Procurement for Cannabis, CBD, and Medical Retailers: Licenses, COAs, Lot Tracking, and Expiry

For cannabis, CBD, medical, and pharma-adjacent retailers, procurement is half a logistics problem and half a compliance problem. Every receipt is a regulatory event: the wrong COA, an expired lot, a license that lapsed two months ago, or a transfer manifest that doesn't match the truck — any one of those turns a normal Tuesday into a state inspection. And the systems most operators end up with weren't designed for this: the POS handles checkout but not the supplier loop, the seed-to-sale or wholesaler-distributor reporting system handles state filings but not your buying decisions, and the spreadsheet handles everything in between badly.

This guide is the operator's view of how regulated-retail procurement should actually work in 2026 — for the dispensary, CBD storefront, hemp retailer, medical supply shop, or any retailer carrying licensed inventory who needs license tracking, COA storage on the lot, expiration capture on every receipt, and audit-ready history. Without rip-and-replace on the POS you already run.

If you operate a regulated catalog and you've ever gone hunting for a specific lot's COA at 11 PM, this is for you.

What's different about regulated-retail procurement

Three structural differences from regular retail procurement — and they apply across cannabis, CBD, hemp, medical, and pharma-adjacent categories alike:

1. Every line is a compliance object, not just an inventory object. A 1 oz jar of flower isn't just SKU CAN-FLW-001 — it's lot 2026-04-22-A, COA on file from Lab X dated 2026-04-08, sourced from supplier with Adult-Use Cultivation License CA-CUL-1234, transferred under Manifest M-99812, expiring 2027-04-22. The same applies for medical: a bottle of a regulated supplement is its NDC, its lot, its expiration, its manufacturer's license, and its COA. Lose any of those data points and the unit becomes unsellable, regardless of how much you paid for it.

2. The lot is the unit of recall. A vendor lot fails a heavy-metal screen three weeks after it shipped. A medical supplier issues a recall for a single manufacturing batch. Without lot-level tracking from receipt forward, you can't answer "which units of that lot are still on the shelf, which sold, and which sold to whom" without backing into it through the POS receipt history. With lot-level tracking, the answer is one query — true for cannabis flower, CBD tinctures, and medical SKUs alike.

3. Licenses expire. Suppliers, brands, transporters, testing labs, distributors with wholesaler permits — every party in the chain has a license, permit, or registration with an expiration date. The day after one expires, anything you receive from that party becomes unsellable. Most operators discover this only at audit. A compliance system has to surface lapsing licenses the renewal date, not after.

The right procurement system for regulated retail handles all three structurally — without adding manual work for the buyer.

The complete regulated-retail procurement loop

1. Catalog: which items need which documents

Every regulated item should have an explicit list of the documents it requires:

• Adult-use cannabis flower → Vendor License, Certificate of Analysis, Transfer Manifest
• CBD topicals → Vendor License, Certificate of Analysis
• Hemp-derived edibles → Vendor License, Certificate of Analysis (often two — cannabinoid panel + heavy metals)
• Medical / regulated supplements → Manufacturer License/Registration, Certificate of Analysis, Lot-level expiration capture
• Pharma-adjacent OTC under state controls → Wholesaler/Distributor Permit, COA where applicable, expiration capture
• Accessories / non-regulated → no documents required

The catalog should let you flip an item to regulated and pick from the standard document types. Receiving for that item is then blocked until the required documents are attached. Receiving for a non-regulated item — pipe cleaners, lighters, branded merch — flows normally. The compliance overhead lives on the regulated lines only.

2. Supplier licenses: capture, request, expire

For each supplier line, you need the supplier's license details before the first PO can be received:

• License number
• License type — pick from your state's taxonomy (Adult-Use, Medical Cannabis, Hemp, Cultivation, Manufacturing, Distribution, Retail, Testing Lab, Transporter for cannabis; Wholesaler / Distributor Permit, Manufacturer Registration, NDC-registered Repackager, FDA-registered Facility for medical and pharma-adjacent)
• Issuing authority
• Jurisdiction
• Issue date
• Expiration date

Two capture paths matter:

1. Enter — your team reviewed the license document directly. Fill in the fields, attach the PDF, save.
2. Request — you don't have it yet. Send a request to the supplier from inside the system; the supplier's reply is parsed and queued for review.

Then the calendar matters. Renewals approach, licenses lapse. The system has to surface lapsing licenses with enough lead time that you can chase the supplier for the new copy before the old one expires — not after a receipt has already been blocked.

