AI Customer Service for Cannabis Dispensaries (Compliant Setup)

Your budtenders are answering "are you open" and "do you have this" while a customer is standing at the counter, and one wrong reply about sleep, dose, or a price can become a screenshot your regulator reads later. AI customer service for a cannabis dispensary has to confirm the person is 21 or older, or at the state's medical age, before it names a product, refuse "what helps me sleep," and pull every price and quantity from the register. Skip any of those and the convenience is a compliance incident. We build systems for dispensaries. The question, for one shop or for several, is how to take the repetitive messages off the counter without taking on a license risk or a texting lawsuit. For the wider map of where automation earns its place in a dispensary, start with cannabis industry AI opportunities.

What follows is the build, written the way the week actually runs. We will go through why a bot made for an ordinary store breaks on a dispensary menu, the four gates a compliant setup has to clear in order, why a text is the part that ends up in court, which questions stay with a budtender, how to turn the gates on one layer at a time, a twenty-minute count you can run on your own inbox this afternoon, and what changes when a second store has a different shelf. None of that is a setting you toggle on. Each gate is a step you can watch fail in a transcript, which is why the test conversation comes before the first real customer.

Why do generic chatbots fail in cannabis retail?

A standard support bot is built to say yes. In cannabis that habit is a liability. The plain chatbot you can drop onto an ordinary store has no idea of age, no idea of a controlled product, and no connection to the inventory system. On a dispensary site it will tell someone under 21 which gummy is strongest, quote last Tuesday's price, and recommend a strain for anxiety. That is a normal afternoon, not a rare edge case.

Three structural reasons the generic build breaks:

It has no age gate, and age is a precondition.

In every legal market, a sale and most product conversations require 21 for adult use, or the state's medical minimum. A generic bot opens with "How can I help?" A compliant one establishes age first. If it answers a product question before it knows the person is of age, the transcript shows a tool that served a minor. The age check is not a banner a visitor can wave away and keep shopping. It is the step that decides whether the rest of the conversation is allowed to happen at all. The log has to show the gate, the time, and then the product talk, in that order, for every session, including the one that arrived on Instagram at 11 at night when nobody was at the counter. If the product name comes first, you will not have a second explanation that holds up when someone reads the thread later.

It makes medical and dosing claims it is not allowed to make.

Ask a generic model what is good for sleep and it answers, because that is what it was trained to do. In a licensed shop, "this indica helps with sleep" or "take 10 mg for pain" is a medical claim, and those claims from a retailer create regulatory exposure in most states. A budtender knows to decline medical advice and describe what customers reach for. A plain model will diagnose, dose, and recommend, and every answer is on the transcript. The line a budtender already uses, that they cannot give medical advice and can only describe what other customers reach for, has to be the bot's line too. A model that has never stood at a counter does not know that line exists unless you write it as a hard stop. Diagnose, dose, and recommend are three different sentences, and a regulator can read any one of them back to you from the log.

It invents the menu instead of reading it.

A generic bot does not know live inventory, so it refuses product questions or invents the answers: a strain sold out three days ago, an old promo price, a quantity you do not have. The menu source of truth is the point-of-sale system, Dutchie POS, Treez, Flowhub, Cova, or BioTrack, tied to Metrc for state seed-to-sale tracking. A guess about a controlled product is a compliance problem. Wiring the bot to the register is covered in dispensary menu sync automation.

What does a "compliant" AI setup actually have to do?

Compliant is a sequence the bot runs on every conversation, in order, with no skips. For a dispensary it does four jobs.

One: gate on age before product. The first interaction establishes 21 or older, or the state medical age. No product names, no prices, no recommendations until that gate clears. The result is logged with a timestamp.

Two: refuse medical and dosing claims, and hand them to a person. When a question becomes "will this treat X" or "how much should I take for Y," the bot holds a line such as "our staff can talk you through options in the store" and hands the conversation over. It does not improvise around the rule.

Three: read the menu from the register, never from memory. Every price, every "do you have it," every quantity is a live query against Dutchie POS, Treez, Flowhub, Cova, or BioTrack. If the register says out of stock, the bot says out of stock.

Four: respect contact rules before any outbound text. This is the step that turns a service tool into a legal one, and it is where shops that get sued go wrong.

The four-gate pre-launch checklist.

