TLDR: 21 C.F.R. § 1301.13(k) builds the federal medical pathway on deference to your state program: the registration is automatically suspended if the state license is, and labeling, security, and records lean on state law. Your state compliance program now has federal consequences. Audit it through a federal lens.
Reading the April 2026 rescheduling order can feel overwhelming. That overwhelm can make it hard to see the practical implications operators should consider while we wait for guidance.
If you fall into this category, I recommend reading 21 C.F.R. § 1301.13(k) and its subsections. Among other things, they summarize the April 2026 rescheduling order’s deference to state programs. Pay close attention to § 1301.13(k)(3):
This subsection encapsulates the overall theme mentioned above: the federal pathway for state-licensed medical operators is built, in part, on deference to state compliance programs. That means your state compliance program now has federal consequences.
Here are three other key § 1301.13(k) subsections where we see deference to state programs:
Packaging and labeling. Section 1301.13(k)(8) is a conditional exemption: registrants are exempted from specified DEA labeling, packaging, and sealing requirements, on the condition that they comply with state labeling requirements and carry the federal transfer warning under 21 U.S.C. § 825(c) where applicable.
Security. Section 1301.13(k)(10) addresses physical-security requirements and requires compliance with state law.
Records. Section 1301.13(k)(4) requires DEA to accept state-required records, reports, and forms as far as federal requirements permit.
But what does this mean from a practical perspective? It means whether that deference is a strategic advantage or a vulnerability depends on the strength of your state compliance program. If you aren’t taking your state compliance program seriously, start now.
To ensure it’s an advantage, audit your state compliance program through a federal lens:
- Licenses and disclosures. Every license active, renewals calendared with margin (remember what “expires” does under (k)(3)), and every owner and financial interest disclosed the way the structure actually is today.
- Labels. Sampled against current state requirements, with the § 825(c) transfer warning where applicable.
- Physical security. The plan as written versus the floor as operated, camera coverage to access controls.
- Records and track-and-trace. Manifests, inventory reconciliation, the gaps between the system of record and the physical count, kept well enough that (k)(4) deference works FOR you.
The audit should produce something you can act on: a written list of gaps, a named person responsible for each, a correction deadline, and evidence of completion when it closes. If it’s not documented, it didn’t happen.
Hopefully that provides a bit of direction. But I’m curious what you think: which areas should operators focus on first when auditing their compliance program? My vote is for inventory reconciliation, but let me know what you think. Email me; I read every response.
Thanks for reading,
Ryan
P.S. If you want a second set of eyes on your compliance program, I’m now offering an affordable monthly flat-fee membership called the Operator Retainer. $1,500 a month, flat: a written Compliance Baseline of your operation in your first 30 days, a monthly strategy call, a monthly contract review, your questions answered, the front of the line the day a regulator’s document shows up, and my full toolkit customized to your operation. Month to month, cancel anytime, and if the first month is not worth it, I will refund it. Current terms on the Operator Retainer page.
Keep reading
Attorney advertising. This issue is general information about federal and state cannabis law, not legal advice about your situation, and reading it does not create an attorney-client relationship. Requirements vary by operation, license type, and jurisdiction and change often; confirm the current text of every authority before acting.