Canna River publishes two quality certificates, and neither of them is an FDA approval. One is an ISO 9001:2015 quality management registration issued by IAPMO SCB; the other is a cGMP certificate of conformity issued by a private registrar, ESQuality Group, written against the FDA's rules for finished pharmaceuticals. Both are linked in the site footer, both name a scope, and both carry an expiry date. Here is what each one says when you actually read it, and the three questions neither answers.
The ISO 9001:2015 certificate, line by line
| Issued by | IAPMO SCB (Systems Certification Body), Ontario, California, accredited by ANAB as a Management Systems Certification Body |
|---|---|
| Issued to | Canna River, 2535 Conejo Spectrum St., Thousand Oaks, CA 91320 |
| Standard | ISO 9001:2015 |
| Scope of registration | "The Sale of CBD products" |
| Certificate number | 1117702 |
| Certification decision | August 31, 2026 |
| Issued | November 15, 2026 (a renewal; the previous certificate under the same number was issued November 15, 2023) |
| Expires | November 14, 2029 |
| Site structure | Single site |
Two of those rows get skipped. "Single site" means the registration covers one address, not a supply chain. And the expiry date is how every ISO registration works: a certificate is a snapshot of an audit, not a permanent status, and it has to be re-earned. Canna River's was: the 2023 certificate ran to November 14, 2026, and IAPMO SCB re-issued it for three more years.
What ISO 9001 is actually about
ISO 9001 is a management-system standard. It asks whether a company has documented procedures, keeps records, defines responsibilities, controls its suppliers, handles non-conforming product, and acts on problems it finds. An auditor checks the system, not the chemistry.
So the honest summary is this: an ISO 9001 certificate tells you a company works to a written, audited process. It tells you nothing about how much CBD is in your bottle. That is a different question with a different answer, which is the batch report.
The cGMP certificate, line by line
| Issued by | ESQuality Group, San Clemente, California, signed by Erik Searle, Chief Executive Officer |
|---|---|
| Document type | Certificate of Conformity |
| Number | By/113 06.02.055 09710 |
| Issued to | Canna River+ (named on the certificate as a limited liability company) |
| Scope | "The Blending, Manufacturing, and Sale of CBD products" |
| Attests | That the implemented cGMP system satisfies 21 CFR Part 211, Current Good Manufacturing Practice for Finished Pharmaceuticals |
| Registered | February 2024 |
| Expires | February 2027 |
The reference to Part 211 is the interesting choice. The FDA writes separate cGMP rules for different product categories, and the one a CBD company would most often be measured against is not Part 211:
- 21 CFR Part 111 — Current Good Manufacturing Practice for Dietary Supplements
- 21 CFR Part 117 — Current Good Manufacturing Practice and preventive controls for Human Food
- 21 CFR Part 211 — Current Good Manufacturing Practice for Finished Pharmaceuticals
Part 211 is the pharmaceutical rule, and it is the most demanding of the three. Writing a CBD manufacturing system against it is a deliberately high reference point. It is also, to be precise about it, a voluntary one: hemp-derived CBD products are not approved drugs, so Part 211 does not legally apply to them. A private registrar attesting conformity with it is a company choosing a standard, not a company complying with a mandate.
What a certificate of conformity is not
This is where most CBD marketing goes wrong, so here it is plainly. The FDA does not issue cGMP certificates. In its own words, "CGMP refers to the Current Good Manufacturing Practice regulations enforced by the FDA," and enforcement means inspections and legal action, not certificates. A document from a private registrar is an independent third party's opinion that a system conforms. That has real value — someone outside the company looked — but it is not an approval, an endorsement, or a finding by any government agency.
The same page from the FDA makes a point that cuts the other way too, and it is the best argument for why manufacturing standards matter alongside lab reports: "While CGMP requires testing, testing alone is not adequate to ensure quality. In most instances testing is done on a small sample of a batch." A COA describes the sample that was tested. A manufacturing system is what makes the rest of the batch resemble it.
A third standard, on a different document
There is one more standard in this picture, and it belongs to the laboratory rather than to Canna River. Every PharmLabs San Diego batch report carries "ISO/IEC 17025:2017 Acc. 85368" and a DEA license number. ISO/IEC 17025 is the standard for the competence of testing laboratories: method validation, calibration, measurement uncertainty, and the right to report traceable results. It is why those reports state an expanded uncertainty of ±7.81% rather than presenting a number as exact. Three standards, three different objects: your supplier's system, the regulator's manufacturing rules, and the lab's competence.
What none of them tell you
- How much cannabinoid is in the package you bought. Only the batch report for that batch code answers this. The library held 677 reports on October 25, 2026; how to find yours.
- Whether the product is approved for any use. No hemp CBD product is. The disclaimer at the bottom of this page is not boilerplate; it is the actual regulatory position.
- Whether the certificate is still current. Check the expiry on the PDF itself. Canna River's ISO registration runs to November 14, 2029 and the cGMP conformity to February 2027.
The company behind the certificates
Canna River is made and sold by Canna River LLC, a family-owned business that started in 2018, owned and operated by Wes Boatman since 2022. The same address appears on the ISO certificate and the contact page: 2535 Conejo Spectrum St, Thousand Oaks, California 91320, with a published phone number, +1 (805) 375-2777, answered Monday to Friday, 8:00 AM to 4:30 PM Pacific. A verifiable address, a named owner and a phone that is answered are, unglamorously, three of the better signals in this industry.
Frequently asked questions
Is Canna River ISO certified?
Yes. IAPMO SCB registered its quality management system to ISO 9001:2015 under certificate 1117702, re-issued with an issue date of November 15, 2026, a scope of the sale of CBD products at a single site, and an expiry of November 14, 2029.
Is Canna River cGMP certified?
It holds a certificate of conformity from ESQuality Group, number By/113 06.02.055 09710, registered February 2024 and expiring February 2027, attesting that its implemented cGMP system satisfies 21 CFR Part 211.
Does that mean the FDA approved Canna River?
No. The FDA does not certify or approve companies as cGMP compliant, and it has not approved any Canna River product. The certificate is a private registrar's attestation.
Is ISO 9001 the same as a lab test?
No. ISO 9001 covers the management system; ISO/IEC 17025 covers the testing laboratory; a certificate of analysis covers one batch of one product. You need the third one to know what is in your bottle.
Where can I read the certificates myself?
Both are linked in the footer of cannariver.com as "ISO Certificate" and "cGMP Certificate", and both open as PDFs you can read in full.
Canna River products are intended for adults 21 and over. These statements have not been evaluated by the Food and Drug Administration. These products are not intended to diagnose, treat or cure any disease.
