The U.S. legal cannabis industry has been booming as more states legalize medical and/or recreational use. In its U.S. Cannabis Report 2019 Industry Outlook, cannabis research firm New Frontier Data found that total legal sales will have a compound annual growth rate of 14% in the next six years, totaling almost $30 billion in 2025.
But with this growth comes serious operational risks throughout the industry. Cannabis businesses need to ensure that they are complying with relevant regulations and that consumers are getting a safe product and accurate information when making a purchase. However, the complex regulatory landscape and relatively uncharted territory of legal cannabis make compliance significantly more difficult than in other industries.
As of January 1, when legalization officially went into effect in Illinois, cannabis was legal for recreational and medical use in 11 states, while 33 states and Washington, D.C., have legalized cannabis solely for medical use. However, the federal government still classifies marijuana as a Schedule I drug, putting legalization on legally shaky ground and leaving states to sketch out their own regulatory frameworks.
Regulations and Violations
Cannabis industry regulations address every aspect of the “seed-to-sale” process, including growing, dispensing, lab testing and marketing. They are also inconsistent from state to state. For example, Colorado, Washington, Oregon and Alaska all prohibit using cartoon characters to market cannabis products, but unlike the other three states, Colorado does not require health warnings on advertisements. Likewise, of those four states, only Colorado and Oregon prohibit products containing additives like nicotine and alcohol.
Product testing requirements also vary wildly between states, and often are implemented or strengthened after product recalls. According to cannabis information website Leafly, Colorado requires that cultivators submit their products for testing for potency and numerous contaminants and conditions, including fungi and pesticides. Alaska does random testing of products, screening for contaminants as well as potency. Other states, like Connecticut, mandate only self-policed testing by producers. Arizona does not currently require any testing, but recently decided to start mandatory testing in November 2020.
Falling afoul of regulators can have major consequences for legal cannabis producers and the businesses that depend on them, including supply chain disruption and reputation damage. Violations can mean hefty fines as well as the risk of losing licenses—a significant sunk cost totaling tens of thousands of dollars in some states.
Dispensaries are routinely fined for violations. In 2019, Massachusetts cannabis company Cultivate agreed to pay a $75,000 fine after a surprise inspection showed 3,000 improperly labeled products. The products examined reportedly did not include required labels stating that they contained THC, that they were not safe for children, or showing serving size, identification numbers and directions for use.
Labs also face tough consequences for not meeting regulatory requirements. In November, a Nevada lab was closed after the state accused it of inflating THC level results by up to 10%, as well as failing to maintain adequate security surveillance, and not keeping seed-to-sale product tracking or waste logs. The lab settled the suit, paid $70,000 and reopened, avoiding the $107,500 fine and license revocation the state originally threatened. The same lab was previously closed in December 2017 for similar violations, which the owners blamed on confusion over relatively new regulations. In 2018, after discovering that a California-based lab falsified its pesticide test results for four months, the state revoked the lab’s business license and told 29 companies to recall cannabis products, reportedly costing those businesses tens of millions of dollars in sales.
Quality control also poses risks for cannabis businesses. In November, Colorado warned consumers that several batches of medical and recreational cannabis were contaminated. The state’s Department of Public Health and Environment blamed the “microbial contamination” on a computerized tracking system called Metrc, which a dozen states use to track legal cannabis. Similarly, in February, Nevada’s Department of Taxation warned the public about 20 cannabis products it said were contaminated with various types of mold or bacteria. In this case, the state blamed a Las Vegas lab for failing to catch the contaminations and advised consumers not to purchase the affected products.
Nikolas Komyati, who advises cannabis industry clients as a principal at Bressler, Amery & Ross, noted that cannabis businesses face the risk of being labeled a “bad producer” for any type of mishap or scandal, which will “tarnish your brand forever.” He explained, “You don’t want to be seen as low-brow. You can work to get the license, you can do everything, and then one bad thing in the paper and people are going to steer clear of your product.”
As legalization expands, Komyati predicted, “you are going to see more uniformity among states as far as what the controls are, and I think that you are going to see more of a move towards everything being FDA compliant.” He recommended that cannabis businesses strive for “compliance-plus,” doing more than the bare minimum to ensure that they are not playing catch-up with regard to regulations.
Standardization of compliance rules is inevitable for the cannabis industry, according to Rocco Petrilli, board chair and COO of the 2,500-member National Cannabis Risk Management Association. However, he stressed that this standardization would be better coming from the industry itself, rather than the federal government. “On the surface, a governing body at the federal level and a national standard for quality all make a lot of sense, as long as it’s executed properly,” Petrilli said. “I just don’t have a lot of confidence that it would be at this point.” He said many cannabis business owners fear over-regulation, which could cut profits and increase prices, driving customers back to the black market.
Managing the Risks
Testing products can significantly help manage operational risks. Komyati stressed “making sure that your facilities don’t have mice, mildew and mold, and that your product is not tainted.” He added, “It’s not intended to be any kind of burden on the industry or the producer, but it’s really intended to be something that ensures that the customer is getting exactly what they’re supposed to be.”
Additionally, Petrilli emphasized the importance of independent product testing, recommending that businesses “always have testing done outside of your internal quality control with accredited laboratories, because it creates gospel in terms of being able to defend your product.”
Because of the variations among state regulations and the possibility of national regulations in the future, cannabis businesses may want to hold themselves to higher standards than their home state mandates. One way to do this is to enlist compliance experts from the pharmaceutical industry, given the comparable product safety and FDA requirements in that sector.
For Jason Thomas, CEO of Precision Quality & Compliance, a multi-state cannabis quality control, audit and risk management organization, compliance is a much bigger issue than ensuring the product is safe and the supply chain transparent. “It really goes through the entire value chain, because quality control goes beyond the supply chain, like a third party managing your data somewhere. Your quality process is really only as strong as its weakest link.” Addressing these risks can include general risk management practices, like providing adequate training and institutional knowledge to staff, implementing systems to prevent disgruntled employees from contaminating products, and ensuring that a business’s IT infrastructure, including that of third-party partners, is safe and secure.