Cannabis Track-and-Trace Requirements by Country: 2026 Global Comparison

What does this mean for the global cannabis industry?

Every international cannabis operator eventually encounters the same uncomfortable reality: the traceability system that keeps you compliant in one country can be entirely inadequate in the next. Canada requires monthly aggregate reporting through a federal web portal under the Cannabis Tracking System Order. California requires real-time entry of every plant tag, transfer manifest, and delivery record into the state-mandated METRC system. Germany’s Cannabisgesetz imposes comprehensive inventory records and annual reporting obligations on cannabis social clubs and BfArM-licensed medical cultivators alike. Australia’s Office of Drug Control requires quarterly batch-level reports covering every plant cultivated, every gram harvested, and every extract produced — filed by the 15th of the month following each quarter.

These systems share a common goal — preventing diversion of regulated cannabis into illegal channels — but they achieve it through radically different architectures. Some mandate a specific government-contracted software platform. Others specify the data that must be captured without prescribing the tool. Some operate at the individual-plant level with radio frequency identification tags. Others aggregate at the license-holder level. For compliance officers navigating multiple jurisdictions simultaneously, understanding which regime applies — and precisely what it requires — is not optional context. It is the operational foundation on which everything else rests.

This comparison is built from official government and regulator sources only. Where an official mandate could not be verified, the jurisdiction is noted accordingly.

Why Track-and-Trace Exists: The Regulatory Logic

Seed-to-sale traceability systems exist to solve a specific problem: cannabis has both regulated and illegal market participants, and regulators need the ability to verify that product moving through licensed channels did not originate in, or divert back to, the illicit market. As Health Canada describes the purpose of its Cannabis Tracking and Licensing System (CTLS), it exists to "track the flow of cannabis to prevent its illegal inversion and diversion into and out of the regulated commercial system."

That objective — preventing diversion — dictates the structure of every tracking mandate. The question regulators ask when designing a system is: at what point in the supply chain does diversion become possible, and what data, captured at what frequency, would detect it? The answers vary significantly by jurisdiction, legal model, and the maturity of the regulatory framework.

Understanding the fundamentals of seed-to-sale tracking is the prerequisite for making sense of how individual country mandates translate into day-to-day operational requirements.

There are two dominant architectural approaches in use globally in 2026:

Aggregate inventory reporting models require license holders to submit periodic (typically monthly or quarterly) summaries of opening inventory, additions, removals, and closing inventory by product class. The government tracks the flow of cannabis at a macro level — how much entered the system, how much was sold, how much was destroyed — without necessarily tracking individual units in real time. Canada’s CTLS operates on this model.

Real-time unit-level tracking models require license holders to log every plant tag assignment, every batch transfer, every retail transaction into a government-contracted platform in or near real time. The regulator can, in principle, trace any individual unit of cannabis from the clone or seed that produced it to the shelf where it was sold. The US state METRC system operates on this model.

Both approaches impose serious compliance obligations, but they require very different operational infrastructure to support.

Country-by-Country Comparison: What the Law Actually Requires

Canada: The Cannabis Tracking System Order (SOR/2019-202)

Canada’s cannabis tracking framework derives its authority from the Cannabis Act, with the specific data obligations set out in the Cannabis Tracking System Order (SOR/2019-202), which came into force on October 17, 2019. The Order replaced an earlier version and applies to all federal licence holders — cultivation, processing, and medical sales — as well as provincial and territorial reporting authorities, distributors, and retailers.

What Federal Licensees Must Report

Under SOR/2019-202, federal licence holders must submit reports through the CTLS web portal no later than the 15th day of each month, covering the previous calendar month. Required data includes:

• Opening and closing inventory — the number of packaged cannabis products and the quantity of unpackaged cannabis (by class, in the units specified in Schedule 2) that formed part of inventory on the first and last day of the reporting period
• Inventory additions — additions from production, packaging, purchase, returns, and other sources
• Inventory removals — removals from sales (with book value in Canadian dollars, net of sales tax, broken down by province and product class), destruction, losses, and other disposals
• Operational data — the surface area used for cultivation or processing during the reporting period
• Facility and licence identifiers — licence numbers and identifying information

Provincial or territorial reporting authorities (provincial cannabis boards) must submit by the 15th. Retailers authorized under provincial law who are not public bodies report to the designated public body by the 10th of each month. All records must be retained for a minimum of two years.

What Canada’s System Does Not Require

It is important to understand what the Canadian federal system does not mandate. The CTLS is an aggregate reporting system, not a real-time plant-level tracking platform. There is no federal requirement for individual plant RFID tags or real-time transaction logging at the point of sale. Provincial boards may impose additional operational requirements — and some provincial markets have more granular expectations — but the federal mandate is aggregate and retrospective. Health Canada does, however, have the authority to inspect licensee records and to require additional information.

