Where the Rule Stops Writing

> Correction, September 8, 2026. An earlier version of this article reported that the phrase "three or fewer steps" could not be traced to any Texas rule. That was wrong. It is in the adopted rule, at 25 TAC §300.402(a)(6)(B), and we have rewritten this piece around what the rule actually says. How we got it wrong is described below, because it is the more useful half of the story.

Two questions this morning, both of them the boring kind an operator actually has to answer to keep a store open.

How many steps may a certificate of analysis sit behind the label?

The answer came back: the label must include a conspicuously marked URL that links to a COA in three or fewer steps.

When does the registration renewal window open?

The answer came back: DSHS opens the renewal window approximately one to three months before expiration, through the same online portal.

Both sounded alike. Both were confident, specific, operational. One is in the rule almost word for word. The other we still cannot find anywhere.

The first one is real, and here it is

25 TAC §300.402(a) requires that consumable hemp products marketed as containing cannabinoids be labeled with batch number, batch date, product name, the manufacturer or processor's name, their telephone number and email address, recommended serving size in milligrams and servings per container — and, at paragraph (6), a uniform resource locator that provides or links to a certificate of analysis for the product or each hemp-derived ingredient, including the amount of cannabinoid per serving or unit, the amount of total THC, and total delta-9 THC.

That URL carries two conditions of its own:

> (A) be conspicuously marked; and

> (B) directly link to a webpage where the required COA may be found in three or fewer steps.

So the number is real, it is a condition of the label, and it is not a convention someone invented.

Two further details matter, because they are the ones people get backwards. The URL is mandatory and a QR code does not replace it. When DSHS adopted this section, a commenter proposed allowing a QR code instead of a URL, on the reasoning that a QR code is fewer clicks than reading and typing a small-font address. DSHS declined, and said why: HB 1325 requires the product's label to have a URL linked to the certificate of analysis. A firm may add a QR code as well. It may not substitute one.

And §300.402(b) requires five specific warnings on the label — keep out of reach of children; that the product may contain THC and can cause a user to fail a drug test; that all THCs have psychoactive properties; that pregnant or nursing women should consult a healthcare provider before use; and that the product has not been evaluated by the FDA. Under §300.402(c) the label must appear on the outer packaging of each product intended for individual retail sale.

If you want one thing to check this week, make it the link depth. It is objective, it takes a minute per product, and it is the requirement most likely to have drifted without anyone noticing — a lab changes its portal, a landing page gets an extra interstitial, and a product that shipped compliant quietly stops being so.

How we got it wrong

We reported that requirement as untraceable this morning. We were wrong, and the failure is worth describing precisely, because it is the same class of failure this series keeps writing about — only this time it was ours.

We checked three sources. The DSHS labeling summary page, which lists the required elements but does not reproduce the rule's conditions, so it genuinely does not contain the phrase. A third-party mirror of §300.402, which returned an older version of the section with different subsections. And the adopted rule PDF itself — the right document, containing the right sentence — read through an automated summariser, which reported the phrase absent.

Then a plain text search of that same PDF also came back empty, which felt like confirmation. It was not. The phrase wraps across a line break in the document: found in three ends one line and or fewer steps begins the next. A naive search for the whole phrase on a single line finds nothing.

Three negative results, none of which was evidence of anything, all of which agreed with each other.

The lesson we would rather have learned some other way: a tool reporting that a document does not say something is not the document not saying it. We wrote this morning that an absence of an announcement is not an announcement of absence. The same caution applies one level down, to the instrument itself, and we did not apply it. Read the primary text directly, and when a search comes back empty, confirm the search would have found the thing if it were there.

The second one we still cannot trace

The renewal-window claim has not improved on closer reading.

The adopted rule does set out time periods around registration, and they are easy to mistake for this. Under the retail registration provisions, an initial or renewal application is processed in a first period of 45 calendar days from receipt of a completed application, a second period of 45 calendar days ending when the department issues the registration or a written notice proposing denial, and a third period of 135 calendar days where an application was incomplete.

Those are processing periods that begin when you file. They are not a window that opens ahead of your expiry date, and they do not tell you when the portal will accept a renewal. A "one to three months before expiration" range is not a restatement of them.

What the rule does say is that a retail hemp registration is valid for one year from the date displayed on it and must be renewed annually; that an expired registration is not current or valid; and that a person must not sell at retail or offer to sell a consumable hemp product without a valid registration. On fees: a retail hemp registration or renewal fee of $5,000 for each location is required before the sale of consumable hemp product, and a person who files a renewal application after the expiration date of the current registration must pay an additional delinquency fee of $1,000. A $125 fee applies to an amendment during the registration period. Effective March 31, 2026 (TRD-202601066).

Separately, DSHS publishes an amount payable of $5,150 for a one-year retail registration, stated to include the Texas Online fee. The rule's figure and the amount you remit are different quantities; use the first when citing the rule and the second when budgeting.

None of that tells you when a renewal window opens. We report the claim as untraceable rather than false, and we draw no inference in the other direction — an absence from the surfaces we read is not an announcement of absence, and today is a good day for us to be careful about that distinction. If your renewal date is near, ask DSHS directly rather than planning around an unattributed range.

What the pair actually teaches

We began the day thinking we had found two fabrications with a shared shape. We had found one unverified claim and one real requirement, and no amount of reading the claims would have told us which was which.

They were indistinguishable on every surface feature. Both were specific. Both were operational. Both attached to a genuine obligation. Both were phrased with the flat confidence of something settled. The tone did not separate them. The plausibility did not separate them. Neither did our instinct, which put them in the same bucket and was half wrong.

Only the primary text separated them — and only when read directly, rather than through anything that summarises, mirrors, or indexes it.

That is a narrower and less satisfying rule than the one we published this morning. It is the one that survived contact with the document.

If you want the filing habit that makes any of this checkable, we set it out in [the COA intake checklist](https://gethempdash.com/learn/coa-intake-checklist). For an instance where a circulating claim really did turn out to have no author, see [a deadline nobody published](https://gethempdash.com/learn/a-deadline-nobody-published) — which we still stand behind, and which was verified by a different method than the one that failed here.

Source: Label content and COA link depth: 25 TAC §300.402(a), (a)(6)(A)-(B), (b), (c), adopted rule text filed with the Secretary of State March 2, 2026 (TRD-202601066), effective March 31, 2026, read September 8, 2026; corroborated against the Texas Register adoption notice for the March 2026 issue, including the DSHS response declining to substitute a QR code for the required URL and citing HB 1325. Registration validity, processing periods and fees: the retail registration provisions of the same adopted rule; fee figures 25 TAC §300.502(g), verified August 16, 2026. Amount payable including the Texas Online fee: DSHS licensing surfaces, verified August 27, 2026. Renewal-window timing: no published source located; reported as untraceable, not as absent. Enforcement posture: under review, asserted in neither direction.

The full record set is at [the Texas Rule Center](https://gethempdash.com/texas-rules).