A Qualified Person in Frankfurt rarely rejects a Canadian batch because something went wrong in the grow room. They reject it because the deviation record doesn't say what went wrong, what it did to the lot, or who decided the lot was still fit to release.
Cannabis deviation and CAPA management is the documented system a Licensed Producer uses to capture any departure from an approved procedure or specification, investigate the cause, assess the effect on affected lots, and apply corrective and preventive actions. Canada's Cannabis Regulations require this indirectly, through good production practices and the quality assurance function. EU-GMP requires it by name, in writing, with timelines.
That gap is where export deals stall in 2026. A producer can hold a spotless Health Canada inspection history and still fail a European supplier audit on deviation handling alone, because the two systems ask for different evidence of the same thing.
Where Canadian rules require deviation control
Search the Cannabis Regulations for the word deviation and you won't find the concept the way a European auditor uses it. What you'll find is Part 5, good production practices. It requires that cannabis is produced, packaged, labelled, stored and tested under sanitary conditions, using written procedures. Part 11 then sets out how long those records have to be kept. Health Canada builds the rest of the expectation around two things: your standard operating procedures, and the person who signs off before a lot moves.
Processing licence holders carry an extra requirement. Their preventive control plan has to identify hazards, set out the controls, and show the monitoring that proves those controls held. A dry room that ran nine hours at 24 degrees when the SOP says 18 is a control failure. Nothing in the regulations names that event. Your preventive control plan, your monitoring records, and the quality assurance person who releases the lot all have to account for it anyway.
So the Canadian obligation is real. It's just assembled from parts rather than handed to you as a chapter. Producers who export tend to formalise it anyway, because the moment an EU importer's auditor arrives, an informal system reads as no system.
Classifying deviations before the auditor does
Classification decides everything that follows: who investigates, how fast, and whether the batch can move. Most exporting LPs run a three-tier scheme.
| Class | What it means | Batch effect | Who closes it |
|---|---|---|---|
| Critical | Product safety, identity or potency is in question | Quarantine, no release | QA head plus senior management |
| Major | A GMP control failed, product likely unaffected | Release only after impact assessment | Quality assurance person |
| Minor | Documentation or process slip, no product effect | No hold | Area supervisor, QA review |
Two rules keep this honest. Nobody classifies their own deviation, and the classification is written before the investigation concludes, not after. Auditors read a file where every event landed as minor exactly the way you'd expect them to. The same logic applies to your record trail: if the timestamps and signatures can't survive scrutiny, data integrity questions will swallow the deviation discussion entirely.
What EU-GMP and ICH Q10 add for exporters
Chapter 1 of EudraLex Volume 4 states the requirement directly. Deviations must be recorded and investigated, and corrective and preventive actions have to follow. The annual product quality review then covers every significant deviation, the investigation behind it, and whether the resulting CAPA actually worked. The European Commission has consulted on a revision of Chapter 1 aligning it with ICH Q9(R1) on quality risk management. That pushes the same file toward documented risk rationale rather than narrative.
ICH Q10 puts CAPA among the four elements of a pharmaceutical quality system, next to process and product monitoring, change management, and management review. That placement matters for a supplier audit. It means your CAPA system isn't judged on individual files. It's judged on whether the loop feeds back into how you produce.
What the importer's QP needs before certification
Annex 16 governs batch certification, and section 3 covers unexpected deviations. A QP can certify a batch affected by an unexpected deviation where the registered specifications for the product are still met and the deviation has been investigated and closed. That single sentence sets your export reality: an open deviation on a lot heading to Germany is an unreleased lot, whatever your Canadian paperwork says. The mechanics of that handoff sit in EU QP batch release, and the underlying system expectations come with EU-GMP certification.
One distinction gets confused constantly, and auditors test for it. A deviation is unplanned. Change control is planned. Swapping a nutrient supplier because the old one folded is a change, handled through change management before it happens. Discovering mid-run that the new nutrient arrived with a different certificate of analysis is a deviation. Filing the second as the first is how a producer ends up explaining, in front of an auditor, why a change was approved after it took effect.
The 5-step export CAPA loop
Investigations fail in predictable places. Here's the loop that survives a European audit, with the step where most Canadian files break.
- Contain first. Quarantine affected lots and any lot produced under the same failed control, within 24 hours of discovery. Containment before investigation, always. A file that opens with analysis and reaches quarantine on day six tells an auditor product moved while you were thinking.
- Describe the event as fact: date, time, batch numbers, equipment, operator, what the procedure required, and what happened instead. No interpretation yet. If the first paragraph already names a cause, the investigation was written backwards.
