Guide · Cannabis · Recall Response

Cannabis Recalls in Illinois and Missouri: The First 24 Hours, Required Notices, Regulator-Ordered Recalls, and Disposition

An Illinois dispensary must notify three state agencies within 24 hours of discovering defective or potentially defective cannabis, and IDFPR can order a recall and quarantine. Missouri’s Division can publish a recall notice when product may threaten health and safety. The first day decides whether the recall can be scoped and proven.

By Lincoln Square Law · 8-minute read

What the rules require before anything goes wrong

A recall plan is a legal requirement in Illinois retail, not only good practice. Each IDFPR-licensed dispensing organization must have policies and procedures governing voluntary recalls, and its written recall procedures must include, at a minimum, a way to reach purchasers who have or likely have the product and tell them how to return it, a way to identify and contact the cultivation center, craft grower, or infuser that made it, a process to notify IDFPR, the Department of Agriculture, and the Department of Public Health within 24 hours of discovering defective or potentially defective cannabis, procedures for collecting recalled product, destruction procedures that comply with the rule, and entry of recalled product into the State verification system before destruction (68 Ill. Adm. Code 1291.330).

Supply-side licensees should confirm the Department of Agriculture’s requirements for their license category in Part 1300 and keep their own procedures consistent with the dispensary rule, because the dispensary’s 24-hour notice will reach the producer quickly.

In Missouri, the Division of Cannabis Regulation may issue a public notice of recall where marijuana product presents a potential threat to health and safety (19 CSR 100-1.100(4)(P), as cited in the Division’s recall notices). A recall notice the Division issued on May 1, 2026 identified the cultivation licensee, the source tag of the product, the laboratory finding behind the recall, instructions to return unused product to the dispensary where purchased, a statement that returned product does not count toward a patient’s purchase limit, and an address for reporting adverse reactions. Missouri’s proposed amendment to 19 CSR 100-1.100, to be published November 2, 2026, would also address administrative holds and recalls for product that cannot be verified in the tracking system as Missouri-grown.

When the regulator orders the recall

IDFPR may order a recall of cannabis that is adulterated, misbranded, or otherwise poses a danger to public safety. If product creates or poses an immediate and serious threat to human life or health, IDFPR may order distribution to stop and require a recall. It may require quarantine without destruction for at least 72 hours or until further notice, whichever is later, and suspect product may be tested at a laboratory approved by the Department of Agriculture and returned to active stock if shown to be safe. For this rule, adulterated product includes product whose tamper-evident seal is broken, product altered after packaging, and product whose condition has materially changed since laboratory testing. The Director issues a recall order supported by affidavits, an affected dispensary may request a hearing within 30 days, and the Department bears the burden of proof (68 Ill. Adm. Code 1291.330).

Two practical consequences follow. A dispensary under a quarantine order must not destroy the product, even if destruction seems cautious, because the product may be tested and released. And because the order rests on affidavits stating the factual basis, the dispensary’s own records of receipt, storage, and handling will be compared with the regulator’s account.

Hour zero: one command structure

The first decision is who has authority. Name an incident lead, a regulatory lead, an operations lead, a communications lead, and one person responsible for the record. Open a timestamped incident log. Then stop sale, transfer, shipment, rework, relabeling, and destruction of potentially affected product until the scope is understood. The goal is to keep the product population and the evidence from changing while the team decides what belongs in the hold.

The Illinois 24-hour notice runs from discovery of defective or potentially defective product, not from the end of the investigation. The incident log should record when that discovery occurred and who made it.

Preserve the record before correcting it

Export the relevant tracking data, manifests, package histories, certificates of analysis, production and batch records, sanitation and environmental records, access logs, surveillance references, complaints, returns, and supplier communications as they existed when the problem was found. If an inventory entry or label is later corrected, keep the before-and-after record and the reason.

Recalls often become investigations. A regulator may ask when management learned of the problem, what the tracking system showed at that time, who changed records, and why. An operator that cleans its data before preserving it can create a credibility problem even when the underlying issue was minor.

Scope with identifiers

“Some gummies from last week” is not a scope. Build a table with license number, facility, product name, batch or lot, package tag, production date, test sample and result, transfer destinations, and quantities produced, transferred, sold, returned, and still controlled. If the suspected cause is a failed test, a manufacturing deviation, an ingredient, a label error, contamination, or a chain-of-custody break, identify every product population that could share that cause. Start from the tracking system and reconcile it against physical inventory, manifests, and sales records. Record every change to the scope and the reason for it.

Protect consumers before the root cause is known

The team does not need a final root cause to act. If product may present a health or safety risk, quarantine and notice decisions should be made on the available evidence, with the uncertainty documented. Public statements should identify the product precisely, explain what consumers should do, and follow the regulator’s direction, without presenting a working theory as fact. Root-cause work proceeds in parallel: retained-sample testing, review of production and sanitation records, interviews, equipment and environment checks, supplier inputs, and comparison of affected and unaffected lots. If counsel is directing the investigation to give legal advice, set that up deliberately rather than assuming internal emails are privileged.

Collecting returns and final disposition

The Illinois rule requires procedures for collecting recalled product and entry of recalled product into the State verification system before destruction, and destruction must follow the rule’s destruction section (68 Ill. Adm. Code 1291.330). Missouri’s notices direct consumers to return product to the dispensary where they bought it. Each returned unit should be logged against the scope table, quarantined, and held until disposition is authorized.

A recall is not finished when notices go out. The closeout file should reconcile distributed, located, returned, quarantined, destroyed or released, and unaccounted-for quantities, with follow-up on nonresponsive recipients and the tracking-system entries for each disposition.

Close with corrective action

After containment, identify why the problem occurred and which control failed to catch it. Each corrective action should have an owner, a deadline, and a verification step. Update procedures and training only where the investigation supports the change, then run a mock trace on a different batch to confirm the revised control works. Facility, equipment, or procedure changes that come out of the investigation may themselves require Department review in Illinois or an inspection in Missouri. Our briefing on change control explains when.

Who pays, and what the contracts should say

A recall creates costs: lost inventory, retrieval, testing, destruction, refunds, staff time, and sometimes lost shelf space. Most of those costs are allocated by contract, not by the rules. Supply agreements between producers and dispensaries should say who decides to initiate a voluntary recall, how quickly the producer must respond to a dispensary’s notice, what records the producer will provide, how returned product is credited, who pays for testing and destruction, and how public statements are coordinated.

The Illinois dispensary rule requires a way to identify and contact the producer of recalled product (68 Ill. Adm. Code 1291.330), so the supply agreement should name a recall contact at each party and keep it current. Product recall insurance, where available, has its own notice requirements and exclusions, and its notice deadline may be shorter than the business expects. Review the policy before a recall, not during one.

The record at the end of day one

By the end of the first day, the file should show the incident owner, the product hold, the preserved evidence, the current scope table, the time of discovery and the notices sent, the consumer-protection decision, the preliminary root-cause plan, and the schedule for the next update. Record open questions and who owns each one. The first day does not need to solve the recall. It needs to keep the problem from becoming harder to solve.