Product Recalls

Full cannabis recall operational playbook -- mandatory vs voluntary classification, Metrc trace, product quarantine, customer notification mechanics (POS / loyalty / in-store / social / Metrc Retail ID QR), regulatory reporting, and post-mortem documentation.

Extends: sops.md §Recall Procedures. That SOP is the index; this file is the operational playbook.

See also: tech-compliance.md for Metrc Retail ID mechanics | tech-crm-loyalty.md for customer notification via loyalty CRM | coa-testing.md for failed-test recall triggers | waste-management.md for destroy-vs-return disposition

Data current as of early 2026. CA-specific recall volume figures date-tagged to 2024-2025 per D-11.

Overview: Why Recall Readiness is Now an Active Capability

Product recalls used to be rare, ad-hoc events in cannabis retail -- a binder on a shelf, a phone tree, a hope that the bad batch had already sold through. That era is over.

In 2024, California alone issued 63 recall notices covering 259 products and approximately 25,000 units [CITED: MJBizDaily 2024 / CRB Monitor 2024 — verified per A6]. That represented an approximately 800% year-over-year increase in recall notices compared to the prior period [CITED: MJBizDaily 2024]. Recall readiness is no longer a binder on a shelf; it is a monthly operational drill that every compliant retailer should treat as a first-class workflow.

Two structural shifts explain why recall volume has climbed and why it will continue to climb:

Shift 1: Metrc Retail ID direct-to-consumer QR scanning (CA, August 2025) Metrc launched the Retail ID direct-to-consumer recall-verification feature in California via Bulletin CA-2025-006 in August 2025. For the first time, consumers can scan the Retail ID QR code on a product package and receive an authoritative recall status directly from the state's seed-to-sale backbone. This collapses the old model -- in which regulators and retailers alone carried the notification burden -- into a distributed, consumer-in-the-loop model. Every recalled package is now discoverable by any consumer holding the package. As of early 2026 this is CA-only; expansion to other Metrc states is expected but not announced (per Assumption A3). See tech-compliance.md for full Metrc Retail ID mechanics.

Shift 2: Failed-test recall triggers are becoming more frequent as lab chains tighten As state regulators tighten the COA testing regime -- expanded pesticide panels, lower microbial action limits, heavy-metal tightening, aspergillus speciation -- products that passed at release are increasingly being flagged in surveillance testing, random regulator re-pulls, and follow-up batch retesting. A passed COA at release is no longer a permanent safety certificate; it is a snapshot that can be overturned. See coa-testing.md for the surveillance-testing and failed-test pipeline.

What this means operationally:

A mid-size CA dispensary should expect to be on the receiving end of a recall notice at least once per quarter, and often more frequently.
Recall response is a named workflow with an owner (Compliance Manager or General Manager), a clock, and a documented evidence trail.
Customer notification mechanics are tightening -- "good faith" is being operationalized into specific channel combinations (POS / loyalty / signage / social / Retail ID QR).
Retailers that cannot produce a clean recall-closure packet within the state clock (CA: 10 days from resolution) face licensure risk.

What this playbook covers:

Recall classification (mandatory vs voluntary) -- short, because the operational mechanics are the same regardless
The 8-step operational lifecycle -- notification → trace → quarantine → Metrc admin-recall → customer notify → disposition → report → post-mortem
Customer notification mechanics -- POS purchase history, loyalty CRM, in-store signage, social, Metrc Retail ID QR
State-specific clocks -- CA, CO, IL, NV quick-reference
Reach benchmarks -- channel-by-channel estimates
Post-recall documentation -- closure packet structure and 7-year retention

What this playbook does NOT cover:

Day-to-day recall-monitoring SOP (that is sops.md §Recall Procedures -- the index-level SOP)
Full Metrc Retail ID feature mechanics (that is tech-compliance.md)
Loyalty-CRM segmentation tooling (that is tech-crm-loyalty.md)
Destruction mechanics for recalled product (that is waste-management.md)

Recall Classification

Recall classification is a regulatory distinction, not an operational one. Mandatory and voluntary recalls follow the same 8-step operational lifecycle below. The differences are in who initiates, who sets the clock, and who pays.

Mandatory vs Voluntary: The Short Version

| Attribute | Mandatory Recall | Voluntary Recall | |-----------|------------------|-------------------| | Initiator | State regulator (CA DCC, CO MED, IL IDFPR, NV CCB) | Brand, distributor, or cultivator | | Retailer discretion | None -- must comply on regulator's clock | Contractual -- usually must comply per brand/distributor agreement, with a state-defined minimum floor | | Clock starts | At receipt of regulator notice | At receipt of brand/distributor notice | | Customer notification required | Yes -- per state rule | Usually yes -- per brand/distributor protocol, with state-defined floor | | Regulator reporting required | Yes -- closure report to issuing regulator | Often yes -- many states require even voluntary recalls to be reported to the regulator within a defined window | | Financial responsibility | Often disputed; default: brand/distributor bears product cost, retailer bears labor | Usually brand/distributor bears product + contracted refund cost | | Public listing | Yes -- on DCC Recalls Portal or equivalent state surface | Sometimes -- depends on state and voluntary-reporting policy |

Key operational point: Classification is orthogonal to operational mechanics -- a voluntary recall still requires the full 8-step lifecycle below. The retailer's workflow does not branch based on classification; the retailer's paperwork does.

When in Doubt: Treat It Like Mandatory

If a retailer is unsure whether a notice is mandatory or voluntary, the operational default is to treat it as mandatory. The cost of over-responding to a voluntary recall is labor and some lost sell-through. The cost of under-responding to a mandatory recall is licensure action.

Failed-Test Triggers as a Recall Source

Many recent recalls originate from the COA / lab-retest pipeline rather than a direct regulator action. The sequence is:

A package ships with a passing COA
State surveillance sampling, regulator re-pull, or a brand's own QA program catches a failure on that batch
The lab report goes to the state regulator and the brand
The state regulator either (a) orders a mandatory recall or (b) the brand issues a voluntary recall ahead of regulator action to manage the disclosure narrative

From the retailer's point of view the two paths converge at Step 1 of the operational lifecycle below. See coa-testing.md for the failed-test trigger pipeline in full.

