The Hardware Vacuum

Why Cannabis Consumption Devices Have No Safety Standard, and What to Do About It

Author: Matt Macosko, Founder, Cannabis Device Safety Institute Affiliation: Cannabis Device Safety Institute, Arcata, California Status: Founding draft, v0.5 (April 2026) Suggested citation: Macosko, M. The Hardware Vacuum. CDSI Working Paper P-001. 2026.

Abstract

Tens of millions of Americans inhale cannabis through electronic and ceramic hardware every day. There is no comprehensive federal or state safety standard governing that hardware: no off-gas testing requirement, no materials transparency requirement, no certification mark backed by published methodology, and — most critically — no independent body whose institutional purpose is to fill that gap. This paper argues that the absence is not a regulatory oversight to be patched. It is the predictable consequence of cannabis’s federal status, the structural limitations of universities, the FDA’s narrow inhalation-hardware charter, the resource constraints of state cannabis regulators, and the incentive geometry of industry self-regulation. We name this institutional condition the Hardware Vacuum. We argue that a builder-led, university-partnered, fee-disciplined independent institute is the only realistic remedy — and that waiting for federal Schedule III rescheduling to fill the vacuum on its own is to abandon the field. The Cannabis Device Safety Institute (CDSI) is one such instantiation. The paper closes by specifying replication patterns so that other regions can stand up parallel institutes.

Keywords: cannabis safety, vaporizer hardware, off-gas analysis, builder-led standards, regulatory institutional design

1. Introduction

It is 2026. Federal Schedule III rescheduling for medical use became final on April 22, 2026, with the broader DEA reclassification hearing scheduled for June 29, 2026. Twenty-four states permit adult-use cannabis. Forty permit medical use. The most common consumption mode in regulated markets — by spending, by units sold, by harm-reduction-survey self-report — is electronic vaporization of cannabis concentrates.

A consumer in any of those states can purchase, for under fifty dollars, a battery-operated heating device, drop a cartridge of concentrate onto it, and inhale the vapor. The cartridge is regulated. The concentrate inside it is regulated. The device that heats the concentrate to volatilization temperature, that the consumer puts to their lips dozens of times per session, is not.

This is the Hardware Vacuum: the institutional absence of any body whose responsibility is the safety of cannabis consumption hardware as such.

The vacuum is not a story about a missing regulation. Plenty of regulations get written every year. The vacuum is a story about the missing institution — the body that would write, enforce, interpret, peer-review, and update such a regulation. Even if Congress passed a comprehensive cannabis hardware safety statute next session, no body currently exists to operationalize it.

This paper is an attempt to name the vacuum, explain why it persists, and argue for what should fill it.

2. The empirical situation

2.1 What gets tested today

Cannabis flower and concentrate testing in regulated markets is mature. State-licensed labs test for pesticide residue, microbial contamination, residual solvents, mycotoxins, foreign matter, and cannabinoid potency. The methods are published, the labs are accredited, and the results are conditionally public.

Cannabis hardware testing is, by comparison, minimal and inconsistent. The specific tests that do happen include:

• Battery and electrical safety, governed by Underwriters Laboratories standard UL 8139 (published 2018, derived from UL 8141 for general electronic cigarettes). UL 8139 covers fire and electrical hazards; it does not address what compounds the heating element off-gases at operating temperature.
• Heavy metals in cartridge components, performed sporadically by a handful of state labs, primarily where state regulators have inferred jurisdiction over the cartridge as part of the regulated concentrate package. Results are not consistently public.
• Manufacturer-internal QA testing, common in the larger hardware companies, but never required, never published, never standardized.

Conspicuously absent: testing of the device under load — what compounds the heater releases when it is operating at intended temperature, with concentrate present, in conditions resembling consumer use. We have proposed elsewhere (CDSI-001) that this test be called loaded-state off-gas (LSO) analysis. As of this writing, it is not required by any state, performed routinely by any third-party body, or published in any registry.

2.2 What’s at stake

At operating temperatures (350–700 °F), a cannabis vaporizer simultaneously: heats organic concentrate matter past the volatilization point of dozens of compounds; heats the heating element itself, which can volatilize trace constituents of metal alloys, ceramic substrates, glaze coatings, and adhesives; and heats whatever else is in the cartridge — cutting agents, residual solvents, terpene additives sourced from non-cannabis botanicals, vitamin E acetate.

The 2019 EVALI outbreak — vaping-associated lung injury that killed sixty-eight Americans and hospitalized over twenty-eight hundred — was traced primarily to vitamin E acetate in illicit-market cartridges. That attribution is correct but incomplete. Vitamin E acetate at ambient temperature is largely inert. The lung injury was the product of a device-mediated thermal reaction: vitamin E acetate, when heated by an active vaporizer, produces ketene gas and a class of acutely lung-toxic decomposition products. We have proposed that this category of hazard be called adulterant amplification — harm that is neither solely the adulterant’s fault nor solely the device’s, but the product of their interaction.