Before you turn anything on, confirm all four in a recorded test conversation:

• Age gate fires first. Ask a product question with no introduction. The bot should refuse and ask for age before it answers.
• A dosing question leaves the bot. Ask how much to take to sleep. The bot should decline to dose and offer a person, not a number.
• The menu answer matches the register. Mark an item out of stock. The bot should say it is unavailable inside your sync window.
• Outbound consent is logged. Confirm no text goes to a number that has not opted in, and that the opt-in (timestamp, source, and the language shown) is stored.

Why is the TCPA the biggest legal trap in dispensary texting?

Cannabis is not exempt. The Telephone Consumer Protection Act covers automated and marketing texts to mobile phones. Under 47 U.S.C. 227(b)(3), as published by the Legal Information Institute at Cornell Law, a plaintiff recovers $500 per violating text, trebled to up to $1,500 per text for a willful or knowing violation. That is per text. A blast to 5,000 customers is statutory damages with five thousand multipliers, not a single $500 problem.

Snell & Wilmer reports more than 15 TCPA class actions against cannabis companies in recent months, including Lemus v. 2015 Halladay Wellness, Inc. (C.D. Cal). Shops text heavily, often without clean consent. An AI layer that sends texts without consent on file multiplies that exposure. Read the damages as per text, not per person and not per campaign. One non-compliant blast to 5,000 customers is the statute applied five thousand times, and a willful finding can take each of those to $1,500. Plaintiffs' firms have already noticed that dispensaries text often and that the consent record is often a spreadsheet nobody can date. Connecting a bot to your texting tool without a consent check does not lower the exposure. It sends the same message to more numbers, faster, which is the automated system the statute is written about.

What the bot has to respect.

A defensible setup keeps a paper trail behind every outbound text:

• Prior express written consent for marketing texts, captured with a real opt-in (a checkbox, a keyword, or a form), stored with timestamp and source.
• STOP and HELP handling so an opt-out is honored immediately and logged. The bot stops. It does not set the request aside for later.
• Quiet hours and a cap on frequency so the automation does not text at 2 in the morning or seven times in a day.
• A split between transactional and marketing. "Your order is ready" is transactional. "20% off all flower today" is marketing and needs the consent above.

If the bot cannot show consent for a number, it should not text that number. The recovery flows that bring a lapsed customer back, done with that same consent discipline, are in dispensary abandoned cart recovery.

What should the bot answer, and what must go to a human?

The bot handles high-volume questions that carry no judgment. A medical claim, a dose, a compliance edge, or a refund goes to a person, so budtenders are not answering store hours forty times a day. Do not move a row out of "Route to human" without a lawyer signing off.

Across the table, the bot may state facts that come from a system you control, your hours and your register, and it may not invent an opinion about a customer's body. When the question is shaped like an opinion, it goes to a person. That one rule prevents most of the regulatory trouble a dispensary bot can get into.

How do you build the gating and routing in practice?

Build the layers in this order, and test each one before the next. Shipping all four at once is how a bot quietly answers a minor on a path nobody tested.

Start with the age gate.

On any new session, establish age first. On web chat, confirm before product content loads. On text, capture age in the opt-in. Log it with a timestamp so you can show the gate cleared before product talk. Do not open with "How can I help?"

Then classify intent and route the risky ones.

Classify every message before answering: facts (hours, stock, price), transactional (order status), or risk (medical, dosing, complaint, refund). Facts and transactional get an answer. Risk gets a held line and a handoff with the conversation attached. When the classifier is unsure, it hands the message to a person. A needless handoff costs a staffer about half a minute. Answering a dose anyway can become a regulatory finding.

Then wire the menu to the register.

After age and intent are solid, query Dutchie POS, Treez, Flowhub, Cova, or BioTrack for stock and price at answer time, not from a cache older than your sync window. If the connection is down, say someone will check rather than invent a number. A cached price from this morning is already a guess by the afternoon rush, and a guess about a controlled product is the failure the age gate and the dosing rule were built to prevent. The same sync habits are in dispensary menu sync automation, so the bot and the website never disagree about what is on the shelf. Test that disagreement on purpose: mark one item out of stock, ask the bot, and read the answer before a customer does.

How do you size the problem before you spend a dollar?

One budtender can tag the inbox in about twenty minutes and see both what a bot could take and what has to stay human.

