Introduction
Maryland cannabis operations run under one of the more actively enforced regulatory structures in the country. Since recreational legalization took effect on July 1, 2023, cultivators and licensees face dual oversight from the Maryland Cannabis Administration (MCA) — which licenses and sets operational standards — and the Alcohol, Tobacco, and Cannabis Commission (ATCC), whose Field Enforcement Division can issue citations, seize products, and refer criminal charges.
The stakes are concrete. Under COMAR 14.17.14.05, fines reach up to $10,000 per violation, with each day a violation continues treated as a separate offense. The MCA conducts both announced and unannounced inspections, meaning audit readiness must be built into daily operations, not treated as a periodic project.
This guide covers which compliance areas require formal SOPs, what those SOPs must document, and how METRC tracking obligations shape daily cultivation workflows. The goal: documentation that holds up when an inspector walks in unannounced.
Key Takeaways
- Maryland dispensaries answer to both the MCA and ATCC — two agencies with distinct enforcement authority
- Required SOPs span age verification, METRC tracking, inventory management, packaging intake, security protocols, staff training, and advertising review
- All cannabis transactions must be logged in METRC; unresolved discrepancies over 0.5% not reported within 30 days can be treated as evidence of diversion
- Camera footage must be retained for 90 calendar days and produced within 48 hours of an MCA request
- Inspection-ready SOPs include version history, role assignments, and regulatory citations
Understanding Maryland's Compliance Framework
The Dual-Regulatory Structure
The Maryland Cannabis Administration (MCA) handles licensing, registration, inspection, and testing standards for all cannabis businesses under COMAR 14.17. The Alcohol, Tobacco, and Cannabis Commission (ATCC) Field Enforcement Division focuses on illegal cannabis and intoxicating THC products — sworn officers who can issue citations, seize inventory, and destroy non-compliant products.
In practice, most day-to-day compliance runs through MCA rules. But the ATCC's enforcement authority means violations that cross into illegal distribution territory carry consequences well beyond administrative fines.
The MMCC-to-MCA Transition
HB0556/Chapter 254, approved May 3, 2023, established the MCA as an independent agency and made it the successor to the Natalie M. LaPrade Medical Cannabis Commission. Both medical and adult-use dispensary operations now fall under the same MCA framework. Registered medical patients retain certain separate designations, but all licensed dispensary obligations now route through the MCA.
Cannabis Agent Registration
That unified MCA authority extends directly to your workforce. Under ABCA §36-101 and COMAR 14.17.01.01, a cannabis agent is any employee, volunteer, or authorized person acting for a licensee. Every agent must be registered through the Maryland OneStop portal — applications are submitted by the business, not the individual.
Background check requirements include:
- Fingerprint submission to CJIS using ORI MD920525Z
- Agency Authorization Number 1500004096
- Temporary badges available for 90 days while CJIS results are pending (with a third-party background report)
- Departing agents' ID cards must be returned to MCA within 30 days
SOPs must document this onboarding requirement and maintain records of each agent's current registration status.
Core SOP Categories Every Maryland Dispensary Needs
Age Verification and Sales Limits
Maryland law requires dispensaries to sell only to adults 21 and older. Under COMAR 14.17.12.04, acceptable identification must be a physical, valid, unexpired government-issued ID containing the consumer's photo and date of birth. The MCA currently does not accept digital IDs.
Your age verification SOP must define:
- Which ID types are accepted at intake
- How staff handle edge cases (unusual formats, names that don't match)
- What happens when a customer cannot produce valid ID
Purchase limits set by Maryland Criminal Law §5-101 define the personal-use amount as:
- 1.5 oz of usable cannabis
- 12 g of concentrated cannabis
- Cannabis products containing up to 750 mg delta-9-THC
The MCA queries METRC to monitor compliance with these limits. Your SOP must define how staff use the POS system to flag limit-approaching transactions at the point of sale.
Physical and electronic security requirements are equally detailed — and equally enforceable.