A pre-market LSO testing protocol, applied to consumer cartridges in 2018, would have detected the amplification signature. Sixty-eight people would have been alive on January 1, 2020.

This is not a hypothetical claim. Vitamin E acetate’s pyrolytic decomposition pathway was documented in the analytical chemistry literature within months of the EVALI cluster. The compound’s behavior at vaporization temperature was knowable. There was no body whose job it was to know.

2.3 The pyrolytic reservoir, session drift, and what we still don’t know

Beyond LSO, the field is unaware of categories of risk that we do not yet have names for:

• Pyrolytic reservoir effect — the residue from prior sessions, charred onto the heating element, that re-cooks at higher temperatures during subsequent draws.
• Session drift — the progressive change in off-gas profile across the 15–20 draws of a single session as the device heat-soaks.
• Heater-matrix coupling — the interaction between specific heater materials and specific concentrate matrices, such that a heater certified safe with distillate may not be safe with live resin.

None of these phenomena are exotic. They are routine engineering considerations in adjacent fields — combustion engineering, food-processing equipment design, pharmaceutical inhaler manufacturing. Their absence from the cannabis hardware safety literature is not because they have been studied and dismissed. It is because there is no body whose job is to study them.

3. Why the vacuum persists

3.1 Universities

Cal Poly Humboldt’s Humboldt Institute for Interdisciplinary Marijuana Research (HIIMR), founded in 2012, is among the most respected cannabis research bodies in the country. So are programs at Colorado State, Washington State, the University of Mississippi (long the federal cannabis cultivation contractor), and a growing list of others.

These programs are necessary, but they are not sufficient. As public university centers, they cannot, structurally:

• Certify commercial products. State universities are typically prohibited from endorsing private vendors.
• Accept manufacturer fees for testing services. Doing so would compromise their academic position and trigger conflict-of-interest reviews.
• Move at industry tempo. University IRB cycles, grant cycles, and graduate-student timelines are measured in semesters; hardware product cycles are measured in months.
• Specialize in device characterization. Cannabis research at universities is overwhelmingly chemistry- and biology-centric; very few cannabis-research faculty are mechanical engineers, materials scientists, or electrical engineers with hardware experience.

This is not a critique of universities. It is a description of their institutional charter.

3.2 The FDA

The FDA’s Center for Tobacco Products has authority over electronic nicotine delivery systems (ENDS). It has explicitly disclaimed jurisdiction over cannabis hardware while cannabis remains federally Schedule I.

Even with the April 22, 2026 medical-use Schedule III rescheduling now final, FDA jurisdiction will expand slowly. The agency’s prior conduct in adjacent areas — its multi-decade timeline on tobacco regulation, its still-evolving ENDS framework, its narrow charter on combustion-mode cannabis — gives no reason to expect rapid intervention. Its priorities, when expansion happens, will skew toward pharmaceutical-grade cannabis products (medical inhalers, prescribed dosing devices), not consumer concentrate vaporizers.

3.3 State regulators

State cannabis control bodies have neither the laboratory capacity nor, in most cases, the statutory mandate to test hardware. California’s Department of Cannabis Control regulates the concentrate inside the cartridge; it does not regulate the cartridge itself, except to the extent that the cartridge contributes contamination to the regulated concentrate.

A few states (Massachusetts, Colorado) have begun gesturing toward hardware regulation, typically by extending heavy-metals testing to packaging. None have built device-level testing infrastructure. None have hired the engineering staff necessary to interpret device-level test results.

3.4 Industry self-regulation

Manufacturers police their own products. The largest hardware companies maintain internal QA programs, often substantive. They do not, as a rule, publish unfavorable findings, use shared methodology, or contribute to a public registry of failed tests.

This is not a moral failure. It is the predictable equilibrium of an industry whose buyers (dispensaries, brands, white-label customers) cannot effectively distinguish between two compliance-claim-equivalent devices, and whose costs of testing are felt entirely by the manufacturer who pays for the test.

3.5 The vacuum, then

The vacuum is the gap between what universities can do, what the FDA chooses to do, what state regulators have capacity to do, and what industry has incentive to do. Each individual party is acting consistently with its institutional charter. The result is that the work — characterizing what compounds consumers actually inhale from cannabis hardware — gets done by no one.

This is the Hardware Vacuum. It will not fill itself.