Recall Operational Lifecycle

The core of recall readiness is an 8-step lifecycle that applies to every recall -- mandatory or voluntary, flower or edible or beverage, single-package or multi-state MSO-wide.

1. Notification received (brand, regulator, or lab)
2. Affected batch identified (Metrc trace)
3. Product located and physically quarantined
4. Metrc admin-recall status applied (see Bulletin CA-2025-006)
5. Customer notification (POS / loyalty / signage / social / Retail ID QR)
6. Product disposition (return, destroy, remediate)
7. Regulatory reporting (state-specific clock)
8. Post-mortem documentation

Each step is addressed in detail below with named owners, deliverables, and clock-starts. The full lifecycle for a CA mandatory recall typically runs 10-14 days from notification to closure; voluntary recalls can run longer if the brand is managing rolling disclosure.

Step 1 -- Notification Received

Owner: Compliance Manager (primary) / General Manager (backup)

Clock start: Time and date of receipt (log both)

Sources of a recall notice (in approximate frequency order):

Brand or distributor notice -- email or phone to the retailer's listed compliance contact, usually with an attached notice PDF, affected-package list, and refund/return instructions
State regulator bulletin -- the canonical CA surface is the DCC Recalls Portal (recalls.cannabis.ca.gov); other states publish on their regulator web pages
Lab failed-retest notice -- rare but happens when a lab flags a previously-passed batch on a follow-up or surveillance sample and notifies both the regulator and the brand simultaneously
Peer retailer / industry network -- an informal tip from another operator; NOT sufficient as the authoritative trigger, but can prompt the retailer to check the DCC Recalls Portal proactively

What to capture at notification receipt:

Date and time of notice
Channel (email / portal / phone / other)
Originator (brand name, DCC bulletin number, or lab name)
Affected product(s) -- brand name, SKU, product name, batch/lot number, Metrc package ID range if provided
Affected window -- manufacture date range or sell-by date range
Stated reason for recall (pesticide, microbial, heavy metal, label error, etc.)
Stated classification (mandatory or voluntary)
Clock terms (how long the retailer has to notify customers, quarantine product, return product)

CA DCC mandatory-recall clocks (primary reference state):

24-hour notice: CA DCC mandatory recall notices reach retailers within 24 hours of issuance; retailers in turn must begin quarantine and customer-notification workflows immediately on receipt
72-hour quarantine: Affected product must be physically quarantined within 72 hours of notice receipt (CA DCC rule)
10-day closure reporting: Closure report to DCC within 10 days of recall resolution

Do not assume these exact windows apply in other states -- see the State-Specific Recall Clocks table below and always consult the issuing regulator's bulletin.

Deliverable at end of Step 1: A recall-incident ticket opened in the retailer's compliance tracker (or in Metrc compliance notes), with all capture fields populated. The ticket is the evidence trail for the closure packet at Step 8.

Step 2 -- Affected Batch Identified via Metrc Trace

Owner: Compliance Manager

Clock start: Immediately following Step 1 completion

The Metrc package ID is the atomic unit of a cannabis product for regulatory purposes. Every recall notice ultimately resolves to a list of package IDs (or a batch ID that resolves to a list of package IDs).

Metrc trace workflow:

Receive affected package/batch identifiers from notice -- package ID list, batch ID, or harvest/manufacture lot
Pull retailer's current on-hand packages matching those IDs -- Metrc package ledger query filtered by status (Active, Not Finalized)
Pull historical transfers of those IDs into the retailer -- confirms receipt date and manifest
Pull retailer-to-consumer sale records -- Metrc does not directly expose sale-to-consumer package linkages for all package types, so this step often requires POS data (see Step 5)
For MSO retailers with multiple licensees: Query Metrc across all the operator's retail licensees and any downstream inter-store transfers

What "affected" means for a retailer:

Packages currently on-hand (to be quarantined)
Packages already sold through to consumers (drives customer notification at Step 5)
Packages transferred to another licensee (rare at retail; more common distributor-to-distributor)

Common traps:

Partial package matches -- a package may have been split into consumer-unit packages; the child package IDs inherit the affected status but are not always explicitly enumerated in the recall notice
Re-labeled packages -- if the product was re-packaged after receipt (legal in some states, illegal in CA), the trace may break
Unlogged samples -- employee samples or comp packages not properly logged in Metrc can escape the trace

Deliverable at end of Step 2: A reconciled list of affected on-hand package IDs (for Step 3 quarantine) and affected sold-through package IDs (for Step 5 customer notification).

See tech-compliance.md for full Metrc trace-query mechanics including package-ledger fields and transfer-history queries.

Step 3 -- Product Located and Physically Quarantined

Owner: Compliance Manager (decision) / Inventory Lead (execution)

Clock start: Upon completion of Step 2 package list

Quarantine is the single most important physical step in the lifecycle. The goal is to prevent any further sale-to-consumer of affected product, full stop.

Quarantine procedure:

Pull all affected packages from sales floor and back-stock -- the pull list is the Step 2 on-hand package list
Move to the designated recall-quarantine area -- a labeled, secured location in the vault or back-of-house, with camera coverage
Physical label on each package -- "RECALL -- DO NOT SELL -- [date] -- [recall ID]" -- bright color (red/orange), hand-initialed by the person pulling
Quarantine-area signage -- "RECALL QUARANTINE -- DO NOT RE-SHELVE -- LOCKED PER [recall ID]"
Metrc package status update -- move to the recall-quarantine location in Metrc's location hierarchy; some states require specifically designated recall locations to be pre-registered
POS inventory block -- add a sales block at the POS level on the affected SKUs / batch / package IDs so that a budtender cannot accidentally ring them if a package was missed in the physical pull
Camera-footage timestamp -- note the time of the quarantine pull for the closure packet; helpful for any regulator audit

Physical quarantine area requirements:

Lockable (key or keypad; not just a zone marker)
Camera coverage with retention per state rule (CA: 90 days minimum)
Physically separate from active inventory, returns, and destruction-pending inventory
Labeled with recall ID and expected disposition date

Handoff to waste/destruction if quarantined product will be destroyed: See waste-management.md quarantine-to-destruction handoff procedures. Do NOT destroy quarantined product before Step 6 disposition is decided -- some recalls resolve with product-return to the distributor rather than on-site destruction.

