Procurement for Cannabis, CBD, and Medical Retailers: Licenses, COAs, Lot Tracking, and Expiry
How cannabis, CBD, hemp, medical, and pharma-adjacent retailers use living POs to reconcile supplier licenses, COAs, manifests, lot/expiry receiving, and invoices before accounting.
Jainul Vaghasia/Published /Updated /14 min read
For operators
Use this playbook to tighten the buying loop.
LineNow helps teams move from manual ordering and supplier follow-up to a connected workflow for POs, receiving, inventory, and accounting handoff.
For cannabis, CBD, medical, and pharma-adjacent retailers, procurement is half a logistics problem and half a compliance problem. Every receipt can carry regulatory context: the wrong COA, an expired lot, a supplier license that lapsed, or a transfer manifest that does not match the delivery. The systems most operators end up with were not designed for this: the POS handles checkout but not the supplier loop, the seed-to-sale or wholesaler-distributor reporting system handles filings but not your buying decisions, and the spreadsheet handles everything in between badly.
This guide is the operator's view of how regulated-retail procurement should actually work in 2026 — for the dispensary, CBD storefront, hemp retailer, medical supply shop, or any retailer carrying licensed inventory who needs license tracking, COA storage on the lot, expiration capture on every receipt, and audit-ready history. Without rip-and-replace on the POS you already run.
If you operate a regulated catalog and you've ever gone hunting for a specific lot's COA at 11 PM, this is for you.
If you are evaluating software rather than only learning the workflow, start with LineNow's compliance procurement software. This guide explains the operating model underneath that product page: supplier licenses, COAs, transfer manifests, lot and expiry receiving, FEFO picking, and audit-ready purchase history.
Regulated-retail procurement works best when the PO becomes a living compliance record. Supplier license status, required documents, COAs, transfer manifests, lot numbers, expiration dates, receiving decisions, manager verification, invoice variances, and accounting handoff should all live with the order.
Read before ordering
A dense operator briefing for teams that need sharper buying, cleaner supplier follow-up, and fewer expensive surprises.
That is the practical difference between a static PO and a living PO. AP should not discover missing documents after the bill arrives. The supplier and buyer should reconcile required paperwork before receiving. The receiver and buyer should reconcile lot and quantity before inventory is available. The invoice should match the latest verified order state before payment. See Three-Way Matching vs. the Living PO.
What's different about regulated-retail procurement
Three structural differences from regular retail procurement — and they apply across cannabis, CBD, hemp, medical, and pharma-adjacent categories alike:
1. Every line is a compliance object, not just an inventory object. A 1 oz jar of flower is not just SKU CAN-FLW-001 — it may also be lot 2026-04-22-A, COA on file from Lab X dated 2026-04-08, sourced from supplier with Adult-Use Cultivation License CA-CUL-1234, transferred under Manifest M-99812, expiring 2027-04-22. The same pattern can apply for medical: a bottle of a regulated supplement may carry an NDC, lot, expiration date, manufacturer registration, and COA. Lose a required data point and the unit may need to be quarantined, blocked, or investigated before it can be sold.
2. The lot is the unit of recall. A vendor lot fails a heavy-metal screen three weeks after it shipped. A medical supplier issues a recall for a single manufacturing batch. Without lot-level tracking from receipt forward, you cannot answer "which units of that lot are still on the shelf, which sold, and which sold to whom" without backing into it through the POS receipt history. With lot-level tracking, the answer becomes a structured lookup — true for cannabis flower, CBD tinctures, and medical SKUs alike.
3. Licenses expire. Suppliers, brands, transporters, testing labs, distributors with wholesaler permits — many parties in the chain have a license, permit, or registration with an expiration date. Depending on category and jurisdiction, an expired license can block receiving or force extra review. A compliance system has to surface lapsing licenses before the renewal date, not after.
The right procurement system for regulated retail handles all three structurally — without adding manual work for the buyer.
The complete regulated-retail procurement loop
1. Catalog: which items need which documents
Every regulated item should have an explicit list of the documents it requires:
Adult-use cannabis flower → Vendor License, Certificate of Analysis, Transfer Manifest
CBD topicals → Vendor License, Certificate of Analysis
Hemp-derived edibles → Vendor License, Certificate of Analysis (often two — cannabinoid panel + heavy metals)
Medical / regulated supplements → Manufacturer License/Registration, Certificate of Analysis, Lot-level expiration capture
Pharma-adjacent OTC under state controls → Wholesaler/Distributor Permit, COA where applicable, expiration capture
Accessories / non-regulated → no documents required
The catalog should let you flip an item to regulated and choose which document types your team wants to track. Receiving then surfaces the current document status and requires an explicit review when evidence is incomplete. Receiving for a non-regulated item — pipe cleaners, lighters, branded merch — flows normally. The compliance overhead lives on the regulated lines only.
2. Supplier licenses: capture, request, expire
For each supplier line, you need the supplier's license details before the first PO can be received:
License number
License type — pick from your state's taxonomy (Adult-Use, Medical Cannabis, Hemp, Cultivation, Manufacturing, Distribution, Retail, Testing Lab, Transporter for cannabis; Wholesaler / Distributor Permit, Manufacturer Registration, NDC-registered Repackager, FDA-registered Facility for medical and pharma-adjacent)
Issuing authority
Jurisdiction
Issue date
Expiration date
Two capture paths matter:
Enter — your team reviewed the license document directly. Fill in the fields, attach the PDF, save.
