In a request for information released Monday, the California Department of Cannabis Control (DCC) is considering “track and trace software and implementation services.” Formed in July 2021 by the passage of Assembly Bill 141, DCC regulates the “growing of cannabis plants, manufacture of cannabis products, transportation and tracking of cannabis and cannabis products” statewide, as well as cannabis lab testing, its retail sale to patients and consumers, events where cannabis is sold or used, and “related aspects of the cannabis supply chain.” Among the takeaways:
- DCC is required by law to stand up a track and trace system with “unique identifiers” to follow cannabis throughout its supply chain. Such a system has been since 2018, via a contract with Metrc. It tracks cannabis from cultivators and nurseries to retailers and gathers “very limited” information on consumers and patients. The system also assigns a unique identifier to groups of young plants, to mature plants, and to ”discrete units” of cannabis deriving from harvests, packaged portions of harvest, etc. The goal is to “keep cannabis in the licensed market from being diverted to the illicit market,” including to those outside DCC jurisdiction; keep illicit and licensed/regulated goods separate; and to “serve other state interests related to regulation of the licensed cannabis market,” including helping agencies “facilitate the collection of applicable taxes and other compliance efforts.” Requirements for track and trace may change as legal requirements change.
- DCC wants to hear from vendors with experience standing up a track and trace system for cannabis. It is interested in cloud-based software as a-service (SaaS), and the system’s “functional needs” will cover four groups of stakeholders: licensees, licensing authorities, other government entities, and DCC’s IT and administrative teams. DCC needs a system that can “acquire and manage unique identifiers” (UID) and it is interested in “exploring a UID distribution model, whereby licensees can directly acquire the UID.” The department also needs a system where licensees can set up accounts, enter and manage their inventory, enter required information and upload required data from “third-party inventory management and related systems.” Simultaneously, department staff must be able to review supply chain information and distinguishing between recreational and medicinal cannabis; bar cannabis from outside the legal market from “entering”; track distribution; and update supply chain information. Other government entities will also need system access, as well as the ability to review supply chain activity and extract licensee information.
- Department administrators statutorily required to stand up and maintain the system (CCIT) will also need access to the system to ensure licensees aren’t able to record supply chain information or generate shipping manifests “reflecting movement of cannabis in violation of state law”; to ensure legal cannabis isn’t diverted from the supply chain and illegal cannabis entered; to define user access roles to ensure confidentiality; and for IT services staff to be able to monitor the system in real time. Staff and administrators also need to be able to add, delete or suspend users; update processes; and manage staff workload. Contractor’s scope would include “configuring, developing and implementing an existing SaaS product” around state operational needs; converting data from an existing system, or systems with “cannabis activity tracking data” to the SaaS product; developing, implementing, and supporting the CCIT solution aligned to the state development framework; and enhancing the software and updating configurations as state law changes.
- The state development framework, a hybrid of Rapid Application Development (RAD) and Agile, includes three activity workstreams. Product backlog will involve working with state staff to create a working system model via procedures including a fit-gap analysis and developing user stories. Iterative development and delivery will involve using a sprint cycle to do planning, development, testing and retrospectives, to form a “functioning product increment" with full functionality that could be delivered to internal and external production end users. Data conversion will involve potential work from one or more databases with existing system data, parallel to the other workstreams and aligned with key increments, analyzing existing data structures and field, mapping to new data base tables and tools, and transforming data if needed. Deliverables will include weekly status and sprint status reports; a system development and configuration plan; interface control documents; and a go live plan. Vendors’ responses should detail how their system uses the data it collects to generate analytics and flag and notify about irregularities; how it supports a UID distribution model that’s not reliant on DCC; and provide cost estimates for market research. Responses are due by July 3.
