Does GDPR apply to my cannabis business if I only operate in one EU country?
Yes. GDPR is EU-wide regulation that applies to ANY business processing personal data within the EU, regardless of whether you operate in one country or multiple. Even single-location dispensaries handling patient records, customer purchases, or employee data must comply with GDPR's full requirements.
What's the difference between EU-GMP and GACP certification?
EU-GMP (Good Manufacturing Practice) applies to cannabis processing, extraction, and product manufacturing. GACP (Good Agricultural and Collection Practice) applies to cultivation operations. Medical cannabis businesses often need both certifications. Both are required for export to EU markets.
Do I need to comply with the Cyber Resilience Act if I just use third-party software?
You have obligations even as a user. While your POS vendor or tracking software provider has primary compliance responsibility, YOU must verify their CRA compliance, include requirements in contracts, and implement proper security configurations. The CRA's reporting obligations (Sept 2026) may also apply if you discover vulnerabilities in systems you use.
Can I operate a cannabis business in Germany right now?
Yes, under Pillar 1 (cannabis clubs). You can establish a non-profit member association with up to 500 members, cultivate cannabis, and distribute to members (25g/day, 50g/month limits). Pillar 2 commercial dispensaries are in pilot phase and only available in select municipalities starting 2025-2026.
How is EU cannabis compliance different from US compliance?
EU compliance is generally MORE complex: GDPR is stricter than any US state privacy law; EU-GMP/GACP standards exceed most US requirements; the Cyber Resilience Act mandates controls that are voluntary in most US states; and cross-border data/product movement adds regulatory layers. However, EU compliance is more harmonized—GDPR applies EU-wide, unlike US state-by-state patchwork.
What happens if I don't comply with GDPR or CRA by the deadlines?
GDPR fines up to €20M or 4% global revenue (whichever is higher), immediate enforcement possible. CRA violations result in fines up to €15M or 2.5% global turnover, plus potential product recalls and sales bans. Beyond fines: license suspension/revocation, reputational damage, and potential criminal charges for serious violations.
Do you provide implementation services or just guides?
Our membership provides comprehensive guides, templates, and checklists you can implement yourself. For hands-on implementation, we offer vCISO consulting services separately (GDPR compliance audits, EU-GMP preparation, incident response, etc.). Many members use our content to implement 80% themselves and hire us for the complex 20%.
How often is content updated?
Weekly. EU cannabis regulations change constantly—new countries legalizing, pilot programs launching, enforcement guidance published. We monitor regulatory developments across all covered countries and update content immediately when requirements change.