Common traps:

Sales floor pulled but back-stock missed
Open packages (single pre-rolls sold from a master pack) require the master pack to be quarantined even if some units have been sold
Display units / demo packages not pulled
Product in transit to another location -- apply the POS sales block and coordinate with the receiving location to quarantine on arrival

Deliverable at end of Step 3: Physically quarantined packages in the labeled secure area, Metrc location updated, POS sales block active, camera-footage timestamp captured.

Step 4 -- Metrc Admin-Recall Status Applied

Owner: Compliance Manager

Clock start: Immediately following Step 3

Background: Metrc supports an "admin recall" package status that flags the package as recalled in the state's seed-to-sale system. This status is what powers the Metrc Retail ID direct-to-consumer QR recall-check (Bulletin CA-2025-006) and is the authoritative regulator-facing evidence that the retailer has acknowledged and acted on the recall.

Who applies the admin-recall status:

CA mandatory recall: The DCC applies the admin-recall flag at the state level on the affected packages; the retailer confirms/acknowledges the flag and may apply additional "retailer quarantined" notes
CA voluntary recall: The brand or distributor typically initiates an admin-recall request through their Metrc account; the DCC may confirm; retailers acknowledge downstream
Other states: Varies -- some states have Metrc admin-recall workflows similar to CA; others do not and rely on location-based quarantine alone

Retailer responsibilities on Metrc admin-recall:

Verify the admin-recall flag has been applied to the affected on-hand packages (Step 2 list)
If flag is missing on a package that is clearly affected, raise with the state regulator or brand -- do NOT sell the package, and do NOT overwrite the status unilaterally
Add retailer-side Metrc notes documenting the quarantine time, location, and owning staff member
Preserve the admin-recall flag through the disposition workflow in Step 6

Bulletin CA-2025-006 mechanics:

CA Bulletin CA-2025-006 (August 2025) launched the Retail ID direct-to-consumer QR recall-check feature. Key mechanics:

The Retail ID QR code on the product package links to a Metrc public lookup
When a consumer scans the QR, Metrc returns either a "Not recalled" or "RECALLED -- [recall ID] -- [instructions]" response
The response is keyed off the admin-recall status on the package
The recall instructions are provided by the brand/distributor and curated by the DCC -- typically refund-at-retailer or destroy-and-document
The feature works even if the consumer has no app; the QR resolves via a mobile browser

What this means for the retailer's Step 4 workflow:

The retailer does not own the consumer-facing Retail ID QR experience -- Metrc and the DCC do. But the retailer's Step 4 correctness determines whether the QR check returns accurate recall status. If the admin-recall flag is not in place, a consumer scanning the package will get a "Not recalled" response on a product that is in fact recalled -- a regulator-reportable failure.

CA-2025-006 also formalized:

A uniform recall ID format (state-year-NNN, e.g., CA-2025-006)
A requirement for brands to supply refund/exchange instructions to DCC at notice filing
An expectation that Metrc admin-recall status is applied within 24 hours of notice publication

Cross-state note (per A3): As of early 2026, the consumer-facing Retail ID QR scan feature is CA-only. Other Metrc states have the admin-recall package status but do not expose the consumer-facing QR lookup. Expansion to other Metrc states is expected but not announced.

Deliverable at end of Step 4: Metrc admin-recall status confirmed on all affected on-hand packages; retailer-side Metrc notes added; recall ID (e.g., CA-2025-006-format) captured on the recall-incident ticket.

Step 5 -- Customer Notification

Owner: Compliance Manager (coordination) / Marketing Lead (execution) / GM (approval)

Clock start: Upon completion of Step 4 (or earlier in parallel for large recalls)

Customer notification is the reach problem of recall operations. A retailer can quarantine on-hand stock in hours, but reaching the customers who already walked out with a recalled product is harder. Effective notification combines five channels.

5a. POS Purchase-History Lookup

The primary customer-identification channel.

Workflow:

From Step 2, pull the affected package IDs and their sold-through windows
Query the POS system for all transactions that included a SKU matching the affected batch/package within the sold-through window
Join against the customer identity on each transaction
- Loyalty members: full contact (phone, email, address)
- Non-loyalty members: typically phone number only (many CA retailers collect phone for pre-order and delivery) or ID-scan record (if retained; state-dependent)
Deduplicate customer records
Export to the notification channel (loyalty CRM, SMS broadcast, email broadcast)

Named POS platforms with recall-capable purchase-history queries: Treez, Dutchie, Flowhub, Cova, Meadow, Blaze. Query structure varies by platform. See tech-pos.md for platform-specific query patterns.

Privacy considerations:

Purchase-history lookups for recall purposes are a documented legitimate use under most retailer privacy policies
Many states explicitly authorize contact for recall notification
Retailer should NOT use the recall-pull customer list for marketing; keep the recall-notification use case clean in internal logs

Typical reach (CA mid-size retailer): 60-80% of sold-through units can be resolved to a customer identity with some contact information; the remaining 20-40% are cash-and-go non-loyalty customers with no retained contact

5b. Loyalty CRM Outbound

The highest-reach channel for identified customers.

Workflow:

From 5a, generate the affected-customer list
Segment in the loyalty CRM (Alpine IQ, Springbig, Fyllo, etc.) as a recall-specific audience
Send a dual-channel message -- SMS (primary, highest open rate) + email (secondary, includes refund/exchange instructions and attached recall notice)
Track opens, click-throughs, and response actions (call, in-store visit, product return)
Re-send at 48 hours to non-responders

Message template (SMS):

[Retailer name] Recall notice: A product you purchased has been recalled. Please visit [store] with the product for a refund/exchange. Details: [short URL]. Questions: [phone].

Message template (email): Full recall notice, brand name, SKU, batch, purchase date, reason for recall, refund/exchange process, store hours, contact for questions. Attach the official recall notice PDF.