- Find a cause you can act on. Operator error isn't a root cause. It's where the analysis stops early. Five whys or a fishbone will usually land on the real one: a procedure that reads two ways, training that covered the old revision, an alarm limit nobody set. Ask whether your action would prevent a recurrence next Tuesday with a different operator.
- Assess product impact in writing. Name every affected lot, the specification in question, and the market each lot is destined for. Germany, Australia and Israel apply different release specifications, so one deviation can be immaterial for a domestic lot and disqualifying for an export lot.
- Verify the fix. Corrective action repairs this event. Preventive action stops the class of event. Effectiveness verification proves it, with a metric and a date: zero recurrences across the next 20 batches, or the excursion alarm firing correctly in three scheduled challenges.
Call it the 5-Step Export CAPA Loop and put the step names in your SOP, because auditors follow your own structure when they read your files. Canadian regulations set no deadline for closing a CAPA. Quality agreements usually do, and 30 days is the common figure, with extensions permitted where the justification is documented before the clock runs out.
Escalation deserves its own trigger. When an impact assessment shows a released lot may not meet specification, you're no longer in deviation handling. You're in recall territory, and the notification clocks that come with it start whether or not the investigation is finished.
What importers audit in a deviation file
Supplier audits move fast and follow the same route. An auditor picks two or three deviations from your log, usually the oldest open one and the one with the vaguest title, and reads them end to end. What they're testing is whether the system works when nobody's watching.
Have these ready before the audit date:
- The deviation log for the last 24 months, with open items and their ageing visible
- Complete files for any deviation touching a lot the buyer received
- Your classification SOP, showing who decides and on what criteria
- Effectiveness verification records, not just closure signatures
- Trend review output, showing repeat causes and what you did about them
Three numbers carry more weight than any single file. The count of open CAPAs older than 90 days tells an auditor whether closure is real or ceremonial. The share of investigations closed to human error tells them how deep the analysis goes, and anything above roughly a quarter invites scrutiny. Repeat deviations on the same cause tell them the preventive half of CAPA isn't functioning. German buyers have grown blunt about this since regulators there began scrutinising GMP claims more closely. A thin deviation history now reads as a red flag, not a clean record.
Your quality agreement should already say who gets told, how fast. Negotiate the notification window while you're drafting, not while you're inside one. A 24-hour clause for deviations affecting shipped product is achievable if your escalation path is built for it, and painful if it isn't.
AlphaLeaf is a Montreal-based Health Canada Licensed Producer growing indoor, hand-trimmed cannabis flower from refined genetics. We hold export authorisation under the Cannabis Act. Our batch records, ISO 17025 testing data and full traceability documentation are built for the review an EU importer's Qualified Person runs before certifying a lot for the medical channel.
If you're qualifying a Canadian supplier this quarter and want to see how the documentation actually reads, get in touch and we'll walk your quality team through a batch file.
Frequently Asked Questions
What is the difference between a deviation and a CAPA?
A deviation is the recorded event, meaning any departure from an approved procedure, specification or control. A CAPA is what follows: the corrective action that fixes the immediate problem and the preventive action that stops the same class of event recurring. Every significant deviation should generate a CAPA, but CAPAs also come from complaints, audit findings and trend reviews.
Do Canadian LPs have to report deviations to Health Canada?
Not routinely. Deviations are managed internally under Part 5 good production practices and reviewed during inspection. Specific events do carry their own notification duties, including loss or theft of cannabis, serious adverse reactions and recalls. A deviation only becomes reportable when it triggers one of those pathways.
How long does a Canadian LP have to close a CAPA?
The Cannabis Regulations set no deadline. Quality agreements with EU importers commonly require closure within 30 days, with documented justification for any extension. For export lots the harder deadline is practical: under Annex 16, a Qualified Person cannot certify a batch until the deviation affecting it has been investigated and closed.
Can a batch with an open deviation be exported?
It can be shipped once Health Canada export permit conditions are met, but the importer's Qualified Person will not certify it for release while the deviation remains open. Annex 16 allows certification of a batch affected by an unexpected deviation only where registered specifications are still met and the investigation is closed. In practice that means holding the lot.
What is the difference between deviation management and change control?
Timing. Change control handles planned modifications to equipment, suppliers, procedures or specifications, and the assessment happens before the change takes effect. Deviation management handles unplanned departures after they occur. Auditors check that planned changes were not filed as deviations after the fact, which is a common finding.
