Maryland cannabis compliance, end to end.

How the Maryland program is structured

Maryland voters approved adult-use cannabis through Question 4 — a constitutional amendment — in November 2022, with implementing legislation following in the 2023 session via the Cannabis Reform Act (HB 556) and the Social Equity-focused SB 516. Retail sales began July 1, 2023, the same day the new Maryland Cannabis Administration (MCA) took over regulatory authority from the prior Maryland Medical Cannabis Commission (MMCC). Maryland's medical cannabis program predates the adult-use launch by nearly a decade — established under the Natalie M. LaPrade Act in 2014, with patient sales beginning December 2017 — and the combined regulator framework merged the two programs from day one.

Three structural features make Maryland's compliance environment distinctive among US cannabis programs.

The first is the medical-to-adult-use conversion framework. When the Cannabis Reform Act passed, existing medical Grower, Processor, and Dispensary licensees were given a defined window to convert their medical-only licenses to combined adult-use and medical authority under the new Standard license types. Most converted. The practical effect is that Maryland's established operator base on day one of the adult-use program was dominated by converted medical operators — operators with several years of compliance history under MMCC who now had to absorb the adult-use regulatory overlay quickly. Converted operators inherit institutional advantages around inventory infrastructure, METRC discipline, and staff training, but face a specific risk: SOPs and operational baselines built for the medical-only era have to be updated to reflect the adult-use additions. MCA inspectors specifically check SOP-vs-practice alignment for converted operators, and stale medical-era SOPs are a recurring early-program citation source.

The second is the Social Equity-prioritized first round of new adult-use licenses. Under SB 516, the first round of new adult-use licenses beyond medical conversion was reserved exclusively for Social Equity Applicants — entrepreneurs from communities disproportionately impacted by past cannabis enforcement, with specific ownership-eligibility criteria covering geographic residency, prior conviction history, and economic-impact considerations. The reserved-round structure is one of the most consequential Social Equity provisions in any US state cannabis program. Social Equity Licensees carry ongoing structural reporting obligations and face heightened MCA review during the post-award period, with eligibility documentation itself being a recurring compliance touchpoint. Pattern reporting failures or material deviations from the as-applied ownership structure can result in loss of Social Equity standing and MCA enforcement attention that compounds across renewal cycles.

The third is the license-tier and license-type diversity. Maryland has Standard licenses (Grower, Processor, Dispensary) at full operational scale; Micro licenses (Micro Grower, Micro Processor, Micro Dispensary) at reduced operational scale and reduced barriers to entry — designed to broaden access alongside the Social Equity provisions; On-Site Consumption Establishments for licensed on-premise consumption; and Incubator Space licenses allowing one licensee to host the operations of another licensee within a shared physical space. The Incubator Space license is particularly distinctive — it permits a hosting licensee (typically a larger established operator) to provide physical infrastructure for a hosted licensee that operates independently, lowering capital barriers for Social Equity and Micro applicants. Both the hosting and hosted licensees carry their own compliance baselines; structural ambiguities in the hosting relationship drive enforcement against both sides.

Layered on top of these structural features are Maryland's ownership concentration caps and workforce credentialing.

Ownership concentration caps. Maryland caps the number of each license type an entity (or beneficial owner) can hold. The caps are set by COMAR 14.17.04 and exist to prevent excessive market consolidation. They apply across Standard and Micro license tiers, with separate caps per tier. The caps are enforced at application, at change-of-control review, and through ongoing structural review — and the analysis reaches beneficial ownership, not just nominal ownership. Pattern findings of concentration-cap deviations — particularly through beneficial ownership structures that obscure the underlying party-of-interest analysis — can trigger MCA enforcement attention that compounds across multiple operational issues.

Agent ID Cards. Every employee performing work at a licensed cannabis establishment must hold a current Maryland Agent ID Card issued by MCA. The card involves a background check and an application process under COMAR 14.17.06; cards are renewable on a defined cadence and must remain valid throughout employment. Operating without a current card — including during the renewal gap — triggers an immediate operational restriction on the affected employee.

Track-and-trace is METRC, mandatory across cultivation, processing, distribution, and retail since the medical program era. The unified MCA framework continues METRC under the combined adult-use and medical authority. Combined adult-use and medical dispensaries handle transaction categorization within METRC to distinguish qualifying-patient sales from adult-use sales — important for both tax-preferential treatment and inspection recordkeeping.