Typical reach: 50-70% of segmented loyalty customers open or engage with a recall SMS/email combo (industry estimates 2024-2025)

See tech-crm-loyalty.md for full loyalty-platform segmentation mechanics.

5c. In-Store Signage

The channel for current foot traffic and for customers who prefer to come in rather than reply to SMS.

Placement:

Entrance door -- plain-language recall notice with SKU and brand name
POS counter -- recall notice next to the budtender stations
Category shelf where the recalled product lived -- "This product has been recalled -- see staff"

Sample script (door sign):

PRODUCT RECALL NOTICE

[Brand] [Product Name] -- Batch [#] -- Purchased between [start date] and [end date]

The [brand/distributor/DCC] has issued a [mandatory/voluntary] recall on this product for [reason]. If you have purchased this product, please bring it to [retailer name] for a full refund or exchange.

Recall ID: [CA-YYYY-NNN]

Questions: ask any staff member or call [phone].

Typical reach: Captures current foot traffic -- perhaps 10-20% of affected sold-through customers over a 2-week window

5d. Social Media and Retailer Website

The broad-but-unsegmented channel.

Channels and constraints:

Instagram / Meta: Cannabis advertising is restricted; recall notices generally qualify as safety notifications rather than ads, but Meta's enforcement is inconsistent. Expect post takedowns on edge cases
TikTok: Similarly restricted
X / Twitter: More permissive but lower reach for dispensary accounts
Retailer website: The authoritative long-form channel; post a recall banner on the homepage and a dedicated recall page with full details
Google My Business: Post a recall notice as a business update

See marketing-regulations.md for cannabis advertising platform rules.

Typical reach: Unsegmented, hard to measure; supplements other channels rather than replacing them

5e. Metrc Retail ID Direct-to-Consumer QR (CA, August 2025)

Current-state CA mechanism (Aug 2025): Metrc Retail ID direct-to-consumer recall scanning launched in California via Bulletin CA-2025-006. Consumers scan the Retail ID QR on product packaging to verify recall status. As of early 2026, this is CA-only; expansion to other Metrc states is expected but not announced (per Assumption A3).

Workflow from the consumer's point of view:

Consumer has a product at home, hears about a recall (news, retailer notice, social, loyalty SMS)
Consumer scans the Retail ID QR on the package with any smartphone camera
QR resolves to a Metrc public page returning either "Not recalled" or "RECALLED -- [recall ID] -- [refund/exchange instructions]"
Instructions direct the consumer to the retailer (refund/exchange) or to the brand (if the brand manages returns directly)

Workflow from the retailer's point of view:

The retailer does NOT operate the Retail ID QR experience -- Metrc does
The retailer's responsibility is to ensure Step 4 Metrc admin-recall status is correctly applied so the QR returns accurate results
The retailer will receive consumers arriving with a scanned-and-confirmed recall status, expecting refund/exchange per the on-screen instructions
The retailer's POS and loyalty staff should be briefed on the specific recall so they can process refund/exchanges efficiently

Staff briefing script for Retail ID QR-scan arrivals:

"Thank you for bringing this in. We're processing refunds/exchanges for [recall ID]. I'll need the product and your original receipt if you have it, or your phone number for a loyalty lookup. The refund is [cash/card/store credit per brand instructions] and it takes about [X] minutes."

Why this channel matters: It collapses the retailer's reach-gap for non-loyalty cash-and-go customers. A customer who left no contact trail can still discover the recall by scanning the package they took home. As of early 2026 this applies only in CA.

Notification Channel Summary

| Channel | Reach | Cost | Speed | Best For | |---------|-------|------|-------|----------| | POS purchase-history + SMS/email | 40-60% of sold-through | Low | Fast (24-48h) | Identified customers | | Loyalty CRM segmented outreach | 50-70% of segmented | Low (included in CRM cost) | Fast (24-48h) | Loyalty members | | In-store signage | 10-20% of affected (current foot traffic) | Very low | Immediate | Walk-in customers | | Social media + website | Broad/unsegmented, unmeasurable | Low | Same day | Awareness, amplification | | Metrc Retail ID QR (CA) | Consumer-driven -- captures non-loyalty gap | Included in Metrc | Continuous post-launch | Cash-and-go customers |

Step 6 -- Product Disposition

Owner: Compliance Manager (decision) / Inventory Lead (execution)

Clock start: After brand/distributor disposition instruction is received (usually with the Step 1 notice or within 72 hours)

Three disposition paths. The choice is usually set by the brand or distributor and confirmed by the state regulator.

| Disposition | When Used | Retailer Workflow | Metrc Action | |-------------|-----------|-------------------|---------------| | Return to distributor | Contractually preferred default; most voluntary recalls; many mandatory recalls with product-recovery-capable brands | Package and ship per distributor instruction; manifest required; reverse-transfer in Metrc | Reverse-transfer package(s) to distributor licensee | | Destroy on-site | When return is not feasible; when contamination is health-critical and regulator requires evidence of destruction; when brand is defunct | Follow waste-management destruction procedure; render unusable; log destruction in Metrc; camera-witnessed | Finalize package in Metrc as destroyed with reason code "Recall" | | Remediate | Rare -- used for residual-solvent concentrate cases where re-processing can clear the failure; requires regulator approval | Ship to licensed remediation facility; track via Metrc transfer | Transfer package to remediator; await re-test before re-introduction |

Return-to-distributor is the default when contractually available. It minimizes destruction volume, preserves the brand's ability to test/investigate the failed product, and documents chain-of-custody cleanly.

Destroy on-site -- follow waste-management.md render-unusable and destruction-log procedures. All destruction must be logged in Metrc with the "Recall" reason code, witnessed per state rule (CA: witnessed by supervisor and logged; some states require regulator notice), and camera-captured. Do NOT destroy until the disposition path is confirmed in writing.

Remediate -- very rare at retail; applies mainly at the distributor/manufacturer level. A retailer generally does not remediate; the retailer either returns or destroys.

