The fine is a business expense: Colorado's cannabis testing enforcement gap

On March 6, 2026, a dispensary owner stood up at the state's cannabis Science & Policy Forum and said the quiet part into the microphone:

"The problem right now is we're finding bad actors. $15,000. $15,000 is nothing. If somebody's adulterating samples, this should be license revocation. ... We're already finding bad actors. We're not taking them out of the industry. That's the problem."

That was the owner of a Pueblo dispensary, speaking on the record at a public meeting (our machine transcript of the Division's recording, around 1:15:49; he closed his comment by saying "$15,000 is nothing" a second time). He was echoing a manufacturer who had made the same argument a month earlier (February 6, around 1:34:04):

"I think that sample fraud should be a death sentence for a licensee. Right now, it's a $15,000 slap on the wrist based on past practice."

And the manufacturer went further, naming what cheating costs the honest:

"Sample fraud and testing fraud is a cancer on our industry, is a cancer on the businesses that are trying to do good work, is a cancer in the labs that are trying to be honest."

Notice who is talking. Not an activist, not a regulator, not this site. A dispensary owner and a manufacturer, asking the state to punish their own industry harder. The same "slap on the wrist" line also ran in print, attributed by name, in ProPublica that same February; both speakers spoke in their business roles at a public meeting, and the recordings and our transcripts carry their names for anyone who wants to check the quotes. This article is about what happened next, which is the point: as far as the public record shows, nothing did.

The one thing the whole room agrees on

Colorado's testing debates spent a year disagreeing about nearly everything: who should collect samples, what consistency means, who pays. Sample cheating is the exception. The regulators and the industry agree it is real, and after a year of reading the record, so do we.

It is worth spelling out what "it" is, because the phrase sounds like paperwork and the practice is not. The version documented in a 2026 enforcement case (the company's own admission is quoted further down this page) works like this: a production batch fails testing for contaminants, and instead of being destroyed or properly remediated, it gets blended into clean batches until the average tests below the action level. The contaminant does not go away. The same amount of pesticide leaves the facility; it is just spread across more product, thin enough that the test stops seeing it. And on Colorado's pesticide panel, the action level is not a safety tolerance, some residue amount regulators decided is acceptable. It is the level at which a lab can reliably detect a chemical that is not allowed on the crop at all, and whose health effects on cannabis consumers are, in the state agriculture department's own words, unknown. Diluting below that line does not make the product safe. It makes the contamination invisible. The other form of cheating, doctoring the test sample itself so a failing batch ships clean, is worse still: the full contamination reaches the shelf undiluted.

The Marijuana Enforcement Division's deputy director told ProPublica in February: "Sample adulteration is a common violation. This is something that we have an interest in more comprehensively addressing based on what we see out there." The same article reported that from 2023 onward, roughly half of 135 final enforcement actions involved self-sampling and testing issues. Claim strength: secondary source; we have not yet re-counted those 135 actions against the Division's records, though our read of the 2026 actions below is consistent with the pattern.

And at the forum itself, an industry review presented in February put sample adulteration in half of recent enforcement actions, a figure nobody in the room disputed.

So the disagreement is not about whether cheating happens. It is about what happens to the cheater.

The math the argument rests on

The fine for getting caught gaming a test has run around $15,000, by the count offered in the room. A single production batch can be worth many times that. At those prices, a fine is not a punishment; it is a line item. A producer willing to adulterate a sample can simply price it in, the way a delivery company prices in parking tickets. The only penalty that cannot be priced in is the one both speakers asked for: losing the license.

Claim strength: analysis. The dollar logic is the speakers' argument, and ours; the fine figures below are from the Division's own published stipulations.

The state agreed, on the record

Credit where it is due: the response from the state's side of the room in March was not defensive. Each case is evaluated on its facts, the forum was told, but "where enforcement could be a stronger hammer looking at revocation, that absolutely should be on the table and considered" (around 1:20:43 in our March transcript).

The Division has also shown it will talk about testing games in public when it wants to. Its January 2026 Industry Bulletin 26-01 described, candidly and in detail, how Reduced Testing Allowance status gets gamed on the contaminant side, and named R&D testing as a route for circumventing required testing. The candor exists. So does the stated openness to revocation. What the public record is missing is the follow-through.

What the 2026 enforcement record actually shows

The record for January through mid-August 2026: 39 final administrative actions, 20 health-and-safety advisories, and 7 industry bulletins, re-checked against the Division's site on August 15, 2026. Three actions touch testing integrity directly.