Request — you don't have it yet. Send a request to the supplier from inside the system; the supplier's reply is parsed and queued for review.
Then the calendar matters. Renewals approach, licenses lapse. The system has to surface lapsing licenses with enough lead time that you can chase the supplier for the new copy before the old one expires — not after a receipt has already been blocked.
3. COAs, manifests, and lot data on receipt
The receipt is where lot-level tracking gets locked in. When a delivery arrives:
Capture the lot number (the manufacturer or cultivator's, not yours)
Capture the expiration date for that lot
Attach the COA (and parse out the key fields: certificate number, test date, lab, batch number, product name)
Attach the transfer manifest where applicable (manifest number, transfer date, shipper, receiver, carrier, vehicle ID, order number) — required for cannabis; analogous wholesale-distribution paperwork for medical / pharma-adjacent
If the delivery is split across multiple lots — common with bulk flower from a cultivator — receive each lot separately. Each gets its own inventory layer with its own expiration, so picking can run FEFO (first-expiry-first-out) without the buyer doing the bookkeeping.
The structured-fields capture matters more than the file attachment. Files in folders are weak at audit time; structured fields are queryable. "Show me every COA from Lab X in March" should be a structured search, not a folder dig.
4. Picking: FEFO, not FIFO
Most inventory systems run FIFO — oldest receipt out first. For regulated catalogs with short shelf life and lot-level expiry, that's the wrong rule. FEFO (first-expiry-first-out) pulls the lot closest to its expiration date next, regardless of when it was received.
Without expiration capture, FEFO is impossible. With expiration capture on every receipt, FEFO can run from the receipt data — and the operational consequence is better control over stale, expiring, or write-off-prone stock.
5. Receiving: blocked when documents are missing
One high-leverage compliance control is at receiving: show the selected procurement documents and their review state before a regulated item is marked received. Your policy can treat that as an explicit acknowledgement or a stricter internal review process.
Operators sometimes push back on this. The pushback is: "what if the COA is delayed and we already have the product?" The answer is the request flow. Receive into a pending state, request the COA from the supplier, and the moment the COA arrives (parsed from email, queued for review, verified by a manager) the receipt completes. The pending window forces the conversation with the supplier instead of letting the document drift.
6. Audit and recall response
Every verify / reject decision is timestamped with the manager who made it. Every lot is tied to its COA, its manifest, its supplier's license at receipt time, and its sales where that data is connected. When a state inspector, marketplace, internal reviewer, or vendor recall asks for "every unit of lot 2026-04-22-A," the answer should be a structured lookup — not a Friday afternoon of stitching POS receipts to delivery emails to QuickBooks bills.
The same query works for an internal review: a buyer wants to know how much of that supplier's stock is still on the shelf because they're rethinking the relationship. With lot-level data, the answer is immediate.
Mark an item regulated in the item form. Pick which documents it requires (COA, transfer manifest, vendor license) from the standard list. A Premium badge appears next to the toggle — the Regulated Items add-on is $50/mo, auto-enabled the moment you save your first regulated item, auto-canceled when no items remain regulated.
Capture supplier licenses on the line. Enter the details directly, or send a request to the supplier — replies are extracted and queued for verification.
Receive with lot detail. The receive dialog lets you split a receipt across multiple lots in one form, each with its own quantity and expiration date.
Attach documents at receipt with structured fields (COA number, test date, lab name, batch number) parsed out — not just file uploads.
Review the receipt if a tracked document is missing. Request it from the supplier in-app or explicitly acknowledge the current status before proceeding.
Audit-ready history on every line: which manager verified, when, against which version of which document.
The structured request-and-parse loop is not just a compliance win. Whitmans, a multi-location retailer ordering from many suppliers, cut supplier back-and-forth from roughly 8 rounds per PO to about 1 round per 8 POs — a 64x reduction — by running orders through this kind of loop. The same math applies when the back-and-forth is chasing COAs and license renewals instead of price confirmations.
How this layers on your existing POS
A common SMB stack for regulated retail is Lightspeed (Retail X-Series) for the POS, a state-mandated track-and-trace or wholesaler-distributor reporting system (Metrc, BioTrack, NABP VAWD, state pharmacy boards, etc.) for filings, and a procurement gap in between. LineNow lives in that gap:
Sales data flows from Lightspeed to LineNow so inventory depletes in real time.
Lots stay tied to their COAs, manifests, and supplier licenses on LineNow's side.
State track-and-trace, pharmacy-board, or wholesaler reporting still runs through your existing system; LineNow doesn't replace it.
The procurement decisions — what to reorder, from whom, at what price, with which documents required — live in LineNow.
This is the missing layer between "we have a POS" and "we have a procurement system." For most regulated SMBs, replacing the POS just to get compliance documentation is the wrong move. Adding the procurement layer alongside it is the right one.
A 60-second compliance diagnostic
Three questions:
If a state inspector asked for "the COA for lot 2026-04-22-A" right now, could you produce it from a structured record quickly? No = your compliance archive is open.
When does your highest-volume supplier's license expire? Don't know = your renewal queue is open.
Which lots in your current on-hand stock expire in the next 30 days? Don't know = your write-off queue is open.
If any answer is no, the compliance loop is open. The work you do in those gaps is the work a closed-loop system eliminates.
Procurement for Veterinary Clinics — similar lot, expiry, and controlled-substance compliance requirements in a different regulated setting
Procurement for Independent Pharmacies — front-end retail replenishment, OTC purchasing, DSCSA-compliant receiving, and compounding API sourcing for independent pharmacy operations