Deliverable at end of Step 6: Every affected on-hand package disposed per the confirmed path, with Metrc finalization complete and the destruction/return evidence attached to the recall-incident ticket.

Step 7 -- Regulatory Reporting

Owner: Compliance Manager

Clock start: Upon completion of Step 6 for CA closure report; during the recall for interim status reports where required

Regulatory reporting is state-specific. The sections below cover CA and cross-state quick reference; always consult the issuing regulator's bulletin at recall time.

CA DCC closure report (primary reference):

Clock: Within 10 days of recall resolution (where "resolution" means Step 6 disposition complete and Step 5 customer notification effort documented)
Submission: Via DCC portal or email to the recall officer assigned in the original notice
Required contents:
- Retailer license number
- Recall ID (e.g., CA-2025-006-format)
- Affected package IDs received
- Quarantine date and location
- Disposition path (return / destroy / remediate) per package
- Customer-notification effort -- channels used, count of customers contacted, opens/responses, refund/exchange counts processed
- Evidence attachments -- destruction logs, shipping manifests, notification screenshots, reach metrics

Other states (high-level):

Colorado (MED): Recall response documented in the Colorado Marijuana Enforcement Division's compliance management system; exact clock and format per MED bulletin issued at recall time
Illinois (IDFPR): Recall closure reporting per IDFPR bulletin; generally 10-14 days depending on recall class
Nevada (CCB): Per CCB bulletin; closure documentation required

Per Pitfall 6, consult the state regulator's bulletin for exact timing and format -- rules change, and there is no federal uniform standard.

Deliverable at end of Step 7: Filed closure report with the issuing regulator, acknowledgement receipt logged in the recall-incident ticket.

Step 8 -- Post-Mortem Documentation

Owner: Compliance Manager (lead) / GM (review)

Clock start: Within 30 days of Step 7 closure report filing

The post-mortem is the document that converts a reactive event into organizational learning. It also preserves evidence for any audit 1-7 years downstream.

Post-mortem structure:

Recall summary -- ID, classification (mandatory/voluntary), brand, product, batch, reason, affected unit count, sold-through count, on-hand count
Timeline -- notification received → quarantine complete → admin-recall confirmed → customer notification begun → disposition complete → closure filed (with date-time stamps for each)
Reach metrics -- customers contacted per channel, response rates, refund/exchange counts, remaining-outstanding estimate
Deviations -- where the actual workflow deviated from the standard 8-step lifecycle; why; what it cost (time, labor, risk)
Corrective actions -- supply-chain-side (new brand/distributor scrutiny? additional COA verification at receiving per receiving-qc.md? additional QA steps?); operations-side (gaps in quarantine procedure? POS block timing? signage readiness?)
Reach-rate benchmark -- how the combined-channel reach compared to the 60-80% industry benchmark for POS+loyalty combined
Regulator closure letter -- the DCC or state regulator closure acknowledgement, attached as evidence

Retention: 7 years (the industry-standard retention for cannabis regulatory evidence). Store in the compliance filesystem with recall-ID-based folder structure; back up offsite.

Deliverable at end of Step 8: Completed post-mortem document, attached regulator closure letter, corrective-action items assigned with owners and target dates, recall-incident ticket closed.

Named Recall Exemplars

Recent CA recalls illustrate the lifecycle in practice. All details reflect DCC Recalls Portal listings (recalls.cannabis.ca.gov) as of authoring time; exemplar details are representative archetypes -- verify the live portal at recall-response time.

| Recall | Product Type | Issued By | Root Cause (Reported) | Notification Path | |--------|--------------|-----------|------------------------|--------------------| | Pure Beauty Flower (CA, 2025) [CITED: recalls.cannabis.ca.gov listings 2025] | Flower | CA DCC -- mandatory | Pesticide residue over tolerance (aggregated pesticide panel failure on follow-up test) | Metrc admin-recall; retailer notify; customer notify via loyalty CRM + POS purchase-history SMS; Retail ID QR post-Aug 2025 | | CLSICS Edible (CA, 2024-2025) [CITED: recalls.cannabis.ca.gov listings 2024-2025] | Edible | CA DCC -- mandatory | Label / dosing discrepancy; potency variance across units in the affected batch | Metrc admin-recall; retailer notify; in-store signage + loyalty CRM; refund/exchange at retailer | | PotShot Beverage (CA, 2024-2025) [CITED: recalls.cannabis.ca.gov listings 2024-2025] | Beverage | CA DCC -- mandatory | Microbial contamination (aerobic plate count exceedance) detected in post-release surveillance sampling | Metrc admin-recall; retailer notify; POS purchase-history + loyalty CRM outreach; beverage-specific recall notice due to cold-chain considerations |

Archetype lessons from CA 2024-2025 recall cohort:

Flower recalls dominate -- pesticide and microbial failures on flower and pre-roll product represent the majority of 2024 CA recalls
Edible recalls often stem from label/dosing issues -- not always a contaminant; the recall mechanic is the same regardless
Beverage recalls introduce cold-chain urgency -- quarantine must preserve cold chain until disposition; destruction must follow waste-management.md destruction-of-liquid-cannabis procedures
Surveillance-testing retest failures are increasingly common -- products that passed at release can be recalled months later based on surveillance or complaint-driven retests; see coa-testing.md

Where to verify: The authoritative CA recall list is recalls.cannabis.ca.gov (DCC Recalls Portal). Every recall listed there includes the official notice, affected SKUs/batches, reason for recall, and refund/exchange instructions.

