Just as common terms like cyber insurance, data breach protocols, and “cyber hygiene” were foreign to attorneys and claims professionals as recently as 10 years ago, Cannabis-Related Businesses (CRBs) are about to become much more familiar to the insurance world. Cannabis insurance has essentially replaced cyber liability as the “new and shiny” topic at insurance seminars. Although some of our peers in the legal industry may resist the emerging cannabis markets, prudent forecasters are excited about the opportunity these markets present.
An analysis by cannabis market research firm BDSA has predicted that national sales of regulated marijuana will reach $42 billion in 2026, and that the U.S. will account for 75% of the global market share. In other words, cannabis is trending upward. What can we take from our recent experiences with the emerging cyber markets that we can now apply to CRBs?
Cannabis in the U.S.
As those with even a passing interest in cyber insurance are aware, there is no comprehensive federal law regulating data privacy. This is where data privacy and cannabis differ, because cannabis does have some applicable federal laws. Specifically, marijuana is a Schedule 1 drug and is therefore illegal under federal law. This designation has caused many banks and insurers to hesitate before working with growers and dispensaries in legalized states.
Recently, momentum has built to change this. In August, the Department of Health and Human Services recommended that cannabis be reclassified from Schedule 1 to Schedule 3 under the Controlled Substances Act. Legislatively, the SAFER Banking Act, which would more easily allow access to the banking system for cannabis businesses, passed a committee vote in late September and advanced to the Senate floor.
However, just as cyber practitioners await a codified federal data privacy framework, CRBs await passage of a bill that will continue the “normalization” trend of cannabis products.
Obtaining Coverage Amid Market Uncertainty
As more CRBs emerge, they look to traditional products like property insurance, product liability coverage, and workers’ compensation. Although these policies are common, CRBs continue to struggle finding coverage due to the federal criminal classification.
Like the early days of cyber, even though cannabis holds significant potential as an established, legitimate industry, some insurance experts, according to the National Association of Insurance Commissioners (NAIC), are still recommending that insurers and brokers not formally advertise their services to CRBs due to the federal laws surrounding cannabis. As of 2021, there were only about 30 U.S. insurers that offered cannabis protection.
Similar to early cyber coverage, CRBs have concerns about whether their policies actually protect them for the certain foreseeable risks. Cannabis businesses not only have difficulties obtaining insurance, but also have the added wrinkle of collecting under their insurance policies. In addition, due to the federal illegality, CRBs do not have the option of federal bankruptcy protection, if needed.
There is also a broader policy concern with allowing parties to insure against losses from illegal conduct. Cannabis-related firms cannot even be confident that their insurers will be permitted to abide by the policies they sold. Historically, courts have tended to read insurance coverage claims arising out of the use of illegal drugs somewhat narrowly.
Addressing the Risks
One common thread between the cyber and cannabis insurance industries is that many insureds fail to understand the preparation required to mitigate the inevitable risks. Insureds should be keenly aware of the following risks:
Product liability concerns and supply chain shortages. CRBs typically operate like any other agricultural business and can be exposed to product contamination during storage, transport, or manufacturing due to bacteria build-up, pesticides used during cultivation, or numerous other causes. These incidents can result in regulatory fines and product recalls that can adversely affect their reputation and cause them to lose their businesses or have their licenses revoked. In addition, given that current regulations prevent interstate travel for cannabis products, cannabis businesses are barred from shipping excess product across state lines to address shortages that may occur.
Compliance with rapidly evolving regulations. Cannabis regulations differ depending on the location of the business, and CRBs must keep up with a constantly evolving landscape. Attorneys who practice in the CRB space are hard-pressed to provide “comfortable advice” to their clients due to dynamic compliance costs, potential fines for non-compliance, the different regulations across jurisdictions, and the reality that all of these risks are constantly in flux.
Crime and theft. As cannabis businesses are forced to conduct transactions entirely in cash, companies also face increased theft and security risks. Cannabis zoning laws can also increase businesses’ exposure to crime as many local regulations limit the number of marijuana enterprises, which push some dispensaries into dangerous parts of a city.
Workplace accidents. Improper treatment of chemicals, wastes, and other contaminants in the workplace can cause skin or eye irritation, poisoning, or respiratory issues to employees, exposing cannabis-related companies to investigations, fines, penalties, and legal actions. For CRBs, the misconduct of employees or customers can result in costly liability claims. Insufficient limits can put the business at serious financial risk for litigation and defense costs.
Natural disasters. The cannabis industry’s businesses rely on agriculture, and natural disasters—such as wildfires, storms, and flooding—can easily ruin cannabis crops. According to the U.S. Department of Agriculture, cannabis is not eligible for the federal crop insurance program because it contains more than 0.3% THC, a psychoactive substance.
Reputational damage. Like all businesses, there are a range of incidents that can cause drastic harm to cannabis companies’ reputations. Examples such as allegations of fraud, improper dosing, product contamination, and unsubstantiated claims of health benefits can all be damaging.
Cybersecurity. Because of the type of information that cannabis companies interact with, they can become prime targets for hackers. As with all other insured companies that deal with sensitive information, cybercriminals may attempt to steal information. For cannabis companies, this information may concern seeds, plants, growing conditions, product specifications, formulations, and customer and employee data. Lawyers and adjusters need to impress upon their CRBs that cybersecurity measures must be taken seriously.
As more states legalize cannabis and more CRBs join the market, insurance companies will not be able to ignore the industry, and litigation opportunities for potential plaintiffs and defense firms will only increase. As litigation practices increase, more CRBs will turn to insurance policies to protect them. Thus, as the growing cannabis insurance market shows no signs of slowing down, adjusters and attorneys need to be nimble enough to stay current with state and federal laws.
Thankfully, many of the strategies lawyers and adjusters used in the early days of cyber insurance also apply here. As local and national laws continue to change and adapt, managing client expectations and holding quarterly check-ins can help identify and address problems before insurance coverage needs to apply. For example, one of the rapidly growing trends in 2023 is for standard “cannabis coverage” endorsements that broadly cover “cannabis activity,” defined as “the design, cultivation, manufacture, processing, packaging, handling, testing, storage, distribution, sale, serving, furnishing, possession, or disposal” of cannabis.
These extensive endorsements will eventually become more precise and specialized, similar to early cyber insurance policies, and will likely eventually split into either first-party or third-party coverage in response to a growing variety of claims. The law firms and insurers that can keep pace as the industry continues to mature will be in the best position to counsel their clients on how to most effectively protect their businesses and take advantage of a growth product area.