Recall Forensics

Recall Forensics: The New York Keystone Lab Recall — the validation failure behind it

Team ValidLeaf · September 2026 · 5 min read

Recall Forensics is our series tracing real cannabis product recalls to the specific validation gap that caused them. Every fact comes from public regulator records or trade-press reporting of those records — no speculation, no invented causes. This case is the one that should keep every manufacturer up at night, because the manufacturers involved did nothing wrong. They tested their products. They got passing results. And they were recalled anyway.

What happened

On February 27, 2026, the New York State Office of Cannabis Management (OCM) issued a product recall covering multiple adult-use cannabis products tested by Keystone State Testing New York, a permitted testing laboratory. The trigger wasn't a failed product test — it was a failed lab. Following inspections and a records audit of Keystone conducted between December 2025 and January 2026, OCM determined the laboratory had issued unreliable results for several products. A total of 54 product lots had results for Aspergillus — a disease-causing mold — falsely reported as passing when they did not meet the state's safety and testing standards for consumption. One additional lot had a result for the heavy metal cadmium reported incorrectly (OCM press release).

OCM described the recall as a precautionary measure and reported no adverse health effects. Some of the products were considered adulterated; for others, the test results were simply in doubt. "This recall was issued after identifying problems with laboratory testing and reporting from a specific laboratory," said Stephen Geskey, Executive Deputy Director of Licensing, Compliance and Laboratories. "When test results are inaccurate or unclear, product safety and in turn, the safety of New York State consumers cannot be guaranteed. It is not a risk OCM is willing to take."

In a telling footnote, OCM later had to issue a correction to its own recall notice — an incorrect return instruction from a prior recall had been inadvertently included in the original GovDelivery message. Even regulators stumble on recall communications, which is exactly why the discipline of the process matters as much as the science.

The validation gap: lab data integrity

Here is what makes this case brutal: the manufacturers did the compliant thing. They paid a state-permitted laboratory for compliance testing. They received certificates of analysis. They shipped product on the strength of those COAs. And the data behind those COAs was unreliable. Every manufacturer downstream of a bad lab inherits its data-integrity failures, regardless of how clean their own operation is.

The lab's failure is a data-integrity failure in GMP terms — the kind our data integrity guide describes — and your defense against it is laboratory qualification, treating your testing lab like the critical supplier it is:

• Qualify the lab, not just the price. A qualification questionnaire and, for your primary lab, an on-site audit: evidence of validated test methods, analyst training and qualification records, and instrument qualification.
• Demand OOS discipline. A credible lab investigates out-of-specification results instead of editing them into compliance. Ask to see the OOS procedure before you need it.
• Verify, don't file. COAs should be reviewed against your specifications at receipt — a COA nobody reads is a record, not a control.
• Spot-check with a second lab. Periodic split-sample or second-lab verification on your highest-risk analytes turns blind trust into evidence.
• Trend your results. If your Aspergillus pass rate never varies and your potency numbers never surprise you, that is a signal — not a comfort.

There is an uncomfortable second gap underneath this one: somewhere in New York, 54 lots of product genuinely carried Aspergillus. The false pass didn't just clear a test — it masked an environmental monitoring problem at the manufacturing sites. A reliable lab would have caught the mold; the mold's presence means the facilities' own environmental controls were already failing. (See our CQV guide on facility qualification and monitoring.)

How a GMP Readiness Assessment catches it

This is exactly the failure pattern a GMP Readiness Assessment is built to find. Over four weeks, it reviews:

• Your testing and QC program — are your laboratories qualified as critical suppliers, with evidence on file?
• COA review discipline — are certificates verified against specifications at receipt, or filed unread?
• OOS investigation SOPs — yours and your lab's: do out-of-spec results trigger investigations or corrections?
• Environmental monitoring — is your own facility's mold-control program designed to catch what a bad lab would hide?

It closes with a gap assessment, a remediation roadmap, and starter IQ/OQ/PQ templates — so the fix starts before the regulator's audit does.