What MCA inspectors actually check

A Maryland inspection — routine, complaint-driven, post-citation re-inspection, or Social-Equity-status-driven audit — covers METRC integrity, security, SOP adherence, packaging and labeling, Agent ID Card currency, ownership-concentration and Social Equity documentation, and license-type-specific operations. The MCA-specific focus areas:

• METRC inventory integrity. Inspectors pull recent transactions and walk them backward through METRC, comparing tag movement, weight discrepancies, and timing against physical inventory. The investigation trail for any discrepancy matters as much as the underlying discrepancy. Documented investigations within 24 hours of detection are the citation defense. For combined adult-use and medical dispensaries, the medical-vs-adult-use transaction categorization is checked against METRC records to ensure qualifying-patient sales are properly preserved.
• Agent ID Card currency. Every employee on shift must hold a current card. Inspectors spot-check employees against MCA-issued card records — expired or missing cards trigger immediate operational restrictions on the affected employees. This is one of the most common Maryland citation categories.
• Ownership concentration and Social Equity documentation currency. MCA expects ownership and control filings to remain current, with proactive disclosure of any pending changes. For Social Equity Licensees, the as-applied ownership-eligibility documentation is itself a load-bearing compliance commitment — the heightened post-award review picks up structural drift quickly.
• Filed SOPs vs. observed practice. MCA inspectors compare your filed SOPs against what they observe on the floor. Where the SOP says one thing and staff is doing another, the citation is for failure to follow filed procedures. For converted medical operators, stale medical-era SOPs that haven't been updated to reflect the adult-use additions are a particularly common citation source.
• Packaging and labeling. Random product samples are inspected against COMAR 14.17.10 — child-resistance, mandated warnings, lab result references, font-size minimums, THC content disclosure. Non-compliant inventory can be embargoed pending relabeling.
• Pre-retail testing compliance. Inspectors verify that retail-ready inventory has corresponding COAs from MCA-licensed Independent Testing Laboratories and that testing happened in the correct sequence per COMAR 14.17.09. Untested or failed-test inventory found in retail-ready locations is grounds for embargo and mandatory destruction.
• Camera and security plan compliance. Coverage of every required area, retention period adherence, and alarm-system functionality are routinely checked under COMAR 14.17.08. Filed security plans are the bar; deviations need correction or filed amendments.
• Incubator hosting-relationship governance (where applicable). For Incubator Space arrangements, inspectors check the structural separation between hosting and hosted operations — separate inventory, separate METRC sub-accounts where required, separate sales records, separate operational control, but governance over the shared physical space. Hosting-relationship deviations generate citations against both sides.
• Medical patient verification (combined dispensaries). Qualifying-patient verification at the point of sale, with proper documentation of the medical-vs-adult-use transaction categorization. Failures result in citation and loss of qualifying-patient tax-preferential treatment on affected transactions.

The pattern: a Maryland inspection looks for whether your systems produce the documentation an inspection requires, on the day of the inspection, without scrambling. MCA has been refining its enforcement playbook since the program launched in July 2023 — early-program inspections tended toward cure-focused remediation; the program's enforcement posture has been ramping up as the operator base stabilizes.

Common violations and how to prevent them

Six categories produce the majority of MCA citations:

1. METRC discrepancies. Daily inventory counts reconciled to METRC, with discrepancies investigated and documented within 24 hours. Variance thresholds and documented investigations are the citation defense. Combined adult-use and medical dispensaries track medical-vs-adult-use transaction categorization carefully so qualifying-patient tax-preferential treatment is preserved.
2. Agent ID Card gaps. Track every card like a license — multi-stage alerts well before renewal due date, automated reminders to begin the renewal application. Manual tracking has a near-100% rate of missed renewals across multi-employee operations. The citation isn't always about the lapsed card itself; it's about the employee continuing to perform regulated work after the card expired.
3. Ownership concentration and Social Equity status currency. Annual structural attestation against the as-applied ownership filings, with proactive disclosure of any pending ownership or financial-control changes. For Social Equity Licensees, the additional ongoing-eligibility documentation track has to be maintained at the same cadence as the operational compliance documentation.
4. Stale SOPs from the medical-program era (converted operators). Quarterly SOP reviews against the current COMAR Title 14, Subtitle 17 requirements, with specific attention to the adult-use additions that weren't part of the pre-2023 medical regulatory framework. Versioned SOPs with mandatory acknowledgments after each update prevent the long-tail acknowledgment gaps MCA inspectors specifically check for.
5. Incubator hosting-relationship deviations (Incubator Space participants). Clear structural separation between hosting and hosted operations at the inventory, METRC, sales-record, and operational-control levels, with documented governance over the shared physical space. The model is designed to lower capital barriers, not to create compliance ambiguity — disciplined operators on both sides keep the relationship clean.
6. Sales-to-minors prevention. Trained, documented, and reinforced ID verification, with the medical patient verification workflow operating in parallel for combined dispensaries. Pattern findings carry license-suspension exposure on top of monetary penalties.

