Every criminal penalty attached to a controlled substance in the United States, whether it is a marijuana possession charge or a fentanyl trafficking case, traces back to a single phrase in the Controlled Substances Act of 1970. “Potential for abuse.” It is the first of eight factors the Food and Drug Administration is required to weigh when deciding whether a drug belongs in Schedule I with heroin or Schedule V with cough syrup. According to a new GAO report released this week, FDA has never written down what the phrase means.
Not “hasn’t gotten around to it lately.” Never. Fifty six years into the statute, the agency responsible for the single most consequential judgment in American drug law, the one that decides whether you face a misdemeanor or a mandatory minimum, is operating on what its own officials describe to GAO as “professional judgment.” There is no criteria document. There is no process memo. There is a phrase in a 1970 statute and a room full of scientists doing their best.
The Machine That Has No Manual
To be fair to FDA, the underlying machine is genuinely intricate, and GAO’s report lays it out in more detail than anyone outside the agencies has probably ever gotten. When DEA wants to schedule, reschedule, or deschedule a substance, it is required to request a scientific and medical evaluation from HHS, which farms the actual work out to FDA’s Controlled Substance Staff. FDA runs what the statute calls an eight factor analysis, weighs the evidence, and sends a recommendation back. Under a 2024 Department of Justice Office of Legal Counsel opinion, that recommendation is legally binding on DEA right up until DEA opens formal rulemaking, at which point DEA still owes it “significant deference.” In practice this produces a strange kind of choreography. GAO reviewed 208 substances DEA acted on between 2020 and 2025, found that DEA was required to request and consider an HHS evaluation for 95 of them, and confirmed DEA did so every single time, aligning with HHS’s recommendation on all 84 substances where a final decision had been published by the study’s cutoff.
So the system, mechanically, works. Two agencies coordinate, mostly agree, and rarely fight. What GAO actually found alarming was not the disagreement rate. It was that neither agency has bothered to write down how any of this is supposed to happen. DEA has no policy assigning roles or responsibilities within its Diversion Control Division for any of the four scheduling pathways it runs. When GAO asked why, DEA’s answer amounted to a shrug dressed up as confidence, that the statute is already clear and the staff are qualified scientists with advanced degrees who do not need a manual. FDA’s defense was gentler but structurally identical, that each evaluation is so individualized a written policy might not fit, so staff learn the eight factor analysis through what the agency calls “person to person training.” Meaning if the two or three people who currently know how it is done retire in the same fiscal year, so does the institutional memory.
A Definition Nobody Bothered to Write
FDA officials told GAO directly that the absence of a written definition of “potential for abuse,” including what counts as a “high” potential for abuse, creates real problems when a substance does not cleanly resemble anything already scheduled. They cited xylazine, the veterinary sedative now showing up as a street drug additive, as a case where the lack of a legal or policy definition left staff improvising. This is not a hypothetical gap. It is the actual criterion federal law uses to sort substances into schedules that carry radically different criminal exposure, and the agency charged with applying it admits, on the record, that it is filling the void with judgment calls rather than standards.
GAO’s other finding compounds this. FDA also maintains a memorandum of understanding with the National Institute on Drug Abuse describing how the two consult on scheduling science. That MOU is over forty years old and refers to FDA offices that no longer exist. Nobody had gotten around to updating it either, until GAO asked. Both agencies confirmed to GAO that the document is out of date and needs revising, which is its own small monument to how long a stale piece of paper can sit in a federal filing system before anyone with the authority to fix it notices.
None of this is abstract. The report notes that DEA’s own request for an HHS evaluation of xylazine sat with FDA for three years before a recommendation came back, and DEA still had not finished its own review as of this spring. In the meantime the substance keeps showing up mixed into street fentanyl, and DEA has told GAO it now wants Congress to just legislate a schedule for xylazine directly, because the existing statute cannot cleanly cover the ranch hands and slaughterhouse workers who have a legitimate reason to be near the stuff. When the agency responsible for classifying a substance decides the classifying process itself does not fit the substance, the honest response is not to route around it quietly. It is to ask why the process is built the way it is in the first place, which is precisely the question GAO’s report keeps circling without ever quite being allowed to ask it directly, because GAO’s job is to audit process, not to interrogate the statute Congress wrote.
Two Recommendations and a Very Small Concession
GAO’s fix is almost aggressively modest. It asked DEA to write down its roles, responsibilities, and procedures for the four ways it schedules substances. It asked FDA to write down how staff should conduct the eight factor analysis and, specifically, how to define potential for abuse, including relative to other substances. It asked FDA and NIH to update their four decade old MOU and add a clause requiring someone to look at it again periodically. That is the entire ask. Not new authority, not a change to the statute, not even a change to who decides what. Just a request that the agencies write down what they are already doing, so the next generation of staff does not have to reinvent the standard from scratch every time someone retires.
Justice and HHS both agreed to all three recommendations, which is the part of this story that should trouble anyone paying attention rather than reassure them. HHS’s written response promises FDA will draft a new policy describing how to conduct the evaluations that determine, among other things, whether someone’s fentanyl analog carries a Schedule I sentence or no sentence at all. That policy does not exist yet. It has never existed. The system that puts people in federal prison for decades has been running, by the agencies’ own account, on trained judgment and institutional memory rather than a rule anyone could read, challenge, or hold an official accountable to. GAO did not find that DEA and FDA were reaching wrong answers. It found something quieter and, in its way, more damning: nobody can say, on paper, why the right answers were right, or whether the next official asked the same question will reach the same one.
