Guide
Cannabis Traceability and Recall: From Tag to Customer in Under an Hour
A defensible cannabis recall programme answers two questions in minutes, not days: which units of which packages of which batches contain the suspect material, and where did each of those units go. The answer comes from the seed-to-sale traceability backbone (METRC and equivalents), the internal batch record, the complaint and adverse-event intake, and the recall plan rehearsed annually under state rules. ASTM D8434 cannabis safety standards, AHPA recommendations and state-specific recall rules together form the reference. This guide walks the elements, the recurring failure modes, and a practical path to a recall capability that the regulator does not have to chase.
Start free trial Free trial, no credit card, onboard in days, not months.
The genealogy backbone: METRC tags and the internal record
A complete genealogy ties every state-issued plant tag to every harvest lot, every processing batch, every package and every transfer manifest, with the internal batch record carrying matching identifiers at every step. The recurring failure is a genealogy that is complete in METRC but partial in the internal QMS, so a recall query against METRC returns the package-level scope but cannot return the batch-level or operator-level investigation context. The genealogy must be queryable both ways — from package back to source, and from source forward to every package — within seconds.
Complaint, adverse event and the trigger to recall
A recall does not start with a regulator phone call; it starts with a complaint or an adverse event report. State rules increasingly require complaint logging, trend analysis and adverse event triage on a dietary-supplement-equivalent model (21 CFR 111, SAERA). The trigger to recall — confirmed adulteration, mislabelled cannabinoid potency, microbiological out-of-specification, pesticide or heavy-metal exceedance — should be defined in writing in advance and tested by the QA leader on call, not improvised by the night-shift manager who took the call.
The recall plan, mock recall and the 24–72 hour window
Almost every regulated state requires a written recall plan, regulator notification within 24 to 72 hours of a confirmed recall trigger, and an annual mock recall covering at least one finished SKU. The mock recall is not a paper exercise — it should pick a real package at random, trace it back to harvest lot, forward to every customer, and time the exercise end-to-end. Plans that have not been mock-tested in twelve months invariably fail when the live event happens.
ASTM D8434 and the safety-standard reference
ASTM D8434 cannabis safety standards published in 2023–2024 provide the technical reference for product safety incidents — categorisation (Class I/II/III by health hazard), notification format, public communication, effectiveness checks. Aligning the internal recall categorisation to ASTM D8434 means the regulator-facing notice fits the form the regulator already expects, and the multi-state operator can run a single consistent recall capability across all markets.
A 60-day readiness path
Days 1–10: genealogy reconciliation between METRC and the internal record across the last 90 days; close gaps. Days 11–25: complaint and adverse event intake review; define and document the recall trigger matrix; train the after-hours call-takers. Days 26–40: rebuild the recall plan against the current state rules in every market; align categorisation to ASTM D8434. Days 41–55: mock recall execution with a real random package; document the end-to-end time and the capability evidence. Days 56–60: regulator-facing rehearsal in the highest-risk state with the actual form the regulator uses.
Where this lives in V5 Ultimate
The clauses above aren't theoretical — every one maps to a shipped module and an industry profile. Jump to the parts of the product that turn this guide into evidence on a Monday morning.
Modules that do the work
Industries this hits hardest
Frequently asked
What is the difference between a recall and a market withdrawal?
A recall addresses a violative or potentially harmful product and is reportable to the regulator. A market withdrawal addresses a minor issue (labelling typo, customer-relations concern) that is not violative; it is not reportable in most states. The classification should be made by QA against the defined trigger matrix, not by sales.
Does the FDA recall classification (Class I/II/III) apply to state cannabis?
State rules increasingly adopt the FDA hazard-class definitions either directly or via ASTM D8434, which itself draws on the FDA categorisation. A multi-state operator running a single consistent hazard-class framework will satisfy most state rules and is well-positioned for federal alignment.
How long must recall records be retained?
State rules vary but commonly require retention for two to five years; ASTM D8434 recommends a longer retention aligned with product shelf life plus a safety margin. Records supporting an ongoing investigation or litigation should be retained beyond the routine schedule.
Is the regulator notified before or after the customer?
State rules typically require regulator notification within a defined window (24–72 hours) and may require regulator review of the public communication before it is issued. Customer notification timing is set by the recall plan and the hazard class; for Class I (serious health hazard) the customer notification should run in parallel with the regulator notice, not after.
See it on your shop floor.
Free trial, no credit card, onboard in days, not months.