Schedule III: Taking Cannabis Out of the Shadows and Into the FDA Crosshairs
The “Wild West” of cannabis is ending, but a new federal frontier is beginning. As cannabis shifts to Schedule III, the industry must trade DEA evasion for rigorous FDA compliance. This guide breaks down the high-stakes transition from simple state tracking to pharmaceutical-grade cGMP standards. You’ll learn how to navigate the “FDA Toolkit”—including Warning Letters and Injunctions—protect your business from national recalls, and audit your SOPs to survive the most intense regulatory scrutiny yet.
Is cannabis moving out of the dark ages?
When the Executive Order on rescheduling was signed on December 18, the industry celebrated. Rescheduling cannabis means the end of the death sentence of 280E taxes and possible movement towards interstate commerce. But rescheduling is not a magic wand for cannabis; it is a major shift in regulation to federal oversight.
Once, the goal of the industry was simple: avoid the DEA at all costs. Now the industry faces a new challenge: complying with the FDA.
The Great Regulatory Pivot
The shadow era ends. For over 50 years, the goal of anyone in the cannabis industry was simply to avoid the DEA. Getting caught meant getting raided, total forfeiture of possessions, and usually, criminal charges. Attitudes started to change with state legalization, and even the federal government seemed to be getting on board after the Cole Memorandum.
But now, a new era begins, where weed is not illegal, but also not legalized recreationally. The industry is moving into an area of federal oversight, where the goal is to keep the FDA satisfied.
Let’s be crystal clear: moving cannabis to a schedule III drug is not deregulation, and it should not be treated as such. The risk becomes regulatory—getting products recalled or being issued an injunction or consent decree.
The FDA’s Enforcement Toolkit: Beyond the Raid
FDA regulation changes how the cannabis industry must approach doing business. The Food and Drug Administration doesn’t need a SWAT team to shut your business down; they take a more administrative approach.
- Form 483: a document issued to businesses after FDA inspection, where potential violations are found, with 15 business days to respond.
- Warning Letters: an escalation from Form 483, these letters are formal, public notices of significant violations. Untitled letters are issued for violations that do not meet the requirements for a full warning letter.
- Injunctions: a civil judicial process initiated to stop ongoing violations, which can stop manufacturing, sales, and/or distribution immediately.
- Consent Decrees: a legal agreement between the FDA and a company outlining specific actions companies must take to address violations.
All of these documents are considered public records, and each time one is issued, a paper trail of non-compliance is created. Each document also has insurance implications for companies; a warning letter can freeze business credit lines and trigger D&O claims.
cGMP: The New "License to Operate"
With FDA oversight comes new compliance guidelines, mainly Current Good Manufacturing Practices (cGMP). Most cannabis programs focus on seed-to-sale tracking, with emphasis on testing the final product. cGMP focuses on process validation throughout the entire process.
It’s a massive shift in how regulatory oversight for cannabis companies will work. The documentation burden is firmly on companies; if it isn’t documented, it didn’t happen. Your compliance chain becomes as weak as your weakest vendor, and unfortunately, the burden of validation sits firmly with each company. If you’re not already asking for audits of third-party partners like extractors and packagers to ensure pharmaceutical-grade standards, you need to be.
Action item: Now is the time to brush up on cGMP and the gaps between your current SOPs and Title 21 of the Code of Federal Regulations.
The Insurance & Liability Frontier
Rescheduling cannabis has big implications on the cannabis insurance market, because insuring a Schedule I drug carries far more risk than a Schedule III drug.
Changes in Underwriting
Even the smallest changes can have an impact on underwriting cannabis insurance policies, and a shift to federal regulation is a major change. Underwriters are now likely to require cGMP audits of businesses and facilities before renewing policies or increasing limits to ensure there are no exposure gaps.
More Product Recall Insurance
As a Schedule I substance, most cannabis recalls were voluntary and took place on a state level. But as a Schedule III substance, the FDA can require a national recall. What happens to your balance sheet when $10M+ worth of products have to be pulled off the shelf within a few days?
Increased D&O Exposure
When the FDA gets involved in operations, shareholders tend to get uncomfortable. There’s often a spike in shareholder lawsuits after the FDA issues a Warning Letter. The transition to federal compliance is a risky time, and “failure to supervise” during a transition is a major threat to new board members.
The "Unapproved Drug" Conflict
Nothing is a simple change in cannabis, and shifting to federal oversight of a Schedule III substance creates a new paradox for recreational cannabis businesses; what’s legal on the state level may be an “unapproved drug claim” in the eyes of FDA.
As a federally regulated substance, the Federal Trade Commission can also get involved if your business is thought to be marketing Schedule III substances as a wellness supplement—and you better believe they keep an eye on FDA Warning Letters and are capable of issuing their own.
Cannabis companies will have to navigate creating a claims wall of separation between lifestyle marketing and medical claims or therapeutic language. Many states are already strict on this, but the FDA is even more strict.
Where To Go From Here? The Sophistication Test
The first place to start while navigating the transition to federal oversight is with an internal audit. Leaders in the company need to take stock of current SOPs and marketing language and ask themselves vital questions, including:
- Do our COA (Certificate of Analysis) procedures meet FDA data integrity standards? If not, where is the deviation, and how big is it?
- Does our website or social media contain “unapproved health claims” according to FDA guidelines?
- Where does our internal documentation process fall short? Where can it be expanded to cover the documentation burden?
- Does our current Product Liability policy include Involuntary Recall coverage? Do we need increased Product Recall coverage?
- Are our manufacturing partners willing to sign a “Right to Audit” agreement for cGMP? If not, what is the cost and timeline of finding partners who will?
- Are we ready for an FDA audit?
Your risk management plan should cover many of these details. As a living business document, your risk management plan should also be updated to reflect new policies and changes based on FDA regulations. Last year’s risk management plan concerning state oversight won’t go far enough for the new world of federal oversight.
Enter the Pharma Era of Cannabis
For many years, the cannabis industry has been compared to the wild west, with companies seen as renegade cowboys—but this is over. As a Schedule III substance, cannabis will now be subject to the intense scrutiny of the FDA, which changes the game for leaders in this space.
Your job is no longer to grow and sell plants; you now manage a company operating in a high-stakes regulatory system. Cannabis isn’t the government’s favorite substance, and chances are good that the FDA will begin to crack down on large cannabis companies to make an example. It’s now on leaders to build a company too compliant for the FDA to hit.
