Dispensary Compliance Checklist for POS, Kiosks, and Inventory

Most operators think about dispensary compliance as licensing paperwork. The application, the renewals, the annual fees, the state forms with deadlines.

That part is the floor. The real risk shows up after the doors open.

Daily compliance runs through every system in the building. ID scanners. Staff permissions. Inventory sync. POS settings. Kiosk workflows. Cash handling. Audit logs. Exception reporting. When those systems drift out of alignment with current regulations, regulators see a violation, not a configuration problem.

What follows is a checklist for the operational side of dispensary compliance, organized by the systems where daily risk shows up. A summary checklist appears at the end for quick reference.

One scope note before going further: this is not legal advice. State regulations vary and change frequently, and federal cannabis policy is in active flux. The checklist below is a starting point for an internal review, not a legal opinion. Work with cannabis counsel in your state for questions about specific obligations.

For Dispensify’s view on compliance support, see our compliance page.

What dispensary compliance means day to day

Dispensary compliance is the operational discipline of running a cannabis retail business in line with state regulatory requirements. It has two sides.

One side is regulatory: the license, the renewals, the state forms, the registrations. That’s the visible compliance, the one operators think about when the topic comes up.

The other side is operational, and most enforcement actions originate here. Operational compliance is the daily practice of running a dispensary in a way that produces clean records, defensible audit trails, and configurations that match current regulations. It shows up in three categories of risk.

Product risk. Inventory tracking, traceability, package tags, batch records, lab result associations, and the integrity of the seed-to-sale handoff. When state regulators audit a dispensary, the first thing they reconcile is product. If physical inventory does not match the system of record, the operator has a problem regardless of why it happened.

People risk. Age verification at the door and at the point of sale, staff permissions, override authorities, training records, and the audit trail of who did what and when. Most enforcement actions involving people are not about deliberate misconduct. They are about the absence of documentation that would prove the right thing happened.

Money risk. Cash handling, payment documentation, reconciliation, and the paper trail that ties every dollar to a transaction. Federal banking access remains limited for most cannabis operators despite recent rescheduling activity, which means documentation is the primary defense against ambiguity.

Regulators inspect systems and records, not intentions. A dispensary that intended to verify every customer’s ID but cannot produce the scanned records is in the same position as a dispensary that never bothered. The audit looks the same.

Violations rarely come from deliberate non-compliance. They come from configuration drift. A POS gets set up correctly three years ago. The regulations change. Staff turn over. The original administrator leaves. Nobody updates the receipt format or the tax line items or the age verification thresholds. The system keeps running, the operator keeps selling, and the violation sits in the configuration for two years before an inspector finds it.

“The dispensaries that get hit hardest in audits are not the ones cutting corners. They are the operators who stood up their POS three years ago and never touched the configuration when the rules changed in New York, Missouri, or Michigan. The system kept running. Nobody noticed until the state did.”
— Gio, Dispensify

Compliance debt builds the way technical debt builds. Small misalignments compound. The fix is regular review, clear ownership, and systems designed to make the right behavior easier than the wrong one.

ID verification and age-gate workflows

Age verification is the most visible compliance failure mode in a dispensary. An inspector can walk in with an undercover buyer and know within minutes whether it works.

Every state requires age verification at point of sale. Most states require it at the door. Mechanics vary by state; the principle does not. On every transaction, the dispensary has to demonstrate that the customer was verified.

Manual verification breaks down at scale. Staff get rushed during peak hours. Fake IDs keep getting better. A tired cashier on Saturday night is a thin defense, and manual checks produce nothing for an auditor to review. If a regulator asks for proof that a specific transaction was verified, “the cashier looked at the ID” is not an answer.

ID scanner integration with the POS creates an audit trail. Every scan generates a record: timestamp, ID validity, staff member who completed the verification, and the transaction tied to the verification. When an inspector asks for proof, the answer is a query, not a story.

Self-service requires the same verification rigor, often more. Dispensary kiosks do not relax the requirement. They tighten it. A kiosk transaction without a verified, recorded ID scan is a transaction without compliance coverage, and it is harder to defend than a counter sale because no human was in the loop to confirm the check happened.

What to document on every verification:

ID scan timestamp
Staff member responsible for the verification
Result of the validity check
Transaction ID tied to the verification record
Any exceptions or overrides, and who authorized them

Exception logging matters as much as the verification itself. When something does not go through the normal workflow, the record of why is what protects the operator.

