We Regulate Cannabis Like It Is Uranium
A now-former cannabis commissioner would say to me, whenever I would update them on our plan to enforce a regulation they didn’t necessarily understand, “you act like we’re regulating uranium!” She did not mean it as a compliment. She meant we had overdone it. Tracking every gram from seed to sale. Surveillance footage retained for ninety days. Background checks and fingerprints reaching layers into ownership. Packaging requirements that read like pharmaceutical labels. Testing protocols a craft brewery would find excessive. Suitability reviews for anyone who touched the plant. She thought we had built a regulatory regime out of proportion to the substance and the risk.
Most licensees probably agreed with that commissioner. The complaint was not unreasonable. The framework was built fast, in jurisdictions that had never regulated a federally illegal product before, by lawmakers who knew their statutes would be read by federal prosecutors looking for enforcement priorities…and skeptical voters. Heaviness was a feature when the framework was drafted. It looked like overreach a few years later, after the feds had moved on and legalization expanded into more markets.
I helped write some of those rules. I have heard the uranium line more times than I would care to. The complaint had merit, in places. So, what if we actually did regulate cannabis like uranium?
The nuclear industry operates inside a regulatory framework that is heavier than anything cannabis will ever face. Not by a small margin. By orders of magnitude. Tracking and accountability requirements that make seed-to-sale look casual. Inspection regimes that make state cannabis enforcement look friendly and pleasant. Disclosure obligations that make 280E look discretionary. Personnel suitability standards that reach into the family histories of senior operators. The system is enormous, and the industry has lived inside it for fifty years without losing the ability to operate. The reason is that the industry built an entity to live alongside their regulator. A self-regulatory body that sets industry standards, certifies compliance, and rules against members who fall short.
“After all that complaining, maybe cannabis should be regulated like uranium. The industry can self-police while the regulators chase actual bad guys. ”
After Three Mile Island, the utilities built the Institute of Nuclear Power Operations. INPO sends peer evaluation teams from competitor utilities to every member plant on a two-year cycle, publishes findings, holds bad actors and their executives accountable, and gives the Nuclear Regulatory Commission a counterparty inside the industry that knows the technical work as well as the regulator does. The utilities pay roughly $112 million dollars a year for it, a little more than $1 million dollars per reactor. They pay it because the alternative is an enforcement environment in which every reactor pays for the conduct of every other. The system stayed heavy. The industry built themselves capacity to operate inside it.
After all that complaining, maybe cannabis should be regulated like uranium. The industry can self-police while the regulators chase actual bad guys. In fact, one of the best justifications for such an organization came to light on Monday in Illinois.
The class action filed in the Northern District of Illinois names Cresco Labs, Green Thumb Industries, and Verano Holdings in the federal caption, with Curaleaf named in parallel state filings. The complaint runs more than three hundred pages on behalf of thirty plaintiffs across thirteen states, and pleads RICO alongside fraud and consumer-protection claims. The allegation is that the companies marketed cannabis products as therapeutically beneficial without adequate evidence. The actual merits will be tested over years of motions and litigation, and this is not a commentary on the case. What the litigation surfaces, regardless of outcome, is the cost of an industry that has not built its own responsibility infrastructure. There is no industry-wide standard for what cannabis operators may say about the medical benefits of their products, aside from “just don’t,” and no industry body with the standing to draw the line. The door was open before this complaint was filed. It is still open.
The same gap shows up everywhere the industry meets public-health pressure. Prop 65 settlements in California run quietly between $50,000 and $500,000 per case, paid because operators have no defensible record of compliance with industry-developed standards to point to. State regulators and courts in Texas have written, withdrawn, restored, and rewritten hemp rules in compressed cycles, because no industry-side voice has the standing to propose the alternative they would actually find reliable. State lawmakers in Connecticut, Massachusetts, New York, and elsewhere have reversed potency liberalizations within weeks of passing them, because no credible non-prohibitionist voice has standing in these state capitols. The need is there. If there is a way, is there the will?
The cleanest working example is the Portman Group in the United Kingdom. Founded in 1989 by alcohol producers responding to advertising controversies that threatened statutory regulation. A complaint comes in about a brand. The complaint might allege that the packaging looks too much like a soft drink, or that the marketing implies health benefits the evidence does not support, or that the audience composition for a campaign skews too young. An independent panel convenes. The panel includes lawyers, public-health representatives, and consumer advocates, structurally separated from the producer members who fund the institution. The brand submits its case. The complainant submits theirs. The panel rules. The ruling is published with reasons. If the ruling goes against the brand, the brand revises or pulls. The institution publishes its uphold rate, which has run roughly thirty to forty percent across complaints adjudicated since 1996. That is what genuine adjudication looks like in both theory and practice. The cost of running it is between one and two million pounds a year. It works because the panel is insulated from the funders, the rulings are public, and the members have agreed in advance to be governed by it. And they abide by that promise.
The cannabis version works on the same model. A complaint comes in: a marketing campaign that claims more than the evidence supports, a label that misrepresents potency, a packaging design that crosses the line on appeal to minors. The operator gets notice and a real chance to respond. The panel convenes. The chair is independent. The members include public-health representatives, consumer advocates, industry voices, and qualified experts. None of them are political appointees or has-beens looking to grab another headline or settle a score. None of them are strangers to the work. They know cannabis at the level the operator does, and they apply the standards the operator agreed to when it joined. The operator submits its evidence. The complainant submits theirs. Each side is heard. The panel rules. The ruling is published with reasons. If the operator falls short, the choice is to revise the practice or lose certification. Operators who have done the work get a fair forum. Operators who have not get held to a standard the industry itself has agreed is reasonable.
“The institution does not eliminate state enforcement, private litigation, or regulatory scrutiny. It produces a record against which all of them can be measured.”
