The cannabis industry has many component parts, from growers to retailers (dispensaries), and everything in between. And each component part of this burgeoning industry has its own set of risks and exposures, for which it will need insurance protection. The key types of insurance that each such component business should consider are discussed below.
- Product Liability
There may be an increased risk of product liability claims due to the fact that some cannabinoids—chemicals unique to the cannabis plant—are responsible for the plant’s psychoactive effects. Some of these psychoactive effects can manifest themselves in loss of memory; some impact cognition and psychomotor performance; and some lead, possibly, to increased anxiety, among other things. Cannabis products might attract blame for a wide range of perceived adverse health effects due to (a) cannabis’ historical reputation as a psychoactive drug and (b) its ambiguous or at least inconsistent status with respect to legality under various state laws as well as federal law.
This is the type of risk that CGL policies are meant to cover—claims alleging bodily injury from the use of a product. While CGL policies generally have broad grants of coverage—i.e., bodily injury arising out of the policyholder’s product or other aspects of its operations—like all insurance policies, those broad coverage grants are then limited by exclusions. Companies engaged in the cannabis industry might find their insurers relying on, or at least considering, three exclusions that purport to exclude coverage for: (a) failure to comply with applicable law; (b) health hazards; and/or (c) carcinogens. These three exclusions are all reflections of the insurance industry’s unease with what is unknown about the emerging cannabis industry.
- Property Loss/Business Interruption
Cannabis plants are usually grown in greenhouses and, given the risk of fire in greenhouses, property loss and business interruption insurance should be considered. These policies typically only cover sudden, fortuitous losses arising either from “named perils” or “all risks” (the latter typically subject to a significant number of exclusions), depending on the policy type. Property loss and business interruption policies are meant to cover losses arising from fires, some natural disasters, and any other mishaps that cause damage to the policyholder’s property, including both the costs to remediate the property damage, and the costs associated with any business interruption resulting from the property damage. The covered mishaps might include such things as a loss of power to a greenhouse or irrigation system that damages a cannabis grower’s crop.
These policies do, however, have some key exclusions which could limit coverage, such as exclusions for mold, mildew, bugs, and grower error, all of which are very real risks to a cannabis grower. In addition, the policies might exclude coverage for “contraband, or property in the course of illegal transportation or trade”; an exclusion that an insurer might assert if a property loss occurs while transporting the cannabis crop across state lines. Specifically, if the crop were to be transported across state lines, even if to another state in which it is legal, an insurer might argue that federal interstate commerce laws apply, under which cannabis is not legal; thereby theoretically bringing any property loss claim within the contraband exclusion’s scope. It also is possible that a policy might distinguish between plants that are growing and plants that have been harvested, and exclude coverage for the former.
- Commercial Crime
The cannabis industry also faces heightened risks of employee theft. This might be especially true for growers and dispensaries. For growers, the risk of theft might be greatest with respect to the growing plants, from which dishonest employees can cut leaves and stems, diminishing the size of the crop, although it is important to make sure that the policy actually provides coverage for “growing crops” as opposed to “stock.” For dispensaries, the risk is the theft of cash, given that most dispensaries trade in cash as opposed to credit cards.
Commercial crime policies are meant to cover precisely these types of risks. Unfortunately, many insurers may find the risk to be too great where the cannabis industry is concerned, and will therefore refuse to underwrite them. Or, while some insurers might be willing to sell some coverage, that coverage might be substantially limited by exclusions. For example, an insurer might exclude coverage for growing plants, which it might view as too easy to steal, and limit coverage to other property in a grower’s operations, such as equipment or computers, or other business apparatus. And, for dispensaries, insurers might try to attach an exclusion for the theft of cash, but be willing to insure against the theft of the actual products being sold, provided there are strict inventory controls.
- Cyber Liability
The most obvious tech-related risk facing the cannabis industry arises from the fact that dispensaries typically require customers to present identification in order to enter, and then collect personally identifiable information (PII) such as the customer’s name, address, birth date, and driver’s license number from that identification. While no one wants their PII to be accessed or disseminated, dispensary customers would be especially sensitive to the disclosure not only of their PII, but also of the mere fact that they are customers at all.
Even in states in which cannabis is entirely legal or in which it is legal for medical use, many customers would want to keep their use of cannabis products private. This is true for at least two principal reasons. First, cannabis is not legal under federal law and, as a result, there is a possibility that knowledge of a customer’s cannabis could be problematic on various levels, particularly with respect to employment. Specifically, it is possible that, with respect to certain jobs that are subject to licensing—such as attorneys, medical professionals, and psychotherapists, among many others—knowledge of cannabis use could be problematic. Second, notwithstanding its legality on the federal level, there might be a stigma associated with cannabis use, even in states in which it is legal.
For example, although cannabis has been legal in California for several years, there has been a spike in the number of applicants disqualified for government jobs after failing tests for cannabis use. Under Proposition 64, which legalized cannabis in 2016, both public and private employers are still allowed to mandate a drug-free workplace and to terminate any employees that do not follow that mandate. Legislators in California are, accordingly, considering changes to that state’s employment laws which would protect workers and job applicants who used cannabis for medical purposes. But, even without testing, consumers of cannabis products (for both medical and recreational purposes) understandably might want their cannabis use to remain private, in order to avoid any possible employment consequences.
In any event, it is clear that a data breach involving a dispensary could result in significant liability if customers’ PII is released, particularly if any such breach affects a customer’s employment. Accordingly, dispensaries need to be especially vigilant with respect to the PII that the collect, and they need to protect themselves against a breach.
This is where cyber liability insurance is supposed to step in and provide some of that protection. Cyber policies are meant to provide coverage for the costs associated with both mitigating a data breach as well as any resulting liability, among other things (most cyber policies are hybrid property loss/business interruption and liability policies).
In that regard, cyber liability insurers are slowly opening their doors for cannabis-related business. And, like much of the other insurance described above, they are doing so cautiously and at relatively high premiums. But, one thing that is somewhat unique about cyber liability policies is that they are not as uniform or standard as other types of insurance policies and, as a result, tend to be more negotiable. Accordingly, it might be possible for a cannabis business, such as a dispensary, to focus on the types of protections most vital to its business, and possibly forego some of the additional protections that some cyber liability policies may otherwise provide. Such focus may make this line of coverage less cost prohibitive. As with all uncertainties, the more that insurance underwriters understand about a given risk over time, and how to manage it, the more comfortable they may feel about underwriting that risk. That is when prices typically come down.
 See, e.g., The Green Earth Wellness Center LLC v. Atain Specialty Insurance Co., 163 F. Supp.3d 821, 831 (D. CO. 2016), in which the court found that a policy exclusion for “growing crops” barred coverage for the cannabis plants until they were harvested.