Colorado cannabis compliance, end to end.

How the Colorado program is structured

Colorado was the first US state to legalize adult-use cannabis sales, with retail launching January 1, 2014 under Amendment 64. The program built on a medical framework that had been live since Amendment 20 passed in 2000, which means the regulator — the Marijuana Enforcement Division (MED), housed within the Colorado Department of Revenue — has more than two decades of regulatory experience and roughly a decade of adult-use enforcement history.

That maturity matters for how operators approach compliance. MED is not a young regulator finding its feet; the rulebook at 1 CCR 212-3 is comprehensive, the inspector workforce is experienced, and the enforcement schedule is well-documented. Operators coming from younger markets often underestimate how detailed Colorado's expectations are. Operators coming from California's regulatory upheaval often appreciate the relative stability — but stability also means inspectors expect long-tenured operators to have their compliance posture in order.

The licensing framework spans roughly eleven distinct categories across the adult-use and medical programs, with parallel medical licenses for cultivation, products manufacturing, retail, transportation, and testing. Many vertically-integrated operators hold both medical and retail licenses at the same physical site, which creates compliance complexity around segregating inventory, separating METRC tracking, and maintaining program-specific SOPs.

What MED inspectors actually check

A Colorado MED inspection covers a broader surface than checklist-driven inspections in some other states because MED has a decade of enforcement-pattern data to draw on. Inspectors arrive with prior findings, METRC inventory data, filed security and SOP submissions, occupational-licensee badge records, and any open complaints — and the on-site visit verifies that the regulatory record matches what's actually happening.

Concrete focus areas:

• METRC inventory integrity. Inspectors will pull a sample of recent transactions and walk them backward through METRC, comparing tag movement, weight discrepancies, and timing against physical inventory. Colorado was the first METRC state and the enforcement around tracking discrepancies is among the most rigorous in the country. The investigation trail for any discrepancy matters as much as the discrepancy itself.
• Camera coverage and retention. Coverage of every required area (entrances, exits, point-of-sale, all cannabis-handling zones) plus the 40-day minimum retention is routinely checked. Cameras with blind spots over critical areas — vault, sales floor exits, packaging stations — are a top citation category and typically carry follow-up re-inspection.
• Filed SOPs vs. observed practice. MED inspectors compare your filed SOPs against what they observe on the floor. Where the SOP says one thing and staff is doing another, the citation is for failure to follow filed procedures, not just for the operational deviation. Stale SOPs that haven't been updated to reflect current practice are a quiet but compounding citation source.
• Occupational licensee badges. Every employee performing regulated work must hold a current MED Key Badge or Support Badge. Expired or missing badges are checked at every inspection and trigger immediate operational restrictions for the affected employees.
• Pre-retail testing compliance. Inspectors verify that retail-bound inventory has corresponding COAs from MED-licensed testing facilities, and that the testing happened in the correct sequence per 1 CCR 212-3.1500. Untested inventory found in retail-ready locations is grounds for embargo and mandatory destruction.
• Packaging and labeling. Random product samples are inspected against 1 CCR 212-3.1000 — child-resistance, mandated warnings, lab result references, font-size minimums, THC content disclosure. Non-compliant inventory can be embargoed pending relabeling.
• Hazardous waste handling. Solvent-based extraction byproducts and pesticide containers are subject to 6 CCR 1007-3 hazardous waste rules administered by CDPHE. MED inspectors flag improper segregation and disposal — these findings typically result in CDPHE coordination plus significant remediation costs.

The pattern: a Colorado inspection looks for whether your systems produce the documentation an inspection requires, on the day of the inspection, without scrambling. After a decade of enforcement, MED knows what last-minute prep looks like — and they know what a well-run program looks like too.