State-Specific Recall Clocks

Recall clocks are not uniform across states. The table below is a quick reference for four major licensed-cannabis states; always consult the issuing regulator's bulletin at recall time for the authoritative current rule.

| State | Retailer Notification Clock | Quarantine Minimum | Customer Notification Requirement | Closure Reporting | |-------|-----------------------------|---------------------|------------------------------------|--------------------| | California (DCC) | 24 hours from DCC mandatory-recall notice issuance | 72 hours (physical quarantine complete) | DCC requires good-faith customer notification; Retail ID QR available per Bulletin CA-2025-006 | 10 days from resolution to DCC | | Colorado (MED) | Per MED bulletin issued at recall time | Per MED bulletin -- typically immediate upon notice | Retailer must attempt customer contact via records on file (MED rule) | Per MED bulletin; document in the MED compliance system | | Illinois (IDFPR) | Per IDFPR bulletin | State-mandated per bulletin | State-defined per bulletin | Per IDFPR bulletin; typically 10-14 days from resolution | | Nevada (CCB) | Per CCB bulletin | State-defined per bulletin | State-defined per bulletin | Per CCB bulletin |

Important caveats (per Pitfall 6):

Every Metrc-facing statement above is qualified by the specific state tenant of Metrc (each state operates its own Metrc tenant with state-specific fields and workflows)
The consumer-facing Retail ID QR feature is CA-only as of early 2026 (A3)
Non-CA rows should be re-verified against the issuing regulator's bulletin at recall time -- the rules change, and there is no federal uniform standard

Customer Notification Reach Benchmarks

Customer-notification reach rates are industry estimates based on 2024-2025 operator surveys and loyalty-CRM platform reports. They are NOT peer-reviewed; treat them as directional benchmarks for post-mortem comparison.

| Channel | Typical Reach Rate | Definition | Notes | |---------|---------------------|------------|-------| | POS purchase-history SMS | 40-60% open rate | Percentage of SMS recipients who open the message within 72 hours | Varies with SMS vendor deliverability; CA cannabis SMS faces carrier-filtering headwinds | | POS purchase-history email | 25-45% open rate | Percentage of email recipients who open within 72 hours | Cannabis email deliverability is improving but remains below retail average | | Loyalty CRM segmented outreach | 50-70% reach | Percentage of segmented customers who open SMS or email within 72 hours | Higher than POS-only because loyalty customers have opted in and have higher engagement baselines | | POS + Loyalty combined | 60-80% reach | Dedup'd reach across both channels within 72 hours | The industry benchmark for "good" recall reach on a CA mid-size retailer; appears in post-mortem reach-rate comparisons | | In-store signage | ~10-20% of affected | Share of affected customers who encounter signage during current foot traffic over a 2-week window | Low absolute reach but high clarity for those who see it | | Social media (organic) | Unsegmented, unmeasurable | Broad amplification, hard to attribute to specific affected customers | Supplements other channels; not a substitute | | Metrc Retail ID QR (CA) | Consumer-driven -- no retailer metric | Not a push channel; consumers self-discover via QR scan | Captures the cash-and-go non-loyalty gap; CA-only as of early 2026 |

Reach-rate caveats:

All figures are industry estimates, not peer-reviewed
Reach rate depends heavily on the quality of POS/loyalty data hygiene -- stale phone numbers and opted-out contacts drag reach down
"Reach" does not equal "action" -- opens are measurable; refund/exchange conversions are the more important downstream metric
For the closure packet, report both reach metrics AND refund/exchange counts

Reach expectation for a well-run CA mid-size retailer on a typical recall: 60-80% reach via POS+loyalty combined; 15-30% refund/exchange conversion rate on reached customers; the remainder assumed consumed or discarded.

Post-Recall Documentation

The post-recall documentation packet is both an operational artifact and a regulatory evidence trail. Store it in the compliance filesystem for 7 years.

Closure Packet Contents

Recall-incident ticket -- from Step 1, fully populated with timestamps through all 8 steps
Metrc trace outputs -- Step 2 package-ledger queries, Step 4 admin-recall confirmations
Quarantine evidence -- Step 3 camera-footage timestamps, label photos, location register entries
Customer-notification evidence:
- POS purchase-history query exports (Step 5a)
- Loyalty CRM campaign reports (opens, click-throughs, responses) (Step 5b)
- In-store signage photos with date/time (Step 5c)
- Social-media post screenshots (Step 5d)
- Retail ID QR mentions in customer interactions (Step 5e)
Disposition evidence (Step 6):
- Return shipment manifests (if returned to distributor)
- Destruction logs with camera-witnessed timestamps (if destroyed on-site) -- see waste-management.md
- Remediation transfer manifests (if remediated)
Regulator closure filing (Step 7) -- the filed closure report and the regulator's acknowledgement receipt
Post-mortem document (Step 8) -- timeline, deviations, corrective actions, reach benchmark comparison
Regulator closure letter -- received from the state regulator acknowledging closure

Retention

Standard retention: 7 years from recall closure date
Rationale: Aligns with IRS record-retention for cannabis businesses (§280E compliance) and with most state cannabis regulator audit windows
Format: Digital in the compliance filesystem; physical original copies (notices, regulator letters) in a fireproof cabinet in the compliance office
Backup: Offsite or cloud backup at least quarterly
Access control: Compliance Manager + General Manager only, except during active audit when auditor access is granted per the audit-access policy

Common Audit Questions a Closure Packet Must Answer

When was the recall notice received?
How were affected packages identified?
When was physical quarantine completed?
What was the Metrc admin-recall status history?
How were customers notified, through which channels, with what reach?
How was affected product disposed of, and where is the evidence?
Was the closure report filed within the state's clock?
What corrective actions were implemented to reduce recurrence?

Recall Drill & Readiness Program

Recall readiness is a capability, not a document. The only reliable way to validate that a retailer's recall workflow actually works is to run a drill -- a simulated recall -- at least quarterly. The 2024 CA recall volume (63 notices / 259 products / ~25K units) means most CA mid-size retailers will face a real recall at least once a quarter anyway; drills turn that reactive workload into muscle memory.