United States: State-Mandated Real-Time Systems

The United States presents a fundamentally different challenge: there is no federal cannabis tracking mandate (cannabis remains a Schedule I substance under the Controlled Substances Act, though rescheduling to Schedule III was announced in April 2026). Instead, each state that has legalized recreational or medical cannabis has enacted its own tracking mandate, typically requiring use of a specific government-contracted platform.

Colorado: The MED and METRC

Colorado’s Marijuana Enforcement Division (MED) established METRC as the mandatory seed-to-sale tracking system for all licensed cannabis businesses. Under MED Rules (1 CCR 212-3, Sections 309), any MED-licensed business without an activated and functional METRC account may not operate or exercise any privileges of its marijuana business license. The rule is categorical: no METRC account, no operations.

Colorado’s METRC contract expires in October 2026. The state has recently amended its rules to replace mandatory RFID tag language with broader "inventory tracking system" language — a change intended to open the re-tender to a wider pool of vendors. The underlying mandate for real-time, unit-level tracking remains unchanged.

California: DCC and the California Cannabis Track-and-Trace System

California’s mandate derives from Business and Professions Code §26067, enacted as part of the Medicinal and Adult-Use Cannabis Regulation and Safety Act (MAUCRSA). The statute requires the Department of Cannabis Control (DCC) to establish a track-and-trace program using unique identifiers capable of documenting product movement throughout the distribution chain. The DCC implemented this through a partnership with METRC, creating the California Cannabis Track-and-Trace (CCTT) system.

Under California Code of Regulations Title 4 §§15049.3 and 15418, retailer compliance requirements for deliveries are highly specific. Before a delivery vehicle departs, the retailer must record in CCTT:

• The delivery employee’s full name, employee ID, and driver’s license number
• Vehicle make, model, and license plate
• Product UIDs and quantities being transported
• Whether orders are pre-sold

After each delivery, all transaction data must be entered into CCTT by end of the same calendar day, including delivery date and time, customer type (adult-use or medicinal), product UID, quantity, purchase price, and delivery county.

The Pattern Across US States

While Colorado and California exemplify the dominant US model, the pattern extends across every state with a functioning legal cannabis market. States including Oregon, Michigan, Nevada, Oklahoma, Massachusetts, Illinois, and New York have each enacted track-and-trace mandates through their state cannabis control commissions, with METRC serving the largest share of state contracts and BioTrack THC serving others. In every case, the mandate flows from state statute or regulation — the private vendor contracts are the mechanism, not the legal authority.

Operators entering any US state market should expect real-time plant-level and transaction-level tracking as the baseline. The specific platform, data fields, and reporting timelines vary by state, but the operational burden — tags on every plant, manifests for every transfer, logs for every retail transaction — is consistent.

Germany: The Cannabisgesetz Framework

Germany’s Cannabis Act (Cannabisgesetz, CanG) entered into force on April 1, 2024, creating one of the most consequential regulatory shifts in European cannabis history. The legislation created a two-track framework: a medical cannabis regime regulated by the Federal Institute for Drugs and Medical Devices (BfArM), and a personal/social club regime for adult-use cannabis regulated at the Länder (state) level with federal parameters.

Medical Cannabis: BfArM Authorization and GMP

For medical cannabis cultivation and distribution, operators must obtain authorization from BfArM. Unlike the previous regime — which involved an EU-wide tender process and centralized purchasing — the CanG moved to a direct authorization model. All pharmaceutical GMP standards, quality controls, and prescription regulations continue to apply. Cultivation must comply with Good Agricultural and Collection Practices (GACP), and all produced cannabis must be tested by an accredited laboratory.

BfArM-authorized operators must maintain comprehensive documentation supporting track-and-trace capability. This means full batch records from cultivation through distribution, supporting the quality and traceability requirements of the EU GMP framework — specifically Annex 7 of the EU GMP Guidelines (Manufacture of Herbal Medicinal Products). Germany does not mandate a specific software platform; the tracking obligation is expressed as a documentation requirement enforced through inspection.

Cannabis Social Clubs: KCanG Requirements

Under the Konsumcannabisgesetz (KCanG), which took effect on July 1, 2024, non-commercial cannabis social clubs (CSCs) may cultivate and distribute cannabis to members. Clubs require permits from local authorities and must comply with federal membership caps (maximum 500 adults), monthly distribution limits (50g per member), and cultivation controls. Compliance requires maintaining complete inventory records and submitting annual reports. Club growers are subject to regulatory inspections, and record accuracy is a condition of continued authorization.

Germany does not operate a national centralized tracking platform for cannabis. The tracking obligation is compliance-documentation based — regulators inspect records rather than pulling real-time data from a platform.

