On July 15th Governor Beshear announced the approval of the first cultivation facility to commence operations in the state, with more to follow soon. Despite starting to approve operations for cannabis facilities, the Kentucky Office of Medical Cannabis (“OMC”) is continuing to release guidance documents. As licensees prepare for inspections and launching operations, it is essential that they monitor ongoing OMC guidance and are taking steps to ensure that their facilities and procedures align with such guidance.
For example, OMC released two technical advisories earlier this month, “Security Requirements for Limited Access and Restricted Areas” and “Failed Medical Cannabis Product Testing and Dry Weight Standard.” Licensees, whether operating or moving towards approval to begin operations, will be required to comply with the standards outlined in these guidance documents. This post provides an overview of the newly issued guidance for licensees.
Clarified Security Requirements
Under KRS 218B.095(1)(c), medical cannabis business licensees in Kentucky must implement adequate measures to prevent both the theft of cannabis and any unauthorized attempts to access areas that store or process cannabis. Technical Advisory 2025-006 clarifies and expands upon these obligations with respect to limited access or restricted areas.
The advisory provides that all licensed cannabis facilities must install electronic access controls—such as key fob or digital badge systems—in limited access or restricted areas. These mandatory electronic access controls are in addition to required commercial grade locks on doors in these areas. Thus, any portion of the facility designated as a “limited access” or restricted area must be secured by both commercial-grade locks and the facility’s electronic access system. The OMC specified the four critical areas where these layered security measures are mandatory:
- Facility Entrance Points
Facility entrances must be secured with an electronic access control system that restricts entry to access holders. - Entrances to Limited Access or Restricted Areas
This includes any area on the premises of a cultivator, producer, processor, safety compliance facility, or dispensary where medical cannabis or related materials are handled, including areas where medical cannabis or plants are grown, processed, tested, packaged, stored, destroyed, or loaded into or out of transport vehicles; where security alarm or surveillance equipment is stored or maintained; and where medical cannabis waste is processed, stored, or destroyed. - Entrances to Security Alarm and Surveillance Centers
Rooms that house the equipment operating the surveillance systems and the security alarm infrastructure require extra caution, as these areas serve as the operational backbone of the licensee’s entire security framework. - Entrances to Vault Storage
Any vault (or equivalent secured facility) used to store medical cannabis or cannabis-derived products overnight must likewise have an electronically controlled access mechanism.
Licensees may choose to secure additional areas with electronic access controls, however licensees must be sure to implement the required electronic access controls in addition to the full security and surveillance requirements for licensed medical cannabis businesses set forth for cultivators in 915 KAR 1:030 Section 7, processors in 915 KAR 1:040, safety compliance facilities in 915 KAR 1:060 Section 11, and dispensaries in 915 KAR 1:070 Section 11. For example, licensees must be sure to have an alarm system, surveillance system, commercial-grade locks and electronic assess controls at all entrances to licensed facilities.
Failed Testing Procedures: Understanding the Two-Step Framework
OMC issued Technical Advisory 2025-007 following the release of its Testing and Remediation guidance. The advisory expands and clarifies the prior guidance by outlining procedures for handling production or harvest batches that fail initial testing.
When a harvest or production batch fails any element of the required testing panel, 915 KAR 1:110 Section 4(1) allows a “re-analysis” using the reserve sample. Either the licensee or the laboratory may request the re-analysis. When conducting a re-analysis, the full panel must be re-performed; selective re-testing of only failed categories is expressly prohibited.
The initial failing results are not entered into Metrc. Only the re-analysis outcome becomes the official Certificate of Analysis (“COA”). However, laboratories must maintain an external log documenting: (1) the individual or entity requesting the re-analysis, (2) the reason for the request, and (3) a copy of the initial failing COA. This log must be kept contemporaneously outside of Metrc and made available to OMC upon request.
When the harvest or production batch fails the re-analysis using the reserve sample, then licensees should conduct a “re-test” using a new test sample from the same batch. If the harvest or production batch is eligible for remediation under 915 KAR 1:110 Section 5, the re-test should occur after the batch has been remediated. Licensees should clearly distinguish “re-analysis” from “re-test” in all internal procedures related to failed testing.
The advisory also clarifies that all medical cannabis test results must be expressed on a dry-weight basis. If you have any questions regarding the implementation of these requirements or would like to discuss any aspect of the latest technical advisories, please contact us.
