Cannabis Regulatory Authority (CRA)
Last reviewed · By Chad Griffith
A Cannabis Regulatory Authority (CRA) is the state-level government agency that licenses and regulates the cultivation, processing, distribution, transport, and sale of cannabis within a state's regulated cannabis program. Because cannabis remains a Schedule I controlled substance under federal law (21 USC 812), there is no federal regulator — every state operates its own CRA with its own rule set. Examples: Michigan Cannabis Regulatory Agency (CRA), California Department of Cannabis Control (DCC), Massachusetts Cannabis Control Commission (CCC), Colorado Marijuana Enforcement Division (MED). State CRAs publish their own rule packs covering licensing, METRC reporting, lab testing, transport, security, and tax compliance.
Frequently Asked Questions
Why isn't there a federal cannabis regulator?
Cannabis remains a Schedule I controlled substance under the Controlled Substances Act (21 USC 812), making cultivation, distribution, and sale federally illegal. State-legal cannabis programs operate under state authority only — there is no federal agency analogous to FMCSA or OSHA for cannabis. The DEA's role is limited to enforcement of the federal prohibition.
What does a state CRA enforce?
State CRAs typically enforce: licensing requirements, METRC or equivalent track-and-trace reporting, lab testing requirements (potency, microbials, pesticides, heavy metals), transport manifest rules, security requirements (cameras, vault storage), employee badging, packaging and labeling, advertising restrictions, and state-level tax compliance. Enforcement actions range from warning letters to civil penalties to license suspension/revocation.
How are state CRA rules different from federal CFR rules?
State CRA rules live in state administrative codes (e.g., California Code of Regulations Title 4 Division 19, Colorado Code of Regulations 1 CCR 212-3, Michigan Administrative Code R 420.1-420.999). Each state's rules are independent — a compliance program for a multi-state operator must layer separate rule packs per state. Federal CFR rules do not apply to cannabis operations.
Which state has the most strict cannabis CRA?
Strictness varies by category. California (DCC) has highly granular packaging and lab requirements. Colorado (MED) has detailed track-and-trace and employee badging rules. Massachusetts (CCC) has rigorous social equity and disposal requirements. Michigan (CRA) has one of the most active enforcement programs by license-action volume. Most multi-state operators consider New York, Massachusetts, and California among the most operationally demanding.
Authoritative sources
Related terms
FileFlo classifies and tracks compliance documents against rule packs that map directly to the regulators referenced above. Run a free CFR-cited audit →