POS setup and role-based permissions

If one system makes or breaks operational compliance, it’s the POS. Most violations in inspections trace back to POS configuration. Permissions too loose. Receipt formats out of date. Override authorities that were never scoped. Discount rules nobody documented.

Role-based access control is the foundation. Cashiers, managers, inventory staff, and owners need different permissions, and those permissions need to map to actual responsibilities. A cashier should not be able to void a transaction without manager approval. A manager should not be able to adjust inventory without an audit log entry. An inventory clerk should not be able to issue refunds. These are compliance primitives, not technical preferences.

The audit question regulators ask is some version of: “Show me who authorized this transaction.” If the answer is “I think it was Jen, she was on that night,” the dispensary has a problem. If the answer is a system record showing Jen’s user ID, the timestamp, the override reason, and the approving manager, the dispensary has a defense.

Permissions that need explicit scoping in a cannabis POS system:

Void and refund authorities. Who can void a transaction in progress, who can issue a refund after the fact, and what level of supervisor approval is required at each threshold
Discount limits. Maximum discount percentage by role, with manager override required above the threshold
Inventory adjustments. Who can change inventory counts manually, what reason codes are required, and what records the system generates
Cash drop and reconciliation. Who can perform cash drops, who can close out registers, and what two-person verification applies at higher thresholds
After-hours access. Who can log in outside operating hours, and what exception reporting fires when they do

Override logs are audit evidence. Every time the normal workflow gets bypassed, the system needs to record what happened, who did it, and why. An override without documentation is worse than no override at all because it shows the dispensary had the capability and chose not to use it.

Receipt format requirements vary significantly by state. License numbers, tax line item breakouts, customer verification references. A cannabis POS system configured for one state’s receipt requirements is not automatically compliant in another. When operators expand, or when regulations change, the receipt template is one of the easiest configurations to overlook and one of the easiest violations for an inspector to find.

A diagnostic for any operator: pull a receipt from yesterday’s sales. Compare it line by line against current state requirements. Anything missing means the dispensary has been generating non-compliant receipts on every transaction since the last update.

Inventory tracking and seed-to-sale handoff

Inventory is the highest-stakes compliance domain in a dispensary. Variances are the fastest path to a license review, and the standard regulators apply is unforgiving: if the physical product does not match the system of record, the burden is on the operator to prove the difference is not diversion.

Seed-to-sale tracking is the regulatory requirement that every gram of cannabis be traceable from cultivation through processing through retail sale. It’s a regulatory frame, not a product feature. The dispensary is the last link in the chain and is responsible for closing out the trace accurately on every transaction.

Most states require dispensaries to report into a state traceability system. Metrc is the most widely deployed, used in more than 20 state and territorial markets. Other systems in operation include BioTrack (now part of Dutchie) and state-built alternatives such as Leaf Data Systems in Washington. The systems vary; the underlying requirement does not. State migrations between platforms are an active part of the landscape: New York moved from BioTrack to Metrc in early 2026, and similar transitions are likely as markets mature.

The integration question to ask any POS vendor is not “do you connect to Metrc.” It’s “how do you handle the edge cases.” The clean sale is easy. The hard cases are where compliance breaks down: partial package splits, manifest corrections, returned product, lab result associations that need updating after sale, reconciliation when the state system goes down, weight-based deductions on flower, and what happens when a scanned package tag does not match the expected record.

Daily inventory reconciliation is a compliance practice, not a back-office chore. Cadence depends on volume. The principle does not. Every day, the physical count of high-value SKUs should be reconciled against the system count, and any variance should be documented with a reason code before it ages into ambiguity.

Shrinkage looks like diversion to a regulator until proven otherwise. A few units missing from an end-of-month count, without documentation, is not a small bookkeeping error to the state. It’s a gap in the seed-to-sale chain. The defense is the daily reconciliation record showing when the variance appeared and what was investigated.

Package tags and batch tracking deserve specific attention. Every package coming into the dispensary has a unique identifier that must be tracked through every transaction touching it. When a one-pound bag of flower gets broken down into eighths, every eighth still ties back to the parent package, and the lab results follow the product to the customer. POS systems that handle this well make the chain invisible to the cashier. Systems that handle it poorly create manual workarounds, and manual workarounds are where compliance fails.