Rulings travel, too. Other certified operators read them and adjust. State regulators in jurisdictions that recognize the certification take the rulings into account when assessing whether an operator is acting in good faith. Plaintiffs' counsel preparing the next consumer-protection action notice that operators certified under the standard have a substantively different evidentiary record than operators who are not. The institution does not eliminate state enforcement, private litigation, or regulatory scrutiny. It produces a record against which all of them can be measured.
These three functions only work together. Standards without certification are aspirational. Certification without complaints adjudication has no teeth. Complaints adjudication without standards has nothing to enforce. The institution is the machine that turns all three into one. The old three-legged stool.
You can’t just slap together three legs and call it a stool, though. It has to be built in sequence, the way the comparable institutions were built. The first task is the standards fight. Agreeing on what the standards say will take a year, possibly more. Larger operators will push for thresholds they can already meet. Smaller operators will push for compliance costs they can realistically absorb. Public-health representatives will push for stricter language. Patient advocates will push for product access. The technical work at ASTM and elsewhere will be tested against operating realities the standards have not always reckoned with. The fight matters because the bar has to sit ahead of current practice. Standards that ratify what operators are already doing certify nothing. Standards that elevate require concession from everyone, which is why the fight is uncomfortable and why the result has weight.
Once the standards exist, certification follows. Audit infrastructure gets stood up. The first cohort of certified operators goes through the cycle. The certification mark begins to earn recognition with retailers, distributors, and state regulators. That work takes another two to three years to reach scale. The complaints function comes online meaningfully only after certification has produced a body of practice the panel can apply, and a population of certified operators large enough that rulings travel through the industry rather than landing in isolation. The full institution is a five-year build, not a launch event.
What holds the build together is buy-in, and buy-in has to be real. Not a logo on a website. Not a panel seat for the optics. Not a defense to invoke when sued. Operators who sign the standards live by them when commercial pressure pulls the other way, or the standards are not standards. Shortcuts get called out. Bad actors get exposed. Consensus is survival. Without it, the institution becomes another credentialing body whose certification means nothing. The cannabis industry has plenty of those.
“The institution that tries to do everything will do none of it well, and the cannabis industry will be left with one more underperforming body claiming a credibility it has not earned.”
The discipline of building this institution is in what it refuses to do. It does not lobby. It does not run consumer education campaigns. It does not provide litigation defense or insurance coverage. It does not solve federal banking. It does not produce social equity outcomes. It does not absorb the testing variability problem that fragmented state markets produced. Each of those is real work and real work that cannabis needs done. None of it belongs inside this entity. We learned this lesson the hard way on the regulator side. State cannabis regulators were saddled with economic development, social equity, public health, public safety, licensing, and revenue functions that very few, if any, other agencies carry simultaneously. The result? None of those functions are performed at the standard of regulators in mature regulated industries. The same trap is in front of any cannabis self-regulatory body. The institution that tries to do everything will do none of it well, and the cannabis industry will be left with one more underperforming body claiming a credibility it has not earned.
The cautionary case here is the chemical industry. Responsible Care launched in 1988 as a voluntary code with no third-party verification, no public adverse findings, and no enforcement against members who fell short. Independent researchers later documented that participating firms raised their toxicity-weighted pollution by about sixteen percent relative to non-participants. The mechanism the research identified is the one cannabis would reproduce most easily: a credentialing program's reputational cover lets the worst actors externalize more aggressively while compliant members do the visible work. The certification ends up subsidizing the operators it should be exposing.
The vapor industry got seven years between FDA gaining authority over tobacco products in 2009 and the Deeming Rule arriving in 2016. The voluntary codes the industry produced had no third-party verification, no enforcement, and no public-health participation in their governance. The FDA treated them as essentially irrelevant when premarket review hit. By July of 2024, the agency had issued thirty-four marketing authorizations for the entire category. Most of the operators who participated in the failure are gone. Cannabis on the hemp-derived side is closer to the vapor industry's 2014 than to its 2009. The federal hemp definition rewrites itself in six months. The DEA hearing on broader Schedule III placement convenes June 29th. The vapor industry did not survive its window. Cannabis has less time.
There are four questions any organization like this has to answer over the years it operates. Stakeholders and skeptics, including prohibitionists, alike are going to ask them whether the organization invites them or not.
Does the organization publish research its funders would prefer not to publish?
Has it taken adverse action against its largest, most commercially significant members?
Has it supported statutory regulation of its members' practices when voluntary mechanisms fall short?
Are its governance decisions transparently documented and publicly accountable?
The answers will be visible within five years. The work to make those answers possible has to start now.
The next twelve months are the standards-setting fight. A convening of large and small operators, hemp-derived producers, equity stakeholders, independent laboratories, ASTM Committee D37, public-health representatives, clinicians and medical-cannabis researchers, patient advocates, and CANNRA in one room, with a defined deadline and a published work product. That fight is uncomfortable and it is necessary, because it is the fight that gives the standards their weight. The twelve months after that are the certification rollout: audit infrastructure stood up, the first cohort of operators going through the cycle, the mark recognized by the first state regulators or lawmakers willing to accept it as evidence of good-faith operation. The complaints function comes online in year three, with a body of practice the panel can apply and enough certified operators for rulings to travel.
That schedule is realistic. Slower would mean the entity does not exist when the regulatory concrete forms. The November hemp deadline and the June 29th Schedule III hearing will not wait for the industry to get its shit together. The regulatory architecture that emerges from those decisions will be built around whoever is in the room when it sets. Right now, on the industry side, the room is empty or fighting amongst itself to figure out who drives off the cliff first.
The cannabis industry has the capital, the operating scale, and the regulatory pressure to do this. What it has not yet shown is the willingness. So, when should we meet?
