by NCIA’s State Regulations Committee
Contributing authors Jennifer Gallerani, Erin Fay, and Elise Serbaroli

This is the second in a three-part blog series. The first part can be read here.

Highly regulated industries typically require key information to be readily available to regulators related to the production, movement, and sale of products, which is the case in the cannabis industry. The two main reasons for “seed-to-sale” record keeping are (1) to reduce the diversion of cannabis products to the unregulated market and (2) to protect consumer health with an efficient track and recall product method. 

However, cannabis operators are facing many challenges with the state-mandated track-and-trace requirements, causing their business operations to suffer inefficiencies, delays, and sometimes even interruptions, which can ultimately impact consumers and patients. This is the second blog in a series highlighting the issues that cannabis operators and regulators are facing with the current centralized state-mandated track-and-trace model from NCIA’s State Regulations Committee, Technology and Compliance Sub-Committee. 

The point of frustration begins with the method in which the track-and-trace requirements are implemented. Most U.S. states with some form of legal cannabis sales (medical and/or adult-use) have selected a single mandated technology platform that all operators must use to track and trace their cannabis seeds, plants, and products. The track-and-trace system selected by the state is independently configured to match the adopted cannabis regulations for that region. Because each state has adopted different cannabis regulations, there are variations in what can and cannot be accomplished within the selected track-and-trace systems, even within the states that have selected the same technology provider.  

What is an API?

While the definition of an API may seem complex, at its most basic level, the API is the communication pathway between two systems. API stands for “application programming interface,” which means that it is a software intermediary that allows two systems to “talk” to each other, meaning communicating and sending or receiving information. The communication pathway is intended to be two-way, with third-party business management software being able to retrieve (“GET”) information in the track-and-trace system, as well as send (“PUT”) updated information back into the system.

Let’s turn to an everyday example of an API integration that most consumers would be familiar with: travel booking applications that aggregate flight information. Let’s say you are planning a flight for a summer vacation and you have two options: go directly to each airline website to search for and compare flight options, or use a third-party travel booking application to simultaneously access all flights across all airlines within your search parameters. The ability to search and review all the available flights, across many airlines, is because of the airlines’ and applications’ APIs.  When you use the travel booking application, it sends the search parameters to the airlines it is connected with via the API. The airline API then sends available flights, seats, and prices to the travel booking application. In the more sophisticated travel booking applications, you can also purchase the ticket for your flight through the travel booking application, which then also utilizes other APIs for your secure banking/payment information. If all of the APIs are open to send and receive data between the systems, then the transaction is seamless, and all of the required information (identity verification, payment method, etc.) is shared with the airline for your booking.

Understanding API Limitations in Cannabis 

State regulators intend for the cannabis track-and-trace technology to serve as a way to accurately collect and record information about the flow of goods in the cannabis industry from seed to sale. What is consistent across all states, regardless of the track-and-trace technology selected, is the acknowledgment from regulators that the mandated systems are not intended to serve as an operator’s compliance solution or business management software system. The state-mandated track-and-trace systems are not built in a way that would allow a business operator to manage day-to-day operations and transactions between operators and retailers to consumers.

This acknowledgment of the business management limitations within the track-and-trace systems and the need for interoperability with operators’ own software is often stated outright by regulators and policymakers and/or codified in regulations, such as in California’s Business and Professions Code (Clauses (b) and (c)). Instead of directly managing operations within the track-and-trace systems, cannabis businesses utilize third-party software that has been vetted and certified to connect with and communicate important transaction details to the state systems. Cannabis operators are then relying heavily on third-party software and API integrations for the communication and transmittal of that important information and data. 

State-Mandated Software Providers Set Regulators And Operators Up To Fail 

Now let’s think about how cannabis businesses utilize APIs on a regular basis: for example, point-of-sale (POS) software. Regulations require that the cannabis retailer record all sales in the central, state-mandated track-and-trace system, but the actual on-site transaction is conducted through POS software at checkout. The retailer is therefore encouraged to use POS software that provides the necessary sales tools and controls that make running the business manageable for all employees, while also providing API integration with state-mandated track-and-trace systems.

Without the API integration, a retailer would be forced to manually enter all of the details of all of the POS transactions into the track-and-trace system on a daily basis. Hundreds of daily sales without an API integration means many hours of data entry and countless opportunities for human errors in the track-and-trace system. Opportunities abound for inaccurate reporting in the track-and-trace systems with manual entry. Regulators rely on the track-and-trace system they selected to ensure compliance and consumer safety, although operators are essentially utilizing third-party software to communicate with the track-and-trace system. This is exactly why it is important that the cannabis industry has an open and operating track-and-trace system API at all times. Any time the track-and-trace API malfunctions (limited in communication pathways, delayed in responding to POS requests for information, or just completely down), the cannabis retailer operations are severely impacted, if not altogether halted.

In current situations where the state has mandated a specific software provider, the vendor approves specific POS and other software vendors, but the agreements the vendor has with the state does not allow for direct support to the approved vendors. This causes challenges as a licensee’s POS vendor cannot talk directly to the vendor to get API issues resolved. There is also no direct line of communication to the approved vendors about changes happening in the state-mandated software provider’s system that affects the API. These types of issues can cause the licensee (cannabis operator) to be out of compliance without even knowing it.