CC Brands LLC (July 8, 2026): the dilution case. A products manufacturer charged under Colorado's sample-adulteration statute (section 44-10-701(3), which covers adulterating samples "for the purpose of circumventing contaminant testing detection limits or potency testing requirements"). The admitted conduct, quoted from the stipulation:

"CC Brands clarified to Division investigators that when Production Batches yielded failing testing results, CC Brands utilized a blending process to dilute the Production Batches in question to ensure contaminants were below action levels and safe for human consumption. CC Brands believed this practice was compliant and permissible under the Marijuana Rules."

Mixing failing batches into passing ones until the average clears the bar. The company told investigators it believed this was allowed. The sanction: a $23,750 fine. The licenses continue.

GT Infusions LLC (March 11, 2026): proof the hammer exists. An edibles manufacturer that skipped potency testing on production batches without holding the Reduced Testing Allowance that would have made skipping legal, and failed to quarantine batches that failed potency tests. This is the one 2026 action citing the potency-testing rule at all. The sanction: a $20,000 fine plus voluntary surrender of both manufacturer licenses, treated as a revocation. Worth noting: the complaint number dates the investigation to 2024. The Division found this the ordinary way, with field investigators, and when it wanted a license, it got one.

Bona Fides Laboratory (April 8, 2026): the lab side. The only testing-facility action of 2026, over pesticide and elemental-impurity methodology: a $15,000 fine, a 10-day suspension held in abeyance, and a two-year QA/QC staffing requirement. The precedent that a lab can lose everything is real but a year older: in 2025, RM3 Labs was fined $200,000 and lost its license after investigators concluded it was inflating potency data. Claim strength for RM3: the action appears in the Division's 2025 list; the potency-inflation characterization is from trade press coverage.

For scale: the Division's own 2025 annual enforcement report puts total fines across the entire industry at $1,082,000 for the year. Coloradans bought $1.32 billion of regulated cannabis in the same year. The whole industry's annual fine bill was less than a tenth of one percent of sales.

The advisory record deserves a fence here rather than a gotcha, because our own position cuts against the easy criticism. All twenty health-and-safety advisories the Division issued in 2026 through mid-August were for contaminants; none concerned potency, homogeneity, or label accuracy. On this site's read, that is mostly as it should be. Advisories and recalls are safety instruments, and a potency miss is usually a quality-control problem, not a safety emergency: flower potency can only honestly be a range in the first place, and for edibles and concentrates, where a single number is a fair demand, a marginal miss calls for a corrective-action plan and a truer label, not a recall, unless the numbers are completely off. Most of the misses in the state's own edibles data were marginal, by fractions of a milligram (the full label-accuracy record, each figure with its scope, is its own page). By our own standard, quiet correction was the right tool for most of them.

One caveat keeps that standard honest. Edible homogeneity is not a nothing issue, because its cost is not spread evenly across users. It lands mainly on people with low tolerance, and hardest on new medical patients working down to their minimum effective dose, for whom one piece quietly carrying its neighbor's share of THC is a lost evening. Those are exactly the readers this site exists for, and it is who we watch this data on behalf of. That is an argument for truer labels and better mixing. It is still not, short of numbers that are completely off, an argument for a recall.

Which is why the real complaints stay where this article and its companions put them. Deliberate adulteration is a different thing entirely from a quality-control miss, and it draws a business-expense fine. And the quiet corrections are invisible (by design), so the public cannot tell whether the couple of large misses, the ones that might have warranted more, got more.

What was asked for, and what exists

The industry voices who opposed third-party sample collection did not ask for nothing instead. They asked, repeatedly and specifically, for an enforcement program: expand shelf surveillance, inspect annually, set minimum fines, revoke licenses for adulteration (March, June). The state side agreed revocation belongs on the table. The forum's year ended with the third-party proposal declined, which was its right; forums advise, they don't write rules. And the declining had a real reason beyond preference: the proposal would have landed a heavy new cost on producers. The estimates fought at the podium ran from a modest bump to a tripling of a business's annual testing bill, and even the most careful revised estimate, offered by a manufacturer who publicly corrected his own earlier number, put a daily-pickup operation at roughly $40,000 to $50,000 a year (the March cost fight, revised in June), on an industry that told the forum it has lost a billion dollars of revenue in four years. We will be monitoring whether the alternatives that replaced it, the first-party sampling reforms and the enforcement asks above, actually prove effective, and we will report what we find either way.

But as of the August 7 meeting, the record contains no enforcement proposal, no minimum-penalty schedule, and no draft rule answering the request that industry itself made. The one thing everyone agreed on is the one thing nothing has been drafted for.

What this record cannot tell you

Two honest limits, because the absence of visible enforcement is not proof of absent enforcement.