Drill Frequency and Scope

Recommended cadence:

Full drill -- quarterly: End-to-end simulation of the 8-step lifecycle from notification through closure packet, using a synthetic recall ID and a real on-hand SKU as the target
Tabletop drill -- monthly: 30-60 minute tabletop walk-through of the lifecycle by the compliance/ops team, no physical action; rotate the simulated recall archetype (flower / edible / beverage / concentrate) each month
Surprise drill -- annually: Unannounced full drill that tests after-hours or weekend response, since real recalls are not considerate of retail hours

Full Drill Procedure

Compliance Manager selects a drill target SKU from current on-hand inventory; pick a batch that is live and has sell-through to exercise Step 5 customer-notification mechanics
Inject a synthetic notification -- draft a "CA-YYYY-DRILL" notice email, deliver it to the recall response team at an un-pre-announced time, start the clock
Run Steps 1-5 live -- open a drill-incident ticket; run the Metrc trace; physically move the target packages to the quarantine area (then return to stock at drill end); simulate Step 4 admin-recall flag (do NOT apply a real admin-recall flag to Metrc -- use a drill-labeled note); run Step 5a POS purchase-history query (export only; do NOT actually message customers)
Evaluate against clock and reach benchmarks -- did the team complete Step 3 quarantine within the 72-hour CA target? Did Step 2 package-trace complete within 24 hours? Did Step 5a produce a customer list with an estimated 40-60% SMS open-rate expectation?
Simulate Step 6 disposition -- table-discuss the return-vs-destroy decision without actually disposing
Skip Step 7 real filing but draft the closure report document in full
Complete Step 8 post-mortem -- what worked, what broke, what would need to change under real-recall time pressure

Tabletop Drill Script (Example -- Edible Recall)

Scenario: "A brand you carry has issued a voluntary recall on one of their edible SKUs due to a labeling error -- the product's THC content was mis-stated by 30% on the packaging. The brand's notice was received this morning at 09:00. Affected: 3 batches over a 60-day window. Estimated on-hand at your store: ~40 units across 2 SKUs. Estimated sold-through: ~120 units."

Discussion prompts:

Who on your team receives the notice first, and who do they loop in within 30 minutes?

How does your team confirm the affected package IDs against on-hand stock? Who runs the Metrc trace?

Where is your quarantine area? Is it labeled? Does it have camera coverage?

What is your POS purchase-history query for "SKU + batch + date range"? Who owns that in your POS?

What does your loyalty CRM recall-campaign template look like? When was it last updated?

What's your in-store signage readiness -- do you have a recall-notice template that a manager can fill in and print in 15 minutes?

If this were instead a mandatory CA DCC recall, what changes? (Answer: Retail ID QR consumer self-discovery adds a channel; closure-report clock activates; admin-recall flag is state-applied rather than brand-initiated)

Readiness Checklist

A retailer is recall-ready when all of the following are true and current:

[ ] Designated recall-incident owner (Compliance Manager) named with a backup (General Manager)
[ ] Recall-incident ticket template exists in the compliance tracker with all Step 1 capture fields
[ ] Physical recall-quarantine area labeled, lockable, camera-covered, with current signage
[ ] Metrc admin-recall workflow documented for the state's tenant
[ ] POS purchase-history recall-query saved or documented for each active POS platform (Treez, Dutchie, Flowhub, Cova, Meadow)
[ ] Loyalty CRM recall-campaign template current (tested to render correctly on SMS + email)
[ ] In-store signage template current with recall-ID, brand, SKU, refund-instruction fields
[ ] Social media / website recall-notice template current
[ ] Brand/distributor contact list current for all products on shelf (for Step 1 disposition coordination)
[ ] State DCC Recalls Portal bookmarked and monitored on a defined cadence (CA: daily check recommended)
[ ] Last quarterly drill completed within 90 days
[ ] 7-year retention filesystem organized by recall ID

Integration with Ongoing Operations

Monthly ops review: The Compliance Manager reports on recall readiness at the monthly ops review -- drill status, open recall-incident tickets (if any), DCC Recalls Portal notices received that did NOT affect the retailer's on-hand inventory (still worth logging for trend awareness), and any supply-chain corrective actions flowing from post-mortems into brand/distributor relationships.

Brand-onboarding gate: A recall readiness check is part of the brand-onboarding gate -- before carrying a new brand, the receiving-QC team (see receiving-qc.md) confirms the brand has a documented recall process and a named compliance contact.

Hiring and training: All budtenders receive a recall-response briefing at onboarding -- where the quarantine area is, who the compliance manager is, what to say to a customer who arrives with a Retail ID QR recall screen, how to process a recall refund/exchange through the POS.

Recall Economics

A recall is a cost event. Understanding the cost components helps retailers plan reserves and negotiate financial responsibility with brands and distributors.

Cost Components Per Recall

Direct costs:

Product loss -- on-hand quarantined units; usually reimbursed by brand/distributor via return-credit, but reimbursement timing is often 30-90 days
Customer refund/exchange -- the per-unit refund paid to reached sold-through customers; a typical 60-80% reach × 15-30% refund-conversion rate on a 250-unit sold-through recall produces 22-60 refunds at an average of $30-$50 per unit, or $660-$3,000 per recall
Destruction cost (if destroy-on-site path is chosen) -- render-unusable labor, witness time, Metrc logging time, waste-disposal vendor fees; typically $200-$500 per recall

Labor costs:

Compliance Manager time -- ~8-16 hours per recall across the 8-step lifecycle
Inventory Lead time -- ~4-8 hours for quarantine, pull, and disposition
Marketing Lead time -- ~4-8 hours for customer notification across channels
Budtender / floor-staff time -- ~2-4 hours distributed across refund/exchange processing

Indirect costs:

Lost sell-through -- displaced sales of the recalled SKU until replacement stock arrives
Customer-trust impact -- real but hard to measure; effective notification tends to preserve rather than damage trust (customers appreciate being told)
Brand-relationship dynamics -- a recall tests the brand/retailer financial arrangement; repeat recalls from the same brand typically trigger a re-evaluation of that brand's shelf space

Typical total cost for a mid-size CA retailer on a typical recall: $2,000-$8,000 (labor + refunds + destruction, pre-reimbursement); $500-$2,000 (net after brand/distributor reimbursement of product cost and partial refund credit).

