A Florida cannabis control program is only as defensible as the rules it names. An SOP that says "reconcile daily" without pointing to the statute and rules behind it is hard to defend at inspection, and Florida's rules are a moving target in 2026. The baseline below is the frame every other BioTrack control hangs from.
The anchors
Florida's medical cannabis framework rests on a small set of fixed reference points:
- Section 381.986, Florida Statutes: the governing statute for medical use of marijuana.
- The Office of Medical Marijuana Use (OMMU): the administering office within the Department of Health.
- The Medical Marijuana Use Registry (MMUR): the secure electronic registry recording what is dispensed to each patient.
- The Department's seed-to-sale tracking system: the state traceability layer, implemented in Florida on BioTrack.
- Florida Administrative Code Chapter 64-4: the rule chapter, plus the emergency rules currently in force.
What the state system is required to do
The statute sets expectations that explain why so much MMTC activity is regulator-visible. The Department's tracking system must trace marijuana from seed to sale, provide real-time, 24-hour access to regulators, and capture, at a minimum, when product is planted, harvested, destroyed, transported, sold, stolen, diverted, or lost. That last clause is the reason adjustments, waste, and lost-product events are not internal bookkeeping in Florida. They are events the state expects to see.
Inspections and the cost of weak records
The enforcement context raises the stakes on documentation. The Department conducts announced and unannounced inspections, complaint-based inspections, and at least biennial inspections that review records, personnel, equipment, processes, security, sanitation, and quality assurance. Florida may fine an MMTC up to $10,000 per violation, and false records and willful failure to maintain required records are explicit grounds for action.
The operational consequence is direct: a thin adjustment note or a missing support document is not just an accounting defect, it is regulatory exposure. Reconciliation evidence, manifests, audit notes, and exception documentation all have to be inspection-ready.
The part that moves: current rule status
This is the section an SOP must keep current. As of mid-2026, OMMU's rules page still lists emergency rules as the operational baseline for seed-to-sale work:
| Rule | Subject | Status (mid-2026) |
|---|---|---|
| 64ER24-1 | MMTC seed-to-sale tracking system integration | Emergency rule, controlling |
| 64ER24-2 | MMTC STS tracking system procedures | Emergency rule, controlling |
| 64ER22-8 | Dosing and supply limits | Emergency rule, controlling |
| 64-4.221 / 64-4.222 / 64-4.224 | Permanent replacements for the above | In rulemaking; not yet adopted |
OMMU held workshops and hearings through 2025 and into 2026 on the permanent replacement rules, with rulemaking published in mid-2026, and the statute references a rules-transition window tied to July 2026. Because the controlling text can change, verify the current rule before relying on any specific number, and write that verification into the SOP itself.
Build a rule-version log
The practical control is a small, dated log that lives at the front of the binder. For each rule it records the number, the subject, the status, the date last checked, and where in operations it changes what staff do. Pair it with a review trigger, a recurring check of the OMMU rules and notices pages, so a newly adopted rule prompts an SOP update rather than surfacing for the first time during an inspection.
One scope note on transfers
Section 381.986 generally preserves the vertically integrated MMTC structure and bars ordinary wholesale transfers between MMTCs except in a harvest-failure context. Operationally, that means most transfer reconciliation inside an MMTC focuses on facility-to-facility internal transfers, not routine cross-license wholesale distribution. Scope the transfer SOP accordingly.
Version control, not paperwork
Cite the controlling rule by number and date, treat adjustment and waste records as regulator-visible, and keep a rule-version log with a review trigger. While the emergency rules are actively being replaced, version control isn't paperwork. It is the difference between an SOP that holds up at inspection and one that is quietly out of date.