First, the surveillance program's own design hides most of its response ladder. The founding bulletin committed the Division, in the event of a failed sample, to quarantine and corrective-action paperwork first, recall and embargo only after. The first two rungs produce no public document at all. A batch quarantined quietly and remediated through a corrective-action plan looks, from the outside, exactly like nothing happening. The public record cannot distinguish diligent quiet remediation from inaction, and that indistinguishability is itself a problem for a program whose product is public confidence.

Second, cases in progress are invisible until they settle. The Division publishes final actions only. Bona Fides' order to show cause issued in August 2025 and did not surface publicly until its April 2026 settlement, an eight-month lag. A proceeding opened after the surveillance results landed in mid-2026 would not be expected on the public record before 2027. If such cases exist, this article's picture changes, and we will update it and say so.

What we are watching

• Any stipulation appearing in late 2026 or 2027 with a 2026-vintage complaint number charging potency or homogeneity violations. That would be the first visible surveillance-driven enforcement.
• Any minimum-penalty or revocation-schedule language in the August rulemaking or after.
• The September 4 forum, where we are collecting reader questions. Whether enforcement gets an agenda slot is itself a data point.

The chemicals behind this year's advisories, in plain terms

Every pesticide named in a 2026 Colorado cannabis advisory is forbidden on cannabis outright. Not capped, not restricted: forbidden. Each is conventional agricultural chemistry with an EPA residue tolerance for food crops, and under Colorado's pesticide rule for cannabis, having a food-crop tolerance is itself disqualifying, because nobody has ever established what any residue does when it is smoked or vaporized instead of eaten. The action limits labs test against are detection thresholds, not allowances.

Read the third column and the pattern tells you why this chemistry shows up. Mites and mold are the two chronic diseases of dense indoor cannabis, and these are exactly the rescue chemicals a grower reaches for when an outbreak threatens a whole crop and the legal toolkit is losing. That is an observation about the chemicals, not about any named business: an advisory is a contamination finding, and how the chemical got there is a separate question in every case.

What the legal toolkit is. Colorado's allowed list for cannabis runs to botanical oils, insecticidal soaps, sulfur, potassium bicarbonate, beneficial microbes, and pyrethrins, plus predator insects, which are not pesticides at all. Those tools work as prevention: quarantining incoming clones (mites arrive on cuttings), scouting, sanitation between grow cycles, and keeping humidity, airflow, and plant spacing where mildew and root rot cannot get started. What they mostly cannot do is rescue a crop after a bad outbreak has taken hold.

So the pressure to reach for banned chemistry is real, and it peaks at the worst possible moment: a whole crop on the line, and the only legal exit a financial hit. Some succumb; the enforcement record earlier in this page shows what that looks like. But most growers appear to be playing by the rules: keeping pests from ever getting a foothold with good plant hygiene, and taking the loss when a crop goes wrong despite every precaution. Those are the businesses the missing enforcement shortchanges most.

And if the crop fails anyway? The rule leaves one fork. A business may ask the lab for two additional analyses of the original test batch; if both pass, the batch moves. If either fails, the rule's words are plain: the business "must destroy and document the destruction" of the batch. There is no decontamination or remediation path for a confirmed pesticide failure, the way there is for some microbial failures, because extraction concentrates pesticides rather than removing them. Destruction is the lawful exit, and it is expensive, and that expense is precisely what the dilution described at the top of this page was engineered to avoid.

And notice what the retest option really is: a lawful round of the same game this whole article is about. A batch that failed by a mile gains nothing from two more analyses of the same material, so nobody bothers. A batch that failed by a hair is a coin worth flipping twice, because near the action limit the difference between one fail and two passes can be instrument scatter rather than chemistry. The provision is sensibly meant as protection against a single bad measurement, and it doubles as an invitation to roll the dice on the close ones. Using it is entirely legal. It is just one more place where this system turns a noisy measurement into a binary verdict, and where the winning move is to play the noise. Claim strength: analysis.

In fairness to the provision: any single lab test genuinely can be bad, which is why it exists. And our reading is checkable rather than a vibe, because the two uses leave different fingerprints. If the retest option works as measurement protection, challenges should appear across failures of every size. If it works as a dice roll, challenges will cluster among the near-threshold failures, and those challenges will disproportionately go on to pass. The data that separates the two (the original result, how far it missed, whether a retest was requested, and how it came out) sits in the state's testing records. That is a question worth asking, and it is going on our September 4 list.

Quotes from forum meetings are from our machine transcripts of the Division's published recordings, which are the source of record; timestamps let you check any quote against the audio. Quotes from enforcement documents are from the stipulations as published by the Division.