Financial Responsibility Allocation

The default allocation, where contractually agreed:

| Cost Component | Retailer Bears | Brand/Distributor Bears | |-----------------|----------------|--------------------------| | On-hand product cost | No (credit-back) | Yes (full credit or replacement) | | Customer refunds | Sometimes (front the cash, bill back to brand) | Yes (ultimately, via retailer bill-back) | | Shipping cost (return path) | No | Yes | | Destruction cost (destroy path) | Yes (usually) | Sometimes | | Labor cost | Yes | No | | Lost sell-through (opportunity cost) | Yes | No |

Contract clauses worth negotiating (especially with newer or smaller brands):

"Brand will reimburse Retailer for all customer-refund payouts within 30 days of submission of refund documentation"
"Brand will reimburse Retailer for destruction costs incurred when destroy-on-site is the brand-directed disposition path"
"Brand will provide Retailer with a current recall-response contact list and will update it within 24 hours of any change"

Recall Communication Templates

Ready-to-adapt templates reduce response time during a real recall. Keep these current in the compliance filesystem.

Template 1 -- Internal Notification Email (Recall Response Team)

Subject: [URGENT] Recall Response Activated -- [Recall ID] -- [Brand] [Product]

To: Compliance Manager; General Manager; Inventory Lead; Marketing Lead; Senior Budtenders

Body:

A recall notice has been received. Activating the 8-step recall-response lifecycle immediately.

Recall ID: [CA-YYYY-NNN or brand-assigned ID]

Classification: [Mandatory -- DCC] or [Voluntary -- brand-initiated]

Brand: [Brand name]

Product(s): [SKU list]

Affected batch(es): [batch IDs]

Reason: [reason]

State clock: [CA 24h notice / 72h quarantine / 10d closure OR other-state]

Next-30-minute actions:

Compliance Manager: Open recall-incident ticket; run Metrc trace (Step 2)

Inventory Lead: Locate affected on-hand packages; prepare quarantine area (Step 3)

Marketing Lead: Prep POS purchase-history query + loyalty CRM recall-campaign draft (Step 5)

Senior Budtenders: Hold briefing at next shift change

Full lifecycle owner: [Compliance Manager name]

Template 2 -- Customer Notification SMS (Loyalty)

[Retailer]: A product you purchased has been recalled by [brand]. Please bring unused product to [store] for a full refund/exchange. Recall ID: [ID]. More info: [short URL]. Questions: [phone]. Reply STOP to opt out.

Template 3 -- Customer Notification Email (Loyalty)

Subject: Important: Recall Notice for a Product You Purchased

Body:

Dear [customer first name],

[Brand] has issued a [mandatory/voluntary] recall on [Product Name] (SKU [SKU], batch [batch]). Our records show you purchased this product from [Retailer] between [start date] and [end date].

Reason for recall: [short reason]

What you need to do: Please bring any unused product to [Retailer] at [address] for a full refund or exchange. Store hours: [hours]. No receipt needed -- we can look up your purchase by phone number or loyalty account.

Refund process: [cash / card / store credit -- per brand instructions]

Recall ID: [CA-YYYY-NNN or brand ID]

Full recall notice: [attached PDF or linked page]

Questions: Call us at [phone] or reply to this email.

Thank you,

[Retailer] Compliance Team

Template 4 -- In-Store Signage (Entrance / POS Counter)

PRODUCT RECALL NOTICE

Brand: [Brand] Product: [Product name] Batch: [batch IDs] Purchased between: [start date] and [end date]

The [brand / distributor / CA DCC] has issued a [mandatory / voluntary] recall on this product for [reason in plain language].

If you have purchased this product: Please bring it to [Retailer] for a full refund or exchange. No receipt required -- staff can look up your purchase by phone or loyalty account.

Recall ID: [CA-YYYY-NNN]

Questions: Ask any staff member or call [phone].

Posted: [date and time]. For the latest official recall information, visit recalls.cannabis.ca.gov.

Template 5 -- Social Media Post (Instagram / Facebook)

PRODUCT RECALL NOTICE

[Brand] has issued a recall on [Product Name]. If you purchased this product from [Retailer] between [start] and [end], please bring it in for a full refund.

Recall ID: [CA-YYYY-NNN]

Full details: [link to retailer website recall page]

Official DCC notice: recalls.cannabis.ca.gov

Questions: DM or call [phone].

#CannabisRecall #PublicSafety

Template 6 -- Retailer Website Recall Page

[Brand] [Product] Recall -- [date]

Published: [date and time]. Last updated: [date and time].

[Brand] has issued a [mandatory / voluntary] recall on [Product Name] (SKU [SKU], batch [batch IDs]) due to [reason]. The recall was issued by [CA DCC / brand] on [date]. Recall ID: [CA-YYYY-NNN].

What was recalled:

[Product name] -- SKU [SKU] -- Batches [batch IDs] -- Manufactured [date range]

Why: [Reason in plain language, 2-3 sentences]

What to do if you purchased this product:

Stop using the product immediately

Bring it to [Retailer] at [address] for a full refund or exchange

No receipt required -- we can look up your purchase

Store hours and refund process: [Hours, refund process per brand instructions]

Questions: Call [phone] or email [compliance email].

Official notice: [Link to DCC Recalls Portal listing]

Cross-Reference Index

| Topic | Reference File | Section | |-------|----------------|---------| | SOP index for recall response | sops.md | §Product Recall Procedures (the SOP-level index; this file is the operational playbook that extends it) | | Metrc mechanics (admin-recall, Retail ID QR) | tech-compliance.md | Full file | | Loyalty CRM platforms and segmentation | tech-crm-loyalty.md | Platform sections | | Failed-test trigger pipeline | coa-testing.md | Surveillance testing; retest failures | | Waste and destruction of recalled product | waste-management.md | Render-unusable; witnessed destruction | | Cannabis advertising platform constraints (for social notification) | marketing-regulations.md | Platform policies | | State-by-state baseline legality | legality.md | State summaries | | POS platform recall queries | tech-pos.md | Platform-specific query patterns | | Receiving-side COA verification (upstream recall prevention) | receiving-qc.md | COA verification at intake |

Data current as of early 2026. CA-specific recall volume figures (63 notices / 259 products / ~25K units) date-tagged to 2024 per A6. Metrc Retail ID direct-to-consumer QR feature launched via Bulletin CA-2025-006 in August 2025; CA-only as of early 2026 per A3. Verify live DCC Recalls Portal at recall-response time -- recalls.cannabis.ca.gov is the authoritative CA surface.