Security and Access Control
COMAR 14.17.12.02 sets specific physical and electronic security requirements. SOPs must cover all of these:
- Secure inventory room — constructed of concrete or similar material, not adjacent to an exterior wall, with a single entrance and cipher or chip-activated lock
- Zone separation — movement into operations zones must be documented in tamper-evident or electronic logs
- Alarm system — must cover perimeter entry points, cannabis rooms, and record storage; requires continuous monitoring, panic alarms, smoke/fire/power-loss detection, and 48 hours of auxiliary power
- Video surveillance — motion-activated cameras covering all exits, entrances to cannabis areas, packaging/storage/dispensing areas, and curbside pickup spots
- Footage retention — recordings must be kept in high-resolution format for at least 90 calendar days
- Footage production — failure to provide requested recordings to MCA within 48 hours is a violation
Note: Specific procedures for reporting security system failures or outages are not currently confirmed in COMAR — verify directly with the MCA before finalizing outage response protocols in your SOP.
Advertising and Consumer-Facing Compliance
Cannabis advertising in Maryland is governed by COMAR 14.17.14.06 and MCA Advertising Restrictions guidance (Version 6, updated November 21, 2025). Tiered fines for repeat advertising violations within 24 months run from $1,000 to $50,000.
Your advertising SOP must address:
- TV, radio, and digital ads require a reasonable expectation that at least 85% of the audience is 21+
- The dispensary website requires a neutral age-screening mechanism (birth date entry) before access
- Staff must follow documented consultation guidelines covering permissible and prohibited claims
- All point-of-sale display materials must be reviewed against MCA guidance before being placed on the floor
Packaging, Labeling, and Product Compliance SOPs
Under ABCA §36-203.1 and COMAR 14.17.18, every product must pass an intake checklist before it reaches the sales floor. That checklist is the documented control that protects customers and satisfies ABCA inspection requirements.
What the Intake Checklist Must Verify
Packaging requirements:
- Child-resistant under 16 C.F.R. 1700.15(b)(1) and tamper-evident
- No imagery appealing to minors (no cartoons, animals, toys, candy-themed visuals)
- No resemblance to trademarked commercial food, snack, or beverage products
- No seals or insignia implying government endorsement
Required label elements:
- Finished product lot number and expiration date
- All MCA-required warning labels
- Certificate of Analysis accessible via QR code or direct link
- Dispensary name, address, and phone number
- Full cannabinoid and terpene ingredient list with weights
- MCA-approved cannabis symbol on the front of the package
Edible Product SOPs
Edible cannabis products have additional requirements under COMAR 14.17.18.05:
- THC and CBD milligrams per serving and per package
- Number of servings and clear serving size
- Nutrition facts panel or QR code
- Delayed-effects warning
- Multi-serving products must be resealable and include a measuring device
Write a separate SOP for edible product intake and display — don't fold it into the general packaging SOP, because the checklist items are distinct enough to cause confusion.
Handling Non-Compliant Products
When a product fails intake, the SOP must require:
- Quarantine the product immediately — remove it from the sales floor and hold it separately
- Document the specific compliance failure in writing
- Notify management before any further action
- Follow MCA's process for returning or disposing of non-conforming inventory
Under COMAR 14.17.14.01, recalled cannabis must be disposed of within 24 hours of Administration authorization. Build the disposal sequence directly into your non-compliant product SOP so staff can execute it without waiting for management direction.
METRC and Seed-to-Sale Tracking SOPs
All Maryland cannabis licensees — including dispensaries — are required to use METRC. The Maryland METRC licensing page confirms that prospective licensees must pass a knowledge-based test of the system as part of licensing. Passing that test once doesn't protect you going forward. New staff need documented METRC training before handling transactions independently.
What Triggers a METRC Entry
According to MCA's March 2025 Dispensary Guidance, entries are required for:
- Receiving bulk cannabis transfers
- Retail sales
- Product returns
- Disposal of green waste
- Package adjustments
- Discrepancy explanations
Your SOP must define who is responsible for each entry type and within what timeframe it must be made.