Required SOPs and recordkeeping

The required SOP categories listed above are the operating baseline for every Maryland cannabis licensee. License-type additions:

• Standard and Micro Growers must maintain pesticide-application and IPM SOPs, plus harvest, drying, and curing procedures. Scale-appropriate environmental and water-management SOPs apply at the Standard tier; Micro Growers face lighter equivalent expectations.
• Standard and Micro Processors running solvent-based extraction must maintain extraction-method-specific safety SOPs, per-equipment operating procedures, and a master sanitation SOP. The waste handling SOP must specifically address solvent waste segregation and disposal.
• Standard and Micro Dispensaries must maintain sale-to-minors prevention SOPs and, for combined adult-use and medical operations, qualifying-patient verification SOPs covering registration card scanning, transaction categorization, and recordkeeping.
• Social Equity Licensees must maintain ownership-eligibility documentation SOPs covering the as-applied criteria, change-of-control workflows, and proactive notification protocols for any material change in ownership, control, or financial structure.
• Incubator Space participants (both hosting and hosted) must maintain hosting-relationship governance SOPs covering structural separation, shared-space governance, and documented protocols for the operational interfaces between the two licensees.
• On-Site Consumption Establishments must maintain product-format and on-premise consumption SOPs covering what can be served, consumption-method limits, on-site staffing requirements, customer behavioral controls, and incident response.
• Every licensee must maintain an ownership-concentration documentation SOP covering annual attestation against the per-license-type caps and proactive disclosure of any pending ownership or beneficial-ownership changes.

Recordkeeping retention defaults follow COMAR Title 14, Subtitle 17 — generally multi-year retention for transactional records, defined retention windows for security camera footage (longer for incident-related footage), and personnel records held for the duration of employment plus an additional period. Agent ID Card records, ownership filings, and Social Equity status documentation are themselves subject to retention requirements.

How Verdaxi maps to Maryland's requirements

Verdaxi was built for the operator-side discipline that Maryland's combined adult-use and medical, Social-Equity-prioritized, multi-tier compliance regime demands. The compliance product covers state-specific checklists with citation linkage to COMAR Title 14, Subtitle 17, automated inspection prep, violation tracking with MCA enforcement-matrix exposure estimates, versioned SOPs with per-version acknowledgments, retention-policy-enforced document vault, training matrix with multi-stage expiration alerts for Agent ID Cards, and a real-time compliance health score.

Where Maryland's complexity bites — the conversion baseline for medical operators absorbing adult-use requirements, the ongoing Social Equity status documentation, the ownership concentration caps with beneficial-ownership analysis, the Incubator Space hosting-relationship governance, the Micro license-tier operational thresholds, the combined adult-use and medical dispensary workflow — the Verdaxi compliance product earns its place. Multi-tenant architecture is the right shape for Incubator Space arrangements: hosting and hosted licensees operate as fully separate compliance entities with no implicit data crossing, but governance over the shared physical space lives in a shared workflow. Combined adult-use and medical dispensaries get the same multi-tenant pattern with transaction categorization preserving qualifying-patient tax-preferential treatment. Agent ID Cards are pre-templated in the training matrix with the renewal-tracking discipline MCA expects. Versioned SOPs with per-version acknowledgments prevent the long-tail acknowledgment gaps inspectors specifically check for, particularly the stale medical-era SOPs that converted operators carried forward into the adult-use program.

The product is system-agnostic on track-and-trace. Maryland runs METRC across both adult-use and medical; Verdaxi's reconciliation workflows, audit log, and SOP discipline apply equally to METRC, CCRS, BioTrack, and any successor system — the same operator-side compliance posture works across state boundaries regardless of which track-and-trace platform the state mandates.

For multi-license Maryland operators — particularly converted medical operators running combined operations across grower, processor, and dispensary sites, and Social Equity licensees building portfolios across Standard and Micro tiers — Verdaxi's multi-tenant architecture provides one platform across every license with org-wide rollup and per-license drill-down. Same code path for the single-license Micro Dispensary and the multi-facility converted medical operator.

Start with the free trial and run a full inspection-prep cycle on your own data, or book a demo to see Maryland-specific checklists and SOP templates side-by-side with what you have in place today.