4. What should fill the vacuum

A body that fills the Hardware Vacuum must satisfy six conditions:

1. Independent. Not a department of any university (because of §3.1), not a subsidiary of any manufacturer (because of §3.4), not a trade association (because of capture risk).
2. Builder-staffed. The body’s protocol authors must include people who have built the hardware in question. This is non-negotiable; absent builder involvement, the protocols miss failure modes that are visible to engineers but invisible to chemists.
3. Scientist-reviewed. The body’s protocols must pass peer review by independent academic scientists. Builder authorship without scientific review reproduces the trade-association equilibrium.
4. Fee-disciplined. The body must accept manufacturer testing fees but never sell pass/fail outcomes. Operationally: published fees, public reports regardless of result, manufacturer responses appended verbatim. We propose this norm be called pay-the-lab discipline — pay the lab, not pay to pass.
5. Open in methodology and data. Every protocol public. Every report public. Every dataset replicable. Closed certification is a contradiction in terms; if the methodology is closed, peer review is impossible, and the certification reduces to brand reputation.
6. Region-anchored, replication-friendly. The body should be small enough to operate (and be governed) at human scale, while structured so that parallel bodies in other cannabis-producing regions can replicate the model without coordination overhead.

The Cannabis Device Safety Institute is one such instantiation. Headquartered in Arcata, California, formally partnered with HIIMR at Cal Poly Humboldt, structured as a 501(c)(3) nonprofit parent with a fee-for-service testing subsidiary, the Institute is designed against these six conditions explicitly.

It is not the only possible instantiation. The Humboldt model — builder-led applied institute + university research institute + MOU-governed partnership + jointly-hosted annual symposium — is intended to be replicable. We expect (and welcome) parallel institutes in Oregon’s Willamette Valley, in Massachusetts, in Mendocino County, in Oklahoma, in Colorado. The vacuum is large; one institute cannot fill it alone.

5. The cost of waiting

A reasonable objection runs: federal Schedule III rescheduling is now happening. Medical use became Schedule III on April 22, 2026; the DEA hearing on broader reclassification is scheduled for June 29, 2026. Federal research funding will follow. Why stand up an institute now, when in twelve to twenty-four months the institutional landscape may shift further?

The objection misunderstands how institutional landscapes shift. Federal money lands first in the bodies that already exist to receive it. NIH, NIDA, NIOSH, and CDC do not, after a rescheduling event, conjure new institutes into existence. They fund existing institutes. The April 2026 rescheduling sharpens this argument rather than dulling it: the medical-use pathway is now open, and the bodies positioned to receive that funding when the first NIDA NOFOs land are the bodies that already exist as of today.

If the only existing institutes when federal money arrives are pharmaceutical companies, large hardware manufacturers, and university research centers without device-engineering capacity, that is who shapes the field. The standards that emerge will be the standards those bodies are equipped to write.

If, on the other hand, an independent builder-led institute exists when the money arrives — with a published methodology, a track record of public reports, a partnership with a respected university research institute, and a credentialed scientific advisory board — that institute is positioned to receive federal funding on day one. The standards it has already published become the natural reference for federal protocols.

The cost of waiting is not the time itself. It is the loss of standing when the moment arrives.

6. Conclusion

The Hardware Vacuum is real, structural, and persistent. It will not be filled by Congress, by the FDA, by state regulators, by university research alone, or by industry self-regulation. It will be filled by independent institutes — builder-led, scientist-reviewed, fee-disciplined, open in methodology and data, region-anchored.

The Cannabis Device Safety Institute exists to be one such institute. It is also a working draft of a replicable pattern — the Humboldt model — that other regions can instantiate without permission and without coordination overhead. The Institute publishes its protocols, its reports, its lexicon, and its governance documents under terms that explicitly invite forking.

From where this author sits, after fourteen years of building cannabis hardware in Humboldt County, the work is overdue. We are starting it.

Acknowledgments

The 2016 off-gas analysis that anchors this paper and the broader CDSI methodology was performed by ALS Environmental (Simi Valley, California), service request P1605022, project manager Samantha Henningsen. The framing of “builders, not lawyers” owes a debt to every operator in this industry who funded their own testing because nobody else would.

References (preliminary)

To be expanded in v1.0:

1. Underwriters Laboratories. UL 8139: Standard for Electrical Systems of Battery-Powered Vapor Products. 2018.
2. Centers for Disease Control and Prevention. Outbreak of Lung Injury Associated with the Use of E-Cigarette, or Vaping, Products: Final Report. 2020.
3. ALS Environmental. Off-Gas Analysis Report, Service Request P1605022. November 30, 2016. Archived at CDSI document repository.
4. Cannabis Device Safety Institute. CDSI-001 Protocol: Off-Gas Analysis of Cannabis Concentrate Vaporizers, v1.0 (Founding Draft). April 2026.
5. Cannabis Device Safety Institute. The CDSI Lexicon, v. 2026-04. April 2026.

Comments and corrections to: matt@ineedhemp.com (until papers@cdsi.io is provisioned).