3. COAs, manifests, and lot data on receipt

The receipt is where lot-level tracking gets locked in. When a delivery arrives:

• Capture the lot number (the manufacturer or cultivator's, not yours)
• Capture the expiration date for that lot
• Attach the COA (and parse out the key fields: certificate number, test date, lab, batch number, product name)
• Attach the transfer manifest where applicable (manifest number, transfer date, shipper, receiver, carrier, vehicle ID, order number) — required for cannabis; analogous wholesale-distribution paperwork for medical / pharma-adjacent

If the delivery is split across multiple lots — common with bulk flower from a cultivator — receive each lot separately. Each gets its own inventory layer with its own expiration, so picking can run FEFO (first-expiry-first-out) without the buyer doing the bookkeeping.

The structured-fields capture matters more than the file attachment. Files in folders are useless at audit time; structured fields are queryable. "Show me every COA from Lab X in March" should be one click, not a folder dig.

4. Picking: FEFO, not FIFO

Most inventory systems run FIFO — oldest receipt out first. For regulated catalogs with short shelf life and lot-level expiry, that's the wrong rule. FEFO (first-expiry-first-out) pulls the lot closest to its expiration date next, regardless of when it was received.

Without expiration capture, FEFO is impossible. With expiration capture on every receipt, FEFO is automatic — and the operational consequence is fewer write-offs at the end of every shelf-life window.

5. Receiving: blocked when documents are missing

The single highest-leverage compliance control is at receiving: refuse to mark a regulated item as received until the documents are on file. Not as a warning the buyer can dismiss — as a hard block.

Operators sometimes push back on this. The pushback is: "what if the COA is delayed and we already have the product?" The answer is the request flow. Receive into a pending state, request the COA from the supplier, and the moment the COA arrives (parsed from email, queued for review, verified by a manager) the receipt completes. The pending window forces the conversation with the supplier instead of letting the document drift.

6. Audit and recall response

Every verify / reject decision is timestamped with the manager who made it. Every lot is tied to its COA, its manifest, its supplier's license at receipt time, and its sales. When a state inspector or a vendor recall asks for "every unit of lot 2026-04-22-A," the answer is one query — not a Friday afternoon of stitching POS receipts to delivery emails to QuickBooks bills.

The same query works for an internal review: a buyer wants to know how much of that supplier's stock is still on the shelf because they're rethinking the relationship. With lot-level data, the answer is immediate.

What this looks like in LineNow

LineNow's Regulated Items workflow gives you exactly this loop:

1. Mark an item regulated in the item form. Pick which documents it requires (COA, transfer manifest, vendor license) from the standard list. A Premium badge appears next to the toggle — the Regulated Items add-on is $50/mo, auto-enabled the moment you save your first regulated item, auto-canceled when no items remain regulated.

2. Capture supplier licenses on the line. Enter the details directly, or send a request to the supplier — replies are extracted and queued for verification.

3. Receive with lot detail. The receive dialog lets you split a receipt across multiple lots in one form, each with its own quantity and expiration date.

4. Attach documents at receipt with structured fields (COA number, test date, lab name, batch number) parsed out — not just file uploads.

5. Block the receipt if any required document is missing. Or request from the supplier in-app and complete the receipt when the document lands.

6. Audit-ready history on every line: which manager verified, when, against which version of which document.

How this layers on your existing POS

The most common SMB stack for regulated retail is Lightspeed (Retail X-Series) for the POS, a state-mandated track-and-trace or wholesaler-distributor reporting system (Metrc, BioTrack, NABP VAWD, state pharmacy boards, etc.) for filings, and a procurement gap in between. LineNow lives in that gap:

• Sales data flows from Lightspeed to LineNow so inventory depletes in real time.
• Lots stay tied to their COAs, manifests, and supplier licenses on LineNow's side.
• State track-and-trace, pharmacy-board, or wholesaler reporting still runs through your existing system; LineNow doesn't replace it.
• The procurement decisions — what to reorder, from whom, at what price, with which documents required — live in LineNow.

This is the missing layer between "we have a POS" and "we have a procurement system." For most regulated SMBs, replacing the POS just to get compliance documentation is the wrong move. Adding the procurement layer alongside it is the right one.

A 60-second compliance diagnostic

Three questions:

1. If a state inspector asked for "the COA for lot 2026-04-22-A" right now, could you produce it in one click? No = your compliance archive is open.
2. When does your highest-volume supplier's license expire? Don't know = your renewal queue is open.
3. Which lots in your current on-hand stock expire in the next 30 days? Don't know = your write-off queue is open.

If any answer is no, the compliance loop is open. The work you do in those gaps is the work a closed-loop system eliminates.

Related

• Procurement Software for Specialty Retailers
• Lightspeed Procurement Layer
• Why Cannabis Retailers Layer LineNow on Lightspeed
• Closed-Loop Procurement, in Plain English
• How LineNow Uses AI
• How AI Reads Your Supplier Emails