From The Operator’s Perspective

Imagine that you are a budtender trained on your employer’s POS software, compliance and track-and-trace requirements. Very rarely will you access the statewide system directly because the POS is fully integrated with the track-and-trace API. You are working during your daily shift processing retail transactions through the POS, but unfortunately, the track-and-trace API is experiencing high call volumes from all of the other retailers in the state, and the API is not responding to your POS requests. You cannot complete the transaction in the POS as usual, so you are forced to complete and track the transaction manually. Later on, you have to spend hours manually entering which unit of product came from which box in the back storeroom, along with all of the customer’s information and time stamps. This takes hours of labor and could lead to mistakes (hey, we’re human!). As we stated, manual records and entry invite human error. Now the inventory listed in your POS software does not match the statewide track-and-trace system. You spend many more hours trying to find and correct this mistake. The circle of conducting sales transactions, recording and tracking it manually, and fixing errors, widens, all putting your cannabis business at risk.

Because cannabis businesses at every point of the supply chain (i.e., cultivation, manufacturing, distribution, and retail) rely on third-party software to manage their operations effectively and efficiently, a hiccup in the track-and-trace API has ramifications for an entire statewide industry at once. While this sounds like a “perfect storm” scenario that only happens every once in a long while, in reality, track-and-trace API performance issues happen on a regular basis.

In California, a group of third-party software integrators reviewed track-and-trace API performance over a period of six months (April 2020 through October 2020) and found that the API was generally up and fully responsive approximately 91 to 98 percent of the time. While an API performance ranking in the high nineties may seem acceptable, the technology industry considers 99.999% uptime as the standard for high availability. An availability of 94 to 98 percent means 2-6% downtime, which is effectively 3 to 8 hours of downtime per week. More recently, the California Metrc API (CCTT-Metrc) experienced consistent outages for approximately 17 consecutive days (February 16, 2021 – March 5, 2021). This extensive outage caused all third-party software integrators serious Metrc-sync issues for packages, transfers, and more. Operators were forced to keep their staff on extensive overtime for more than two weeks in order to manually enter and/or correct information that was entered into the system while sync issues were occurring. As a result, cannabis businesses suffered as operations were interrupted, additional labor was required, and additional costs were incurred that had to be absorbed by the business.

From The Regulators’ Perspective 

Cannabis is a highly regulated industry and regulators are very concerned about the path from a cannabis seed to final sale to a consumer. The perceived public safety concerns are immense, which is what prompted the implementation of, and requirements, around track-and-trace. Put simply, regulators rely on the track-and-trace system they selected and the system is only as good as its uptime.

Many regulators focus on the track-and-trace server uptime reporting from their technology providers as an indication of how well things are running. If the server is up, then an operator can still access and update the track-and-trace system manually, and that is where most regulators stop in their understanding of the issues. API connectivity and performance is just as critical as track-and-trace server uptime in order to ensure business continuity and accurate data; and accurate data is the entire intent of the state’s mandated technology platforms. It is important that regulators assign key technical leads with the sole responsibility of reviewing track-and-trace API limitations and performance issues for their regulated industry.

Without skilled technical staff on the state’s side, when the track-and-trace API has issues, no one is aware of the problem besides technical teams at third-party software providers. The onus is on the software providers to notify all operators and inform the regulators. This leads to a delayed and fragmented flow of information to operators who are scrambling because their third-party business platforms are shut down. The responsibility of transparent notification around API performance should be on the state-mandated system provider, and no one else. The current lack of transparency on API performance and downtimes also leads to complete blind spots for the regulators, having also not been timely notified that cannabis operations in their state have halted due to API connectivity. The operators and the state should know the health of their track-and-trace systems at all times so that they can attempt to mitigate the amount of damage an outage inflicts on businesses. As with many other online platforms with APIs (i.e., SAP, Twitter, Intercom, etc.), this is typically done through the establishment of an API status page. At this time, there are no current API status pages for key track and trace vendors and, as stated above, performance issues are largely tracked and reported to regulators by the operators. In California, there are currently no performance reports required of Metrc for their system’s API availability (not including general server/equipment uptime).

Conclusion

The performance deficiencies of track-and-trace API’s are burdensome to the entire legal cannabis industry because it can cause third-party inventory management applications to collapse. Then operators are forced to duplicate and/or correct entries directly in the track-and-trace system. This amounts to countless hours lost and perpetuates inaccuracies of the data being entered into the system. Ultimately, the effectiveness of the track-and-trace system diminishes with any amount of downtime. Unfortunately, downtime and interruptions are all too common and the cannabis industry’s needs as a highly regulated industry demand a much higher success rate for its systems.

In our next blog in this series, we will compare the current centralized state-mandated track and trace model with the alternative distributed model.

Interested in joining us in establishing an effective and scalable track and trace framework for regulators and operators in the legal cannabis space? Click here to stay updated on the State Regulations Committee, and the efforts that its Technology and Compliance Subcommittee are taking to improve and advance track and trace nationally. Let’s close the information gap between operators and regulators, and help the entire industry move forward together.

Stay tuned for the next blog post in our multi-part series!

#cannabisindustry #legalcannabis #trackandtrace #wearethecannabisindustry #cannabiscompliance