Dispensary menu and POS integrations are the connective tissue between the dispensary’s commercial systems and the regulatory layer. The dispensary that gets cannabis inventory management right has clean records running from receiving through sale through reporting, with no manual handoffs and no orphaned data.

The dispensary that gets it wrong has a spreadsheet somewhere.

When dedicated inventory automation makes sense

Operators with existing inventory management systems they trust can absolutely run a compliant operation through POS-native tools and disciplined daily reconciliation. The systems and the discipline matter more than any specific vendor.

For dispensaries that want an additional automation layer on the inventory side, Dispensify’s kiosk and POS solutions can work alongside dedicated inventory platforms like Cloudbox. Cloudbox is weight-based inventory automation: its Smart Container technology connects to standard scales, automatically captures weight as product moves, and syncs with state traceability systems like Metrc and BioTrack. The use case is straightforward for operators with high cycle-count volume or recurring reconciliation pain: continuous weight-based counting reduces the manual work that produces most inventory variances.

Whether that level of automation is the right fit depends on the operation. Smaller dispensaries with tight inventory discipline often do not need it. Larger operators, multi-location stores, or any dispensary where cycle counts are pulling staff time away from customers tend to see the value sooner. The point is that the inventory layer can be configured to match the operation, not the other way around.

Kiosk checkout controls and staff oversight

Self-service kiosks are one of the fastest-growing categories in dispensary retail, and one of the most poorly understood from a compliance perspective. Operators often treat kiosks as a labor-saving convenience. Regulators treat them as staffed point-of-sale terminals that happen to allow customer-initiated transactions. The staffing requirement does not disappear when the touchscreen appears.

Self-service does not mean unsupervised. Every state that allows dispensary kiosks attaches conditions, and those conditions almost always include staff oversight at the transaction level. Age verification, purchase limits, and restricted product gating all need explicit staff approval workflows built into the kiosk software. A kiosk that lets a customer complete a transaction without those gates is not a kiosk configured for compliance.

Kiosk controls operators need to verify:

Age verification at the device. ID scanning, validity checking, and a verified record tied to the transaction before product is dispensed
Per-transaction purchase limits enforced by the kiosk itself. Posted signage at the register is not enforcement. The kiosk has to block the over-limit transaction in software, not rely on the customer to add correctly
Staff approval gates for flagged transactions. Restricted products, high-value baskets, or any transaction crossing a configurable threshold should route to a staff member for approval before completion
Real-time inventory deduction. Kiosk transactions must hit inventory the same way counter transactions do, with no batch-write delay that could create temporary phantom stock
Camera coverage tied to transaction records. Audit defense for a self-service transaction is significantly stronger when video records can be pulled by transaction ID

Many operators treat self-service kiosks like vending machines. They aren’t. A vending machine sells gum. A dispensary kiosk sells a regulated cannabis product under state oversight, and every transaction needs to meet the same compliance standard as a counter sale.

The compliance question is not “did the kiosk make the sale.” It’s “can the operator produce, for any kiosk transaction in the last three years, the verified ID, the staff member responsible for oversight, the inventory deduction record, the receipt, and the video coverage.” Anything other than yes means the kiosk is generating compliance exposure on every transaction.

Payment and cash-handling documentation

Cannabis is in the middle of a major federal policy shift. A December 2025 executive order directed expedited rescheduling from Schedule I to Schedule III, and DOJ has begun reclassifying state-regulated medical cannabis and FDA-approved cannabis products. Recreational cannabis remains on the rulemaking path. Rescheduling does not, on its own, resolve the banking access problem. Most national banks still will not provide standard accounts or merchant services to dispensaries because federal safe-harbor legislation like the SAFER Banking Act has not passed, and FinCEN’s cannabis guidance is more than a decade old. Cash and ACH workarounds remain the dominant payment mechanisms in cannabis retail, with ACH adoption growing significantly as operators move away from cash-only models.

The compliance principle for cash and ACH alike is simple to state and hard to execute: every dollar that enters or leaves the dispensary needs documentation that ties it to a transaction, a person, and a timestamp. Documentation is the only defense against ambiguity, and ambiguity is the regulator’s invitation to investigate further.

