have discovered they cannot make that trace cleanly because the cultivation log and the batch record live in different tools. Plan for a single chain-of-custody system from the outset.
Pitfall 3: Failure to Renew on Time
Hemp licences are valid for six years with renewal permitted, but renewal is not automatic and the documentation refresh required at renewal is comparable to the original application. Operators that treat the six-year term as a runway and start renewal preparation in year six rather than year five have, in practice, run out of time. The renewal cycle should begin twelve months before expiry, with the documentation refresh treated as a planned workstream rather than an end-of-term emergency.
Pitfall 4: Pharmacy Channel Assumptions
RTCR 515:2024 routes all medical cannabis sales through licensed pharmacies with valid digital prescriptions. Several operators (across multiple LATAM markets, not specific to Costa Rica) have built business cases that assume a direct clinic channel, a delivery service, or a cash-pay self-pay model. None of those are permissible under the current regime. The pharmacy channel is the only channel, and the unit economics need to reflect that reality.
Pitfall 5: Treating GACP as a Domestic Compliance Document
GACP certification is not required for domestic supply, only for EU export. Operators sometimes defer GACP work indefinitely because the domestic market does not enforce it. This is a strategic mistake: the EU corridor is now demonstrated, the buyers are real, and the cost of bolting GACP onto an already-running facility is materially higher than building to GACP from day one. The operators capturing first-mover export volume are the ones who treated GACP as table stakes from the design phase.
When Should Operators Start the Costa Rica Compliance Build?
The honest answer is “yesterday,” but the operational answer is more useful. With the traceability mandate landing in roughly February 2027, the remaining runway is approximately nine months. A realistic deployment cycle for a multi-agency seed-to-sale system is six to nine months from procurement to validated production use, which means the procurement decision needs to be made in Q2 or early Q3 2026 for operators that intend to be compliant on day one rather than scrambling at the end of the runway. The Q3 to Q4 2026 window is for GACP certification, QMS rollout, accredited-lab partnerships, and staff training, all of which run in parallel with the platform deployment rather than after it. Primary-source guidance on the underlying authorities can be found at the Ministerio de Salud at https://www.ministeriodesalud.go.cr/ and the Ministerio de Agricultura y Ganadería at https://www.mag.go.cr/.
Frequently Asked Questions
What is Law 10,113 in Costa Rica?
Law 10,113 is Costa Rica’s “Law on Cannabis for Medicinal and Therapeutic Use and Hemp for Food and Industrial Use,” enacted in March 2022 and activated through implementing regulations approved in February 2025. It establishes three license categories (import or export, manufacture of derivatives and medicines, cultivation and production) and a 24-month seed-to-sale traceability mandate that lands in roughly February 2027. Our free Costa Rica Compliance Checklist walks through the licence categories, the application requirements, and the multi-agency oversight model step by step.
Who issues cannabis licenses in Costa Rica?
Three authorities share oversight. MAG (the Ministry of Agriculture) handles cultivation licensing, seed approval, and hemp production. The Ministry of Health (Ministerio de Salud) handles medical product registration, sanitary controls under RTCR 515:2024, and pharmacy distribution. The ICD (Instituto Costarricense sobre Drogas) handles random and routine compliance inspections and diversion monitoring. The full PDF includes the inspection-readiness matrix showing exactly which workflows each authority owns.
Can foreign companies get a Costa Rica cannabis license?
Foreign investors must participate through locally registered Costa Rican companies or partnerships. There is no fast-track for foreign-only corporate structures, and the licence sits with the Costa Rican legal entity rather than the foreign parent. Our free Costa Rica Compliance Checklist includes the full Costa-Rican-entity requirement list along with the environmental, municipal, and CCSS prerequisites every applicant has to satisfy.
How long does Costa Rica cannabis compliance approval take?
The honest answer is that approval timelines vary by licence category and by how complete the applicant’s environmental, municipal, and CCSS documentation is at submission. As of September 2024, MAG had awarded 57 hemp licences against a stated government target of 10,000, so the pipeline is still building capacity. Operators that pre-stage local-government permits and environmental registration before opening the MAG file consistently clear faster. The full PDF walks through the Q2 to Q4 2026 priority-action plan to maximise approval velocity.
What does the seed-to-sale traceability mandate require?
By roughly February 2027, every licensed operator must run a digital seed-to-sale platform covering individual plant tracking (unique ID, cultivar, planting date, environment, nutrients, harvest), processing and manufacturing, distribution and pharmacy dispensation, plus automated compliance reporting for MAG, the Ministry of Health, and the ICD on demand. The Costa Rica Compliance Checklist details the documentation, signature, and infrastructure standards (including the CFR Part 11 equivalent digital-signature requirement) operators have to meet.
What is RTCR 515:2024 and when did it take effect?
RTCR 515:2024 is the technical regulation that governs sanitary registration, labeling, dosage, advertising restrictions, and pharmacy distribution for THC-based medical cannabis products. It took effect in June 2025, alongside the start of pharmacy sales of medical cannabis. The full Costa Rica Compliance Checklist includes the RTCR 515:2024 reference table, the licensed-pharmacy distribution model, and the digital-prescription requirement for dispensation.
Get the Complete Costa Rica Compliance Checklist
Still mapping the compliance gap against Law 10,113 and RTCR 515:2024? Download the full Costa Rica Compliance Checklist for the timeline, the multi-agency inspection map, and the priority actions for Q2 through Q4 2026. One PDF, no fluff, ready for your project plan.
Ready to Take Your Operation to the Next Level?
See how GrowerIQ helps licensed cannabis facilities streamline compliance, reduce errors, and scale with confidence.
REQUEST DEMO
Ready to Level Up Your Operation?
Get the full PDF: the 32-item licensing and GACP/GMP checklist by phase, an RTCR 515:2024 product-standards reference table, the MAG, Ministry of Health, and ICD inspection-readiness matrix, and worked examples for the seed-to-sale traceability rollout.
Recommended For You
About GrowerIQ
GrowerIQ is changing the way producers use software - transforming a regulatory requirement into a robust platform to learn, analyze, and improve performance.
To find out more about GrowerIQ and how we can help, fill out the form to the right, start a chat, or contact us.