Common violations and how to prevent them

Five categories produce the majority of MED citations:

1. METRC discrepancies. Daily inventory counts reconciled to METRC, with discrepancies investigated and documented within 24 hours. The citation isn't usually about the discrepancy itself; it's about the absence of an investigation trail. Variance thresholds and documented investigations are the citation defense.
2. Camera coverage gaps and retention failures. Monthly self-audits against the filed security plan, with documented camera-functionality checks and retention verification. The 40-day floor is a minimum — incident-related footage requires significantly longer retention.
3. Packaging and labeling failures. Vendor-supplied labels still need licensee verification — passing the citation back to the supplier doesn't help when the inventory is embargoed. A label-approval step before any new SKU enters distribution is the structural fix.
4. SOP-divergence findings. Quarterly SOP reviews against actual practice. Either the SOP needs amending or operations need correcting — the gap can't persist. Versioned SOPs with mandatory acknowledgments after each update prevent the long tail of un-acknowledged versions that compound at the next inspection.
5. Occupational licensee badge gaps. Track every badge expiration like a license expiration — multi-stage alerts well before lapse, automated re-application reminders. Manual tracking has a near-100% rate of missed renewals across multi-employee operations.

The throughline: each of these categories is structural. The fix is a process that runs on its own cadence, not a heroic effort just before an inspection.

Required SOPs and recordkeeping

The required SOP categories listed above are the operating baseline for every Colorado licensee. License-type additions:

• Cultivators must maintain pesticide-application and IPM SOPs, plus harvest, drying, and curing procedures. The Colorado pesticide-residue testing regime is strict and IPM documentation is the operator's defense if a residual-pesticide failure surfaces at testing.
• Products manufacturers (especially Retail Marijuana Products Manufacturers handling solvent-based extraction) must maintain extraction-method-specific safety SOPs, per-equipment operating procedures, and a master sanitation SOP. Hazardous waste handling under 6 CCR 1007-3 is a separate workflow that needs its own SOP and its own evidence trail.
• Retail stores must maintain a sale-to-minors prevention SOP that mirrors the POS system's age-verification flow, plus an SOP covering the maximum-purchase limit checks built into Colorado retail rules.
• Transporters must maintain a manifest-handling SOP covering the chain of custody from origin licensee to destination licensee, with documented evidence of every handoff.

Recordkeeping retention defaults are typically seven years for transactional and inventory records, the 40-day camera footage minimum (longer for incident-related footage), and the duration of employment plus an additional period for personnel records. Colorado's specific retention schedules are published per record class in the MED rules.

How Verdaxi maps to Colorado's requirements

Verdaxi was built for the operator-side discipline that Colorado's mature compliance program demands. The product ships pre-loaded Colorado checklists across cultivator, processor, and retailer license types — covering facility security, inventory tracking, employee training, environmental, fire safety, recordkeeping, testing and labeling, waste disposal, and advertising — with citation linkage to 1 CCR 212-3 and risk-weighted scoring that feeds the compliance health score directly.

Where Colorado's complexity bites — METRC enforcement intensity, the 40-day camera retention floor, MED Key Badge tracking across a workforce, hazardous waste handling for extraction operations, SOP-vs-practice alignment under inspection — the Verdaxi compliance product earns its place. Inspection prep automation creates corrective actions for every open violation, expiring document, overdue SOP acknowledgment, and expiring badge when an inspection is scheduled. Versioned SOPs with per-version acknowledgments prevent the long-tail acknowledgment gaps MED inspectors specifically check for. Retention-policy-enforced document vault keeps camera footage and transactional records archived to the right cadence. Training matrix tracks MED Key Badge and Responsible Vendor Program certifications with multi-stage expiration alerts.

For multi-license Colorado operators — particularly those running parallel medical and retail operations at the same facility, or vertically-integrated operators spanning cultivation through retail — Verdaxi's multi-tenant architecture provides one platform across every license with org-wide rollup and per-license drill-down. Same code path for the single-license operator and the multi-facility MSO.

Start with the free trial and run a full inspection-prep cycle on your own data, or book a demo to see Colorado-specific checklists and SOP templates side-by-side with what you have in place today.