Recall Forensics

Recall Forensics: The Arizona Lab Ban — when the COA itself can't be trusted

Team ValidLeaf · October 2026 · 6 min read

Recall Forensics is our series tracing real cannabis recalls and enforcement actions to the specific validation gap behind them. Every fact comes from public regulator records or reporting of those records — no speculation, no invented causes. This case is not a single contaminated batch. It is what happens when a retailer stops trusting the test results themselves: in September 2026, Story Cannabis told its suppliers it would no longer accept products tested by two state-licensed laboratories. The gap: a certificate of analysis treated as proof, when it is only a claim that still needs qualification and verification.

What happened

Story Cannabis operates 11 dispensaries in Arizona and stores in three other states. On September 10, 2026, its Arizona retail buyer, Nikole Samuelson, emailed suppliers with a cutoff: the chain would not accept products tested by Kaycha Labs in Tempe or Level One Labs in Scottsdale if the certificate of analysis — the COA — carried a test date on or after October 1, 2026. Story's founder confirmed the email to the Arizona Republic. Suppliers who wanted shelf space would need to use a different lab (Arizona Republic; MJBizDaily; Ganjapreneur).

The two labs had different problems, and both matter. Arizona's Department of Health Services fined Kaycha $88,500 after inspections found inaccurate results for contaminants and other tests. Reporting based on state records describes repeat findings in 2023 and 2024 and again in April 2025, problems with potency, pesticide and microbial methods, a dilution issue that could skew THC results, and quantification limits set far above the state maximum for some tests. MJBizDaily, summarising the findings, also noted incomplete sample records, client-requested potency re-runs without a documented scientific reason that came back biased high, and no log for every sample where Aspergillus or Salmonella was detected. The Republic reported that problems at Kaycha contributed to a December 2025 recall of several products it had tested.

For Level One, a state letter dated August 5, 2026 described a software problem that inflated potency for flower and infused flower for months. According to that letter, the software applied an undisclosed dry-weight conversion that reduced the sample weight in the calculation, so reported cannabinoid results came out high. Inspectors also found a December case in which Aspergillus was detected but the COA reported it as not detected, and the agency issued a July recall after detected Aspergillus results had been reported as passing. Level One had previously been fined $12,000 in 2024 over repeat record-keeping and policy findings, per the Republic.

The responses were not the same. Kaycha, which operates in nine states, did not comment to the Republic and did not acknowledge wrongdoing in its consent agreements. Level One's co-founder attributed the recent issues to human error and inadvertent software problems, said the problems were fixed after notification, and asked Story for a clear path to reinstatement.

An honesty note, because we hold ourselves to it: public reporting does not establish intent at either lab, and state records as reported do not fully explain why the underlying errors occurred. The Republic noted that the health agency referred its most recent Level One findings to enforcement for a possible fine; the outcome of that referral is not publicly known as of this writing. The lesson does not depend on intent — an inaccurate COA creates the same release risk whether it came from a software default, a weak method, or a deliberate shortcut.

The validation gap: lab qualification and COA data integrity

Most manufacturers qualify a lab the way they check a box: is it state-licensed, is it accredited, can it turn product around in time? That is licensure, not qualification. A licensed lab can still run an unvalidated method, an unvalidated spreadsheet or software calculation, and a retest practice that quietly rewards the answer the client wants. When that happens, every downstream decision built on its COAs — release, labelling, potency claims — inherits the error. This is the same upstream pattern we traced in New York's Keystone lab recall, where manufacturers with passing paperwork were recalled anyway because the results underneath were unreliable.

The controls that would have reduced this risk are specific, and most belong to the manufacturer and retailer, not just the lab:

• Qualify the lab beyond its licence. Review the lab's inspection history, repeat findings, corrective actions, and proficiency-testing record before you place product with it — and re-review on a schedule. Repeat findings are a signal, not background noise: a finding that returns in the next inspection means the fix was never verified.
• Validate the method, not just the result. Ask how detection limits and quantification limits compare with the state action limits for pesticides, microbes and solvents, which dilution factors the method uses, and what evidence shows the method can actually detect a failure at the limit. A limit set above the legal maximum cannot produce a meaningful pass.
• Put laboratory software under change control. A conversion factor buried in a calculation is a validated-system problem. Potency software, LIMS calculations and any moisture or dry-weight correction need documented requirements, testing before use, change control when they change, and disclosure on the COA when a correction is applied. That is core data-integrity work, not IT housekeeping.
• Ban retesting into compliance. A re-run needs a documented, scientifically valid reason, a pre-written retest protocol, and retention of the original result. Retesting at a client's request with no invalidated cause — and keeping only the higher answer — destroys the audit trail a COA is supposed to represent.
• Verify COAs independently. Periodically split samples to a second qualified lab, trend failure rates by lab and by analyte, and investigate a lab whose failure rate is implausibly low as carefully as one whose rate is high. Story's decision is, in effect, verification at the retail gate — useful, but far more expensive than catching the pattern before product is made.
• Write the exit into the quality agreement. Agreements with testing labs should define notification duties for inspection findings, method or software changes, and data corrections, plus your right to pause acceptance. If a retailer's ban is the first time you hear about your lab's repeat findings, the agreement was never doing its job.

For cannabis manufacturers, the uncomfortable point is ownership. You cannot outsource release. The lab generates the data, but the manufacturer puts the product on the market and the retailer puts it on the shelf — and regulators and customers will hold those names, not just the lab's, when a passing COA turns out to be wrong.

How a GMP Readiness Assessment catches it

This is exactly the failure pattern a GMP Readiness Assessment is built to find. Over four weeks, it reviews:

• Your testing-lab qualification file — inspection history, repeat findings, proficiency results, and scheduled re-qualification, or just a licence on file?
• Method suitability — do your labs' detection and quantification limits, dilutions and panels actually support the pass/fail decisions you are making?
• Lab software and data integrity — are LIMS and potency calculations validated, change-controlled, and transparent about corrections on the COA?
• Retest and OOS discipline — is every re-run justified in writing with the original result retained, and are COA trends reviewed by lab and analyte?
• Quality agreements and contingency — do you have a qualified second lab and a documented pause-and-switch trigger if a lab's findings escalate?

It closes with a gap assessment, a remediation roadmap, and starter IQ/OQ/PQ templates — so the fix starts before a retailer makes the decision for you.