Colorado Cannabis Facility Video Surveillance Compliance

Rule 3-225(E)(2) requires that recordings be kept a minimum of 30 days in a format that is easily accessible for viewing. Many Colorado vendor pages still say 40 days. They are wrong, and that error has real cost, because retention is the single largest driver of video storage spend.

Thirty days is a floor, not a recommendation. Plenty of operators choose longer retention for insurance, internal loss prevention or litigation reasons, and that is a business decision worth making deliberately. Just do not pay for 40 days believing the state requires it.

The subsections that previously carried the equipment specification, 3-225(B)(2) and 3-225(E)(3), are repealed. There is no current state-mandated pixel count or frame rate for a Colorado cannabis surveillance camera.

What survives is a performance standard, and it is arguably harder to meet than a number. The rule requires playback quality suitable for viewing, capture of the identity of all individuals and all activities in monitored areas, capability of identifying activity within 20 feet of all points of ingress and egress, and clear and certain identification of any individual, with facial feature capture at point of sale sufficient to determine identity.

A performance standard shifts the burden onto the design. You cannot satisfy an inspector by pointing at a product sheet. You satisfy them by showing that the installed camera actually resolves a face at the distance the rule names.

Because the state gave no number, the integrator has to supply one. We use the IEC 62676-4 DORI framework, which defines observer task levels by pixel density on target.

Identification is 250 pixels per meter, roughly 80 pixels per foot. We design to that at point of sale and at every point of ingress and egress, because those are the locations where the rule demands identification of an individual.

Recognition is 125 pixels per meter, roughly 40 pixels per foot. That is the appropriate level for general Limited Access Area coverage where the task is knowing who this is among known staff rather than identifying a stranger.

The deliverable is explicit. We hand you a camera map annotated with pixel density at the 20-foot line for every ingress and egress point, plus point of sale positions. That document is what you want in front of an inspector, and it is what most facilities cannot produce.

The equipment requirements are concrete and worth itemizing, because each one is a check an inspector can perform in a minute.

Coverage is where most remediation work happens, because facilities get built, then reconfigured, and the camera map does not follow the reconfiguration.

The rule requires coverage of all Restricted Access and Limited Access Areas, point of sale areas, security rooms, all points of ingress and egress to Limited Access Areas, all areas where product is displayed for sale, and all points of ingress and egress to the exterior of the licensed premises. All entrances and exits must be recorded from both indoor and outdoor vantage points.

Recording must work in any lighting condition. There is a cultivation exception: a rotating schedule of lighted and zero-illumination conditions is allowed, provided ingress and egress points to flowering areas remain constantly illuminated.

Grow, sampling, testing, curing, manufacturing, research and storage areas each require a camera in the room facing the primary entry door, mounted at a height that gives a clear unobstructed view not blocked by lighting hoods, fixtures or equipment. In a flower room that is a genuine design constraint, not a formality. Hoods, trellis, ducting and light movers all conspire to block the exact sight line the rule requires, and the mounting solution usually has to be worked out on site.

Cameras are also required at each location where weighing, packaging, transport preparation, processing or tagging occurs, and at least one camera must be dedicated to recording access points to the secured surveillance recording area. Outdoor cultivation areas must meet the same requirements as indoor Limited Access Areas.

The surveillance room is itself a Limited Access Area, in a designated, locked and secured room or enclosure. Treat it as a controlled space with its own access list.

The licensee must keep a current list of authorized employees and service personnel with access to the surveillance area, and a surveillance equipment maintenance activity log recording who serviced the system, when and why. Those two documents get requested regularly and are frequently missing.

Off-site monitoring and off-site storage by the licensee or by an independent third party is permitted, provided the remote standards meet or exceed the on-site standards. That is the opening for a cloud or hosted architecture, and for many operators it is the fastest way to cut surveillance room overhead.

Premises in a shared building must have a separate surveillance room dedicated to that premises. Commonly owned businesses in the same local jurisdiction may share a central surveillance room, provided the facility without one has a review station, a printer and a camera placement map meeting the same minimums.

All camera views of all Limited Access Areas must be recorded continuously 24 hours a day. Motion detection is authorized only where the licensee can demonstrate that monitored activities are adequately recorded, so it is an exception you have to be able to defend rather than a default setting.

Retention is a minimum of 30 days, archived in a format that ensures authentication as legitimately captured video and guarantees no alteration.

Date and time must be embedded on all recordings without significantly obscuring the picture, and synchronized with the point of sale system, measured against official United States time. That makes network time configuration a compliance item rather than an IT nicety. A recorder that has drifted three minutes from the point of sale system is a finding.

After the retention schedule lapses, recordings must be erased or destroyed prior to sale, transfer or disposal of the equipment. There is also a litigation hold: recordings may not be destroyed if the licensee knows or should have known of a pending criminal, civil or administrative investigation.

Five documents belong on site and available. Missing paperwork is the most common finding we see, and it is the cheapest one to fix.

The Colorado market has contracted for several consecutive years from its 2021 peak, and licensed recreational cultivations fell sharply over that period. That shapes the work realistically.

The projects now are consolidation, relocation into smaller footprints, cloud migration to cut surveillance room and on-premises overhead, retention cost reduction, and compliance remediation at acquired facilities where the camera map no longer matches the build. Greenfield construction is the exception rather than the rule.

That is a good fit for how we work. Remediation and migration reward somebody who reads the rule carefully and can document the result, rather than somebody selling a new-build package.

Rules change. Confirm current rule text and interpretation with the Marijuana Enforcement Division. This page is a plain-language summary for planning and is not legal advice.