Reconciliation Requirements
MCA's Dispensary Guidance requires physical inventory at least monthly, reconciled against METRC records. The reconciliation SOP must document:
- How discrepancies are identified
- Who reviews and escalates variances
- The documentation trail for each adjustment
Unresolved discrepancies greater than 0.5% not reported within 30 days may be used as evidence of diversion. The MCA's consent order against Meshow, LLC — which cited inventory and seed-to-sale failures — resulted in a $100,000 civil penalty.
SOP Documentation Standards, Staff Training, and Audit Readiness
Minimum SOP Documentation Standard
An SOP that exists only in someone's memory isn't an SOP. Each documented procedure must include:
- Title and purpose — what the SOP governs and why
- Regulatory authority — the specific COMAR section or statute it maps to
- Step-by-step procedures — written clearly enough that any trained staff member can execute them
- Responsible roles — who owns each step
- Version and revision history — date of last update and what changed
Under COMAR 14.17.14.02, records including production logs, test results, and visitor logs must be retained for 2 years, with a duplicate set at a secure off-site location.
Staff Training Documentation
Training records must capture:
- Which SOPs each employee was trained on
- Date of training and trainer's name
- Employee signature or digital acknowledgment
These logs must be available immediately during MCA inspections. Failure to provide access to premises or records can result in fines or license revocation.
SOP Review Cadence
Assign a compliance owner to monitor MCA's Laws, Regulations and Reports page and trigger revisions when:
- The MCA or ATCC issues new regulations or guidance
- An inspection finding reveals a gap
- Annually, at minimum
What Audit Readiness Looks Like
Your compliance binder — physical or digital — should be organized to produce any document within minutes. It needs to contain:
- Current versions of all SOPs with revision history
- Staff training logs
- METRC reconciliation records
- Security system documentation
- Agent registration records
- Product testing records and COAs
For vertically integrated Maryland operations that both cultivate and dispense, the cultivation side carries its own SOP burden: managing grow schedules, treatment protocols, and harvest tracking across teams. Tools like PlanaCan let cultivation teams build version-controlled, timestamped workflow templates and deploy them across grow cycles, creating records that hold up during MCA audits.
PlanaCan sits at the cultivation operations layer. It complements METRC rather than replacing it, feeding structured documentation upstream into the broader seed-to-sale compliance record.
Frequently Asked Questions
What is cannabis compliance and administration?
Cannabis compliance refers to operating a cannabis business in accordance with all applicable state laws and regulations. In Maryland, "administration" refers to the Maryland Cannabis Administration (MCA): the agency responsible for licensing, regulation, testing standards, and oversight of all cannabis businesses in the state.
What does MMCC in Maryland regulate?
The MMCC (Maryland Medical Cannabis Commission) was Maryland's original medical cannabis regulator. Following recreational legalization, HB0556/Chapter 254 transitioned the MMCC into the current MCA in May 2023.
What SOPs are required for Maryland cannabis dispensaries?
The MCA does not publish a single mandated SOP list, but dispensaries are expected to have documented procedures covering age verification, METRC tracking, inventory management, packaging and labeling intake, security protocols, staff training, and advertising review to demonstrate compliance during inspections.
What happens if a Maryland dispensary fails a compliance inspection?
Consequences range from a formal citation and fine to license suspension or revocation, depending on severity. Non-compliant products can be seized and destroyed by the ATCC's Field Enforcement Division. Licensees must respond to corrective action demands and pay fines within 10 business days of a non-compliance letter.
How often should Maryland dispensaries update their SOPs?
Review SOPs whenever the MCA or ATCC issues new regulations, after any inspection that identifies a compliance gap, and at minimum once per year. Designating a compliance owner to monitor MCA updates keeps this process consistent.
Does Maryland require cannabis dispensaries to use METRC?
Yes — all Maryland cannabis licensees are required to use METRC for seed-to-sale tracking. Dispensary staff must also pass a METRC knowledge test as part of the licensing process, so documented METRC training procedures are an essential SOP for every new hire who handles transactions.