The Netherlands: Controlled Cannabis Supply Chain Experiment

The Netherlands launched the experimental phase of its Controlled Cannabis Supply Chain (NEMO) experiment on April 7, 2025, after decades of tolerating coffee shop sales without a legal supply chain. The experiment operates under the Controlled Cannabis Supply Chain Experiment Decree (BWBR0043738) and will run for four years (extendable by 18 months).

Under the decree, ten designated licensed growers supply cannabis exclusively to participating coffee shops in selected municipalities. The Netherlands Food and Consumer Product Safety Authority (NVWA) monitors product quality and supply chain compliance, alongside municipal enforcement officers and the Justice and Security Inspectorate.

The tracking requirement is specific: every plant receives a unique code, enabling traceability from designated grower to participating coffee shop. No cannabis from illegal sources may enter the experiment’s supply chain, and no cannabis from the experiment’s supply chain may be processed or sold outside the experiment’s context. The Justice and Security Inspectorate began issuing citations in 2025, with violations primarily involving incorrect registration entries and security compliance failures.

Australia: Quarterly Reporting Under the Narcotic Drugs Act

Australia’s medicinal cannabis framework is administered by the Office of Drug Control (ODC) under the Narcotic Drugs Act 1967. All ODC licence holders holding valid medicinal cannabis permits for cultivation, production, or manufacture must submit quarterly reports using the ODC Cannabis Reporting Template.

Quarterly Reporting Deadlines

What Must Be Captured

The ODC template requires reporting across three interconnected data categories:

Crops and Plants — All plants generated for medicinal or scientific use, tracked from generation through transfer, harvest, and destruction/failure. This is a plant-population accounting, not an individual-plant RFID system.

Cannabis and Resin Stock — Inventory of cannabis on hand, split into three categories: cannabis with >1% THC; cannabis with ≤1% THC; and resin stock. Each tab records inputs and outputs over the month, producing an auditable stock movement ledger.

Manufacturing Outputs — Inputs and outputs of all manufacturing activities, with extract outputs broken down by cannabinoid: delta-9 THC, THC isomers (excluding delta-9), and CBD obtained from extraction.

The Q4 report must also contain a complete annual reconciliation covering all activities for the calendar year. Failure to submit, late submission, or submission of false or misleading information may constitute a breach of licence conditions and trigger compliance action by the ODC.

The TGA’s 2026-2027 enforcement priorities place cannabis among the top areas of focus, with quarterly compliance reviews now replacing annual assessments. For a detailed breakdown of TGA enforcement expectations for cannabis producers, GrowerIQ’s analysis of Australia’s TGA cannabis compliance requirements covers the enforcement posture shift in detail.

EU Medical Cannabis: Pharmaceutical GMP as the Traceability Standard

For cannabis-based medicinal products marketed across the European Union, there is no single EU-wide track-and-trace platform comparable to METRC. Instead, the traceability obligation flows through the pharmaceutical GMP framework, specifically:

EU GMP Guidelines Annex 7 — This annex covers the manufacture of herbal medicinal products and applies directly to cannabis as a herbal active substance. It requires that all actors in the supply chain maintain batch documentation and quality systems, and impose the same requirements on their suppliers.

Good Agricultural and Collection Practices (GACP) — Applied at the cultivation level; operators must document cultivation conditions, harvesting, and primary processing for all herbal starting materials.

Falsified Medicines Directive (2011/62/EU) — Requires serialization and verification of finished medicinal products in the legal supply chain. Between 2019 and 2024, the EU confirmed only 11 cases of falsified medicines detected in the legal supply chain — evidence that the FMD’s mandatory verification system is functioning as intended.

The practical implication for cannabis operators is that batch-level documentation — covering identity, purity, heavy metals, pesticide residues, mycotoxins, and microbial contaminants, with stricter standards for inhalation products — is non-negotiable at every stage of the supply chain. The traceability requirement is enforced through national competent authority GMP inspections, not a central platform.

What Operators Must Actually Capture: A Practical Summary

The table above compares regulatory architecture. But for operations directors building compliance infrastructure, the more useful question is: what data must my systems generate, retain, and be prepared to produce on demand?

Across all jurisdictions reviewed, the following data categories appear in some form in every mandate:

• Plant/batch origin — where and by whom the cannabis was cultivated; genetic/seed source documentation in pharmaceutical-grade jurisdictions
• Inventory movements — all additions and removals from inventory, with dates, quantities, and counterparties
• Destruction and loss records — documented disposition of all cannabis that did not enter the commercial chain
• Sales and distribution data — to whom cannabis was transferred, at what quantity, at what price or value, and where
• Testing and quality records — batch-level analytical results demonstrating compliance with potency, contaminant, and quality standards
• Personnel and facility records — who handled cannabis, at what licensed facility, under what authorization

The architecture and granularity differ — Colorado captures this data in real time at the individual-plant tag level; Canada captures it in monthly aggregate summaries — but the underlying data universe is largely the same. A well-designed compliance system should be capable of generating either output from the same operational data.

