The cannabis industry has treated GMP as a compliance project. A thing operators will start one day, consultants will help with for a fee, and auditors will eventually grade. The industry has a whole category of businesses that sell this project: compliance consultancies, GMP transition services, audit prep software, SOP template libraries, deviation investigation workflows.
We think the records half of GMP shouldn’t be a project at all.
If a commerce stack is designed lot-native, with an immutable ledger, unbroken chain of custody from Seed through Delivery, and audit-exportable records, then compliance stops being a project and starts being a byproduct of operating normally.
That’s not a feature claim. It’s an architectural claim, and it’s a vocabulary move: we turn GMP Compliance into GMP-Commerce.
The reframe reorders the operator’s purchase decision. Instead of “which consultant should we hire?” or “which audit prep system should we buy?”. The question becomes “which commerce stack are we running?” The answer to the second question also solves the first. The answer to the first does nothing to solve the second.
What Schedule III actually asks of you
On April 22, 2026, the DEA signed the final order moving FDA-approved marijuana products and state-licensed medical marijuana from Schedule I to Schedule III. Effective immediately. Expedited registration window closed June 26. First federal registrations land in the next six weeks.
The loud story about rescheduling is tax relief. Internal Revenue Code 280E was a gut punch, and operators who qualify under Schedule III get to deduct ordinary business expenses for the first time. That’s a real win and it will be covered in every trade publication.
The quiet story is what GMP posture now gates. Pharma distribution, insurance underwriting, institutional capital, M&A valuation, and interstate opportunity (if and when) all pass through a records-and-chain-of-custody filter that most cannabis operators have never been asked to pass.
21 CFR 211 doesn’t care that you have METRC entries. It cares whether your production records, batch records, deviation logs, chain of custody, and distribution records are retrievable, retention-compliant, and tamper-evident. That’s the records half of GMP. It’s what the auditor opens first and the thing most cannabis operators have never built.
Where most cannabis commerce stacks stop
Walk the industry stack and look at where each tool stops:
- Dutchie stops at Sale. Its API is read-only; its distribution record lives inside Dutchie, not in your system of record. If you build on Dutchie, your compliance records are a report pulled from someone else’s database.
- LeafLink is a marketplace. The record of what left your facility and where it went is reconstructed from marketplace exports after the fact. Chain of custody has a seam where ownership transfers.
- Canix originated as a METRC skin and reverse-engineered BOMs after. It explicitly lacks an immutable general ledger: any record can be edited retroactively. That alone disqualifies it for publicly-traded operators and almost all pharma-adjacent conversations.
- State track-and-trace (METRC, BioTrack) is a floor, not a stack. It covers movement reporting, not production records, QC release records, deviation logs, or distribution records in the GMP sense.
Three of those four stop at Sale. The fourth isn’t a stack. None of them deliver GMP-grade records as a byproduct of operating normally. That’s the gap SellStack was architected to close, not with a bolt-on compliance module but by designing the whole commerce layer lot-native from the ground up.
Four pillars shipped out of the box
GMP-Commerce out of the box isn’t a slogan. It’s four specific architectural pillars that no other cannabis commerce stack ships together:
- Immutable records. SellStack integrates with 365 Cannabis on Microsoft Dynamics 365 Business Central, an immutable general ledger with decades of audit discipline. No retroactive edits. Every transaction timestamped, user-attributed, permanent.
- Lot-native commerce. You sell lots, not SKUs. The distribution record is lot-level by design, not reconstructed from reports after the fact.
- Unbroken chain of custody. Seed through Delivery, one stack, one ledger, lot continuity through every transaction. No stitching between systems.
- Audit as an export. Your audit is a query against one ledger. Traceback and traceforward are the same evidence. Weeks of audit prep collapse to minutes.
What we don’t claim
We think the honesty strengthens the pitch. Overclaiming “we solve GMP” pattern-matches to point-solution and triggers skepticism. We’d rather be the operator-grade stack that hands you the records half and lets your discipline carry the rest.
What SellStack doesn’t ship out of the box: facility design, environmental controls, HVAC validation, personnel qualifications and training records, deviation investigation (we log the deviation; the investigation is operator process), change control process, stability testing programs, returned and salvaged product handling. Those stay operator discipline.
We ship the records half. Your SOPs, facility, and training are still your job. GMP-Commerce out of the box is architecture, not an audit service.
The horse’s mouth
One of our operators runs about 50,000 square feet of cultivation. Earlier this year the DEA visited two of his dispensaries. He describes GMP this way:
“Those are the principles that we work under. Yeah, GMP. That’s why every plant past a certain stage is tagged and batched and connected. That is supposed to be the process.”
Note the vocabulary. “Principles,” not “project.” “The process,” not “the audit.” GMP is how he operates, not something he started doing when rescheduling arrived. When the DEA inspected his dispensaries they left saying the facility was “more secure than a typical pharmacy.” That’s what the operator-grade end-state sounds like.
His schema remodel, moving from a hierarchical product model to a lot-based part number structure, wasn’t a GMP project. It was a schema cleanup. GMP came out the other side for free, and the customer-facing presentation got sharper at the same time. That’s the shape of the architectural claim.
The reframe matters because the market’s about to sort
In the next six weeks, the first wave of operators becomes federally registered under Schedule III. Pharma distributors, insurers, and institutional investors begin treating GMP posture as table-stakes diligence. M&A valuations start reflecting GMP-readiness as a discount factor for operators who aren’t ready.
The 55–65% of US rec-legal operators who believe METRC plus lab testing adds up to GMP compliance are about to meet the records half of GMP in the worst possible way: an auditor asking for a lot’s full history and getting a shrug.
The 3–5% who are already GMP-ready are the shortlist for everything downstream: pharma distribution, premium insurance underwriting, institutional capital, pharmacy-adjacent retail, M&A as a buyer rather than a target.
GMP-Commerce is the architecture that moves an operator from the first group to the second without a two-year consulting engagement.
What this isn’t
GMP-Commerce isn’t a replacement for your compliance consultant, your QC team, your facility manager, or your audit partner. It’s not a magic button. It’s not a bolt-on report pack. It’s not a shortcut past the practice-half of GMP, which stays yours to run.
GMP-Commerce is the commerce stack that stops making the records half harder than it has to be. Everything else, your principles, your process, your people, still has to show up.
The question
If a pharma distributor audited you Monday, what would they fail you on first?
If the honest answer is “the records,” you’re the shock cohort. The question that answers itself is the one that reveals the gap no one has been pointing at. The fix is not a project. The fix is a stack decision.