Cash documentation requirements that need explicit procedures:

Cash drops from the register. Frequency, threshold amounts, two-person verification at higher thresholds, and the document trail that ties each drop to the cashier, the manager, and the safe
End-of-shift counts. Reconciliation between POS reported totals and physical cash on hand, with documented variance investigation for any discrepancy above the materiality threshold
Deposit preparation and transport. Who counts, who verifies, who transports, and the chain of custody from the safe to the bank or armored carrier
Customer payment records. Receipt copies, payment method documentation, and the transaction ID that links every dollar back to a specific sale

ACH and cashless ATM workarounds carry their own compliance considerations. Pin-debit routing, ACH bank-to-bank transfers, and various banking workarounds operate in a regulatory landscape that varies by state and processor. The operational requirement is the same regardless of mechanism: documented procedures, consistent execution, audit-ready records.

Reconciliation between POS totals and physical cash is the daily checkpoint. A dispensary running this every day, documenting variances, and investigating anything material operates from a defensible position. A dispensary that does this weekly, monthly, or only when something looks wrong is generating compliance exposure with every shift.

Two-person verification on high-value cash movements is not a luxury control. It’s an internal check that protects both the operator and the staff. When two people sign off on a deposit, neither one is in a position to be wrongly accused if a discrepancy surfaces later. The verification is for everyone’s protection.

Audit trails, reporting, and exception review

An audit-ready operation is not a dispensary that scrambles when a regulator calls. It’s a dispensary that runs daily exception reports and reviews them as part of normal management practice, so audit-ready is just the day-to-day posture.

Exception review is a managerial function, not an IT function. The systems generate the reports. The manager owns the review. When that ownership is unclear, reports get generated and nobody reads them, which is functionally the same as not generating them at all.

Exception categories that need defined review processes:

Voids and refunds. Frequency, who authorized each one, what reason codes were applied, and whether the pattern suggests training issues, equipment problems, or something worse
Manual overrides. Any time the normal workflow was bypassed: discount overrides, permission overrides, manual inventory adjustments, and who approved them
After-hours transactions. Any system activity outside standard operating hours, including logins, register openings, and inventory changes
Large cash movements. Movements above a configurable threshold, with documented investigation for anything unusual
Inventory adjustments. Manual changes to count, transfers between locations, and any variance correction that did not come from a documented physical recount

Access logs deserve their own category. Every system action tied to a user account leaves a record, and those records are what allow a manager to reconstruct what happened during any given shift. When access logs are absent, intermittent, or unreviewable, the dispensary loses its most basic audit defense. The right setup makes logs available, searchable by user and time range, and accessible to the operator without requiring a vendor support ticket.

Review cadence depends on volume. High-volume stores need daily review of high-risk categories. Lower-volume stores can run weekly review on most categories with daily review on cash and inventory. The principle holds either way: review needs to happen on a schedule, with documented signoff, before anomalies have time to age into a pattern.

Retention policy is often overlooked until it surfaces in an audit. State requirements vary, but most states require dispensaries to retain transaction records for several years, with some categories requiring longer. The retention requirement applies to every record regulators might ask for: transactions, ID verifications, override logs, inventory adjustments, cash counts, reconciliations. A dispensary that purges records on a 12-month rolling cycle to save storage is generating a compliance gap that will surface the first time a regulator asks for older records. Operators should confirm their state’s specific retention rules with counsel.

A diagnostic: pick a random transaction from six months ago. How long does it take to produce the full record, including the verification, the inventory deduction, the receipt, the staff member who completed it, and any exceptions logged against it? More than five minutes means the records architecture needs attention.

For an operational view of how compliance workflow support works in a B2B context, Dispensify provides systems-level configuration that produces audit-ready records by default rather than as a reporting layer added on top.

Audit readiness isn’t something a dispensary turns on when a regulator calls. It’s a daily operating posture.

Configuring your tech stack for multi-state operations

Multi-state operations introduce a category of compliance complexity that single-state dispensaries do not have to think about. The same product, sold the same way, by the same company, can be compliant in one state and non-compliant in the state next door because the underlying systems were configured for the wrong jurisdiction.

Many operators expanding for the first time assume a national POS works the same way in every state. The software might be the same. The configuration is not.