For a practical comparison of the software options available for meeting these requirements across jurisdictions, GrowerIQ’s analysis of cannabis track-and-trace software provides a vendor-neutral overview of the platform landscape.

The Diversion-Prevention Test: How to Evaluate Any Tracking System

Regulators in every jurisdiction share one underlying objective: ensuring that cannabis in the regulated market does not originate from, or flow back into, the illicit market. When evaluating whether your compliance infrastructure is adequate, the practical test is whether it can answer five questions under regulatory scrutiny:

1. Origin — Where did this cannabis come from, and can you prove it was cultivated under a valid licence?
2. Chain of custody — Who handled this cannabis at each stage, and are those movements documented?
3. Destruction — What happened to cannabis that did not enter the commercial chain — rejected material, trimmings, failed plants?
4. Reconciliation — Can you reconcile your opening inventory plus all additions against your closing inventory plus all removals, with documented explanations for any variance?
5. Auditability — Can you produce all of this documentation at the request of a regulator, in the format and within the timeframe the regulator requires?

A compliance system that cannot answer all five questions, for every batch, in every jurisdiction where you operate, is a liability — regardless of whether the regulator in that jurisdiction is pulling real-time data from a platform or arriving for a scheduled annual inspection.

How GrowerIQ Supports Multi-Jurisdiction Compliance

The regulatory divergence described in this post is not a temporary transition artifact — it reflects the reality that cannabis regulation is built market by market, with each jurisdiction encoding its own political and public health priorities into its tracking architecture. Operators expanding internationally cannot rely on a system designed for one regime to meet the requirements of another.

GrowerIQ’s seed-to-sale platform is built on the principle that all compliant tracking obligations — whether Canada’s CTLS monthly reporting, a US state’s real-time METRC requirements, Australia’s ODC quarterly template, or the EU’s GMP batch documentation standard — draw from the same underlying operational data: plant records, batch records, inventory movements, quality results, and chain-of-custody documentation. The platform captures this data at the operational level and can generate the regulatory outputs each jurisdiction requires without duplicating data entry or maintaining parallel systems.

For compliance officers and operations directors evaluating their readiness for 2026 multi-jurisdictional requirements, the starting point is always the same: does your system capture the five-question audit trail described above, for every batch, at every stage? If it does not, the gap is a compliance risk regardless of which market you are entering next.

This analysis is current as of May 2026 and draws on official government and regulatory sources including Health Canada’s Cannabis Tracking System Order (SOR/2019-202), California Business and Professions Code §26067 and DCC regulations, Colorado Marijuana Enforcement Division rules (1 CCR 212-3), Germany’s Cannabisgesetz and Konsumcannabisgesetz, the Netherlands Controlled Cannabis Supply Chain Experiment Decree (BWBR0043738), Australia’s Office of Drug Control quarterly reporting guidance under the Narcotic Drugs Act 1967, and EU GMP Annex 7 and the Falsified Medicines Directive (2011/62/EU). Figures reflect the best available data as of the publication date.

Sources

• Cannabis Tracking System Order (SOR/2019-202) — Full Text — Justice Laws Website, Government of Canada
• Cannabis Tracking System Resources — Health Canada
• Reporting Requirements for Cannabis and Industrial Hemp Licences — Health Canada
• Cannabis Tracking and Licensing System Monthly Reporting Guide — Health Canada
• California Business and Professions Code §26067 — Track and Trace — Justia / California Legislature
• Record-Keeping/Track-and-Trace Requirements for Deliveries — California Department of Cannabis Control
• 5 Steps to Using the Track and Trace System — California Department of Cannabis Control
• METRC — Marijuana Enforcement Division, Colorado — Colorado Department of Revenue
• Colorado Cannabis Traceability Rules Update — Metrc Contract Expiry 2026 — MJBizDaily
• Quarterly Reporting Obligations for Medicinal Cannabis — Office of Drug Control (ODC), Australian Government
• Reporting and Compliance Obligations for Medicinal Cannabis — Office of Drug Control (ODC), Australian Government
• Background Information and Experiment Design — Controlled Cannabis Supply Chain Experiment — Government of the Netherlands
• One Year On: Dutch Regulated Cannabis Experiment an Apparent Success — NL Times
• GMP Requirements for Medical Cannabis in the EU — ECA Academy / GMP Compliance
• Tracking Progress: Implementation of the Falsified Medicines Directive — G&L Scientific
• Germany Cannabis Act (Cannabisgesetz) — Wikipedia Overview) — Wikipedia (secondary reference)
• Germany Cannabis Business Guide 2026 — Cannabis Europa