Pull your last 50 inbound customer messages, from web chat, texts, or Instagram, whichever channel is busiest. Tag each one: facts (hours, location, "are you open," "do you have this," price), transactional (order status, pickup), or risk (a medical claim, a dose, a refund, or a complaint). Count the buckets.

Facts plus transactional is the ceiling a compliant bot can take off the counter. Risk stays human. Count how many of the 50 touched dosing or a medical claim. Those must go to a person, and if a third of the inbox is dosing questions, the useful build sorts those conversations to a person. Write the three counts on a card and keep it. Facts plus transactional is the ceiling a compliant bot can take off the counter. Risk is the floor of work that stays with a person no matter how fluent the model gets. If dosing is a third of the fifty, staff the handoff for that volume before you celebrate the hours questions disappearing, because the bot is a sorter in that shop, not an answer machine.

Run the same count 30 days after launch. The facts bucket should be mostly handled by the bot, staff time on the risk bucket should improve because they are not buried in closing time, and texting exposure should be flat or lower because every outbound text passes a consent check. If those three are not true, fix the build.

What changes when you run more than one location?

The gates stay. The data path changes. Each store has its own menu, prices, stock, and often its own hours, and sometimes its own state rules. "Do you have it" has to know which store before the register query, because the shelf at one store is not the shelf at the next.

Ask or detect the store right after the age gate, then scope every menu and hours query to that register. Track consent for the entity that captured it, not for a shared brand inbox that any store can text from. If the stores sit in different states, the age rule and the advertising rule can differ too, so the location the customer names also picks which rulebook the bot is allowed to speak from. Quoting the wrong store sends someone to a shop that is out of the item, and that drive across town is the trust the automation was supposed to protect. One brand, many shelves, one rulebook, and data that stays scoped to the store the customer actually asked about.

Common questions.

Why do generic chatbots fail in cannabis retail?

A standard support bot says yes, with no concept of age, no concept of a controlled product, and no connection to your register. On a dispensary site it answers minors, quotes a stale or invented price, and recommends a strain for sleep. Cannabis needs a bot that gates and hands off.

Is texting customers from an AI tool a TCPA risk for dispensaries?

Yes, and it is the largest legal trap. The TCPA covers automated and marketing texts, cannabis is not exempt, and damages run $500 per violating text, trebled to up to $1,500 per text for willful violations. Snell and Wilmer reports more than 15 cannabis class actions in recent months. An AI layer that sends texts without clean, logged consent scales the exposure.

What questions should the bot answer versus route to a human?

The bot answers high-volume facts with no judgment: hours, location, whether you are open, live stock and price from the register, and transactional order status. It sends a person anything that touches a medical claim, a dosing decision, a refund, or a complaint. The bot states facts from a system you control. It does not offer an opinion about what a product will do to a body.

How do I size the problem before paying for a build?

Pull your last 50 inbound customer messages and tag each as facts, transactional, or risk. Facts plus transactional is the ceiling on what you can automate. Risk is the human work that must stay human. Then count how many touched dosing or a medical claim. Those are the conversations a bot must hand off, and the number tells you how hard the classifier should lean that way.

Does the setup change if I run multiple dispensary locations?

The gates stay the same. The data path changes. Each store has its own live menu, hours, and stock, so the bot has to resolve which location the customer means right after the age gate and scope every register and hours query to that store. Consent is tracked per operating entity. Quoting the wrong store's inventory is the failure mode, so location comes before any menu answer.

Where these figures come from.

The statutory damages, $500 per violating text and up to $1,500 per text when the violation is willful or knowing, come from 47 U.S.C. 227(b)(3) as published by the Legal Information Institute at Cornell Law School. The litigation context, more than 15 TCPA class actions against cannabis companies in recent months, the named case Lemus v. 2015 Halladay Wellness, Inc. in the Central District of California, and the point that cannabis is not exempt, comes from Snell & Wilmer. The 5,000-customer blast is an illustration of the per-text multiplier, not a case result.

Age gating at 21 for adult use, or the state medical age, the exposure from medical and dosing claims, and the register as the menu source of truth tied to Metrc are operating requirements of legal cannabis retail. Dutchie POS, Treez, Flowhub, Cova, and BioTrack are the systems named because they are the ones shops actually run against Metrc. The count of your last 50 messages is a measurement you run on your own inbox. If you want those four gates mapped onto that inbox, send the last week of messages and the plan arrives by email a few minutes after you send it, with which questions a compliant bot can take and which ones stay with your budtenders.