What multi-state configuration actually requires:

Per-state product taxonomies. Product categories that exist in one state may not exist in another. Edibles classifications, concentrate categories, and pre-roll groupings often need per-state mapping
Per-state tax engines. Excise taxes, sales taxes, and locally administered cannabis taxes vary by state and frequently by jurisdiction within a state. The tax engine has to be configured per location, not per company
Per-state reporting templates. State traceability systems use different report formats, and some states change platforms over time (as New York did when moving from BioTrack to Metrc in early 2026). The export from the POS has to match what the receiving system expects, and that mapping is per state
Per-state user permission overlays. Some states impose specific operational requirements on who can perform certain actions: two-person verification on certain transactions, manager approval on specific overrides, designated compliance officer signoffs. The permission structure has to absorb these without breaking the underlying role architecture
Per-state age verification thresholds and required ID types. Adult-use and medical thresholds vary, and the verification mechanism and acceptable ID types vary too. The kiosk and POS configuration needs to match each jurisdiction
Per-state receipt requirements. Required line items, required disclosures, and required identifiers vary significantly

Centralized reporting is the upside of getting this right. An operator who configures the stack correctly can run consolidated reports across all locations while each location stays compliant with its own state requirements. An operator who configures poorly has compliance gaps in some locations and reporting nightmares everywhere.

For operators planning an expansion, technology setup for opening a dispensary in a new state involves more than provisioning the same software in a new location. It involves a configuration review against the new state’s requirements, a test transaction protocol that exercises the compliance edges, and a documented configuration baseline that can be audited later.

Red flags that your tech stack is creating compliance drag

Compliance problems rarely announce themselves. They surface as small inefficiencies, manual workarounds, and patterns staff have learned to live with. The list below names red flags that suggest a dispensary’s technology is generating compliance exposure rather than reducing it.

Inventory counts that never quite reconcile. End-of-month variances that “always have a few units off” signal something broken in the inventory workflow. The variance might be small, but the audit position is the same as a large variance: the operator cannot account for the difference.
Manual workarounds for ID verification. “The scanner is broken, we eyeball it for now” is one of the most common compliance gaps in dispensary retail. The workaround usually starts as a temporary measure and becomes the default.
Staff sharing logins or operating under a single shared account. When transactions cannot be tied to specific staff members, the audit trail is broken at its foundation.
POS receipts missing required state line items. Tax breakouts, license numbers, customer reference IDs, and required disclosures that have fallen out of the receipt template, usually after a software update or regulation change that nobody applied to the configuration.
No clear retention policy for transaction records. Records archived to local storage with no documented retention rule, or records purged on a rolling cycle that does not match the state requirement.
Exception reports that no one reviews. The system generates the reports. They land in an inbox or a folder. Nobody reads them. Compliance value is zero unless someone is reviewing the output on a documented cadence.
Kiosk transactions not tied to a specific staff member. Every kiosk transaction should have a staff member of record for oversight purposes. When the system does not capture this, the audit defense for kiosk sales weakens.
Cash counts that do not get documented daily. End-of-shift counts that are performed but not documented, or documented in handwritten logs that are not retained, leave a daily gap in the financial audit trail.
Traceability submissions that miss deadlines or require manual fixing. State system submissions that routinely require manual correction are a sign that the underlying integration is generating errors the operator has learned to clean up rather than prevent.
Vendor support that cannot answer compliance configuration questions. When operators ask their POS vendor about compliance configuration and the answer is “you should talk to your compliance officer about that,” the vendor is not equipped to support the operator’s regulatory obligations. The vendor does not have to provide legal advice, but they should be able to answer questions about how their own software handles specific regulatory requirements.

A dispensary recognizing more than two or three of these patterns has compliance debt accumulating in the systems. The fix is not necessarily replacing the POS. The fix is identifying the specific gaps, documenting them, and addressing them in priority order.

The systems-level compliance checklist

For operators who want a quick self-assessment, the questions below cover the operational layer of dispensary compliance. A defensible operation should answer yes to most of these.

