If you’re a small-business owner and marijuana has been legalized in your state, should you care?

The short answer is, yes. Nearly half of small businesses don't have a policy about cannabis use in the workplace and 10% have had employees show up under the influence of a controlled substance at work, according to a survey released Wednesday by Employers Insurance EIG, -0.70% , a workers’ compensation carrier.

The study polled 501 businesses nationwide that employed fewer than 100 employees, in states with varying legalization laws.

Twenty-three states have legalized medical marijuana and four states and the District of Columbia have legalized recreational cannabis.

See also: Marijuana companies struggle to find a place to put their green

A wide majority of respondents — 81% — said they were “unconcerned” about employees coming to work under the influence, but in states that have legalized marijuana use, a lack of policy could lead to major legal headaches.

“All employers regardless of size should have a drug and alcohol policy,” says Todd Wulffson, an attorney at Carothers DiSante & Freudenberger who represents employers. Wulffson says that if an incident involving marijuana happens in the workplace, the Occupational Safety and Health Administration, which is a federal agency, is likely to step in, and the federal illegal status of the drug will trump state law.

In which case, “take out your checkbook,” he says. Wulffson says a clear policy on the employer’s stance on cannabis use — especially one that outright bans being under the influence at work, no matter the state’s laws — is the best defense from federal oversight.

Substances derived from cannabis, such as cannabidiol (known as CBD) products, that don’t contain THC, a psychoactive component of the plant, should be admissible in the workplace, Wulffson says, since they are more likely to be prescribed for a serious medical condition and don’t impair brain function.

State supreme courts have also weighed in on the issue, ultimately basing their decisions on the drug’s federal status.

In 2008, a case was brought to the California Supreme Court when Gary Ross, an employee of RagingWire Telecommunications Inc. who had a medical marijuana prescription, was fired for failing a pre-employment drug test. Ross sued the company for violation of the Fair Employment and Housing Act, which prevents employees from discrimination based on mental and physical disability. The court ruled against Ross, stating that “an employer may require pre-employment drug tests and take illegal drug use into consideration in making employment decisions.”

Though employers can treat marijuana as an illegal drug in their decisions under the ruling, employees found in violation won't face state legal charges since the California Compassionate Use Act protects medical cannabis users from criminal prosecution.

Colorado experienced a similar case in 2010, when Dish Network DISH, +0.41% employee Brandon Coats, a quadriplegic, was fired after failing a random drug test that found trace amounts of marijuana in his system. Coats reportedly was prescribed medical marijuana to help control leg spasms.

In this case, the question was whether Coats’s medical marijuana use, though legal under the state’s Medical Marijuana Amendment, was admissible under Colorado’s Lawful Off-Duty Activities Statute, which states that employees cannot be fired for legal activities outside of the workplace. Again, the court found in favor of the employer, deciding that the statute covered both state and federal laws, thus Coats’s marijuana use was illegal.

Though employers won in both cases, marijuana’s status continues to be a gray area in legal proceedings. To avoid going to court and potentially losing a hefty workplace lawsuit, business owners should construct and communicate a detailed drug policy.

An important aspect to include in a workplace marijuana policy, Wulffson says, is drug testing. In most states it is legal to drug test job applicants if they have forewarning. Random drug testing of employees, however, is illegal in many states, like California, and employers can be sued for invasion of privacy if they implement them.

In most cases, employers can drug test under reasonable suspicion of an employee under the influence, and a policy that makes that clear to employees helps avoid invasion of privacy suits.

“Employers need to understand the state that they’re in,” Wulffson says. “They need to understand corporate culture, and should have a marijuana policy while it is illegal under federal law, and it should be that you can’t be under the influence at work.”