Permissions and access

Role-based permissions are reviewed and intentionally structured
Staff members operate under unique logins, not shared accounts
Access logs are available, searchable, and reviewed on a documented cadence

Customer verification

ID verification is integrated into the transaction workflow at both counter and kiosk
Every verification produces a record tied to a specific transaction
Manual workarounds for verification have been eliminated

POS and receipts

Receipt templates match current state requirements line by line
Override authorities are scoped explicitly and logged when used
Discount and refund limits are enforced in software, not policy

Inventory and traceability

Inventory is reconciled against system records on a documented cadence
Variances are investigated with reason codes before they age out
Package tags and lab results travel with product through every transaction
State traceability submissions clear without manual correction

Kiosks

Every kiosk transaction has a staff member of record for oversight
Purchase limits are enforced in software at the device
Camera coverage can be pulled by transaction ID

Cash and payments

End-of-shift counts are documented daily and retained
High-value cash movements require two-person verification
Reconciliation between POS and physical cash happens every shift

Audit readiness

Any transaction from the last three years can be reconstructed in under five minutes
Exception reports are reviewed on a documented schedule with signoff
Records retention matches or exceeds state requirements
Multi-state configurations can be maintained without ad hoc workarounds

This isn’t a replacement for legal review. It’s a way to evaluate whether the systems behind the operation are supporting compliance or making it harder than it needs to be.

When to bring in Dispensify

Dispensify is a B2B technology partner for dispensaries. The product line covers point-of-sale systems, self-service kiosks, IT infrastructure, integrations, and turnkey technology setup for new operations. The compliance pitch is operational, not legal: Dispensify builds systems that support compliance workflows, audit trails, and operational controls. Compliance officers and cannabis attorneys handle the regulatory work. Dispensify handles the systems that make their work possible.

Operators come to Dispensify in a handful of situations. Opening a new dispensary and configuring the technology stack from scratch. Expanding into a new state and needing multi-state configuration handled right the first time. Replacing a POS that’s creating compliance drag. Adding kiosks to an existing operation. Each is a moment where the systems decisions made now will shape the audit posture three years from now.

“Compliance lives in the stack. The license and the legal questions belong to other people. Our job is to make sure the POS, the inventory system, and the reporting layer aren’t quietly working against retail operators.”
— Gio, Dispensify

For operators who want a clearer view of where their current setup may be creating risk or inefficiency, request a Dispensify demo and walk through the configuration with the team.

Frequently asked questions

What is dispensary compliance?

Dispensary compliance is the operational discipline of running a cannabis retail business in line with state regulatory requirements. It covers regulatory compliance (licensing, registrations, state filings) and operational compliance (ID verification, inventory tracking, POS configuration, audit trails, cash handling, reporting). Most enforcement actions originate in operational compliance rather than licensing issues, because operational compliance is a daily practice running through every system in the dispensary while regulatory compliance is largely an annual cycle.

How does POS software support dispensary compliance?

POS software supports dispensary compliance through specific mechanisms: role-based access control that limits actions by staff role, override logs that document every bypass of the normal workflow, transaction records that tie every sale to a specific staff member and time, configurable receipt templates that meet state-specific requirements, inventory deduction that maintains traceability through every sale, and exception reporting that surfaces unusual patterns for management review. A cannabis POS system configured correctly produces audit-ready records as a byproduct of normal operations rather than requiring separate compliance reporting work.

What is seed-to-sale tracking?

Seed-to-sale tracking is the regulatory requirement that every gram of cannabis be traceable from cultivation through processing through retail sale. Most states implement seed-to-sale through a state traceability system. Metrc is the most widely deployed, currently used in more than 20 state and territorial markets. Other systems include BioTrack (now part of Dutchie) and state-built alternatives such as Leaf Data Systems in Washington. The dispensary is the final link in the chain, so the dispensary is responsible for accurately closing out the trace on every transaction through package tag scanning, weight-based deductions, and reconciliation with the state system.

Do dispensary kiosks need compliance controls?

Yes. Dispensary kiosks require compliance controls equivalent to or more rigorous than counter-based transactions. Every kiosk transaction needs age verification at the device, per-transaction purchase limits enforced in software, staff approval gates for flagged transactions, real-time inventory deduction, and audit records that tie the transaction to a verified ID, an oversight staff member, and supporting documentation. The regulatory standard for a kiosk sale is the same standard that applies to a counter sale. Kiosks are staffed point-of-sale terminals with customer-initiated workflows, not unattended vending machines.

Is this article legal advice?

No. This article describes operational and systems-level practices that support compliance workflows. It is not legal advice, and it is not a substitute for working with a licensed cannabis attorney or qualified compliance officer in the operator’s specific state. State regulations vary, change frequently, and apply in ways that depend on the specific facts of an operator’s business. Federal cannabis policy is also in active flux as of mid-2026. For questions about specific regulatory obligations, operators should consult counsel who specializes in cannabis law in their jurisdiction.