CBD and Hemp in Food Supplements
A Compendium of EU and US Regulations for 2026 what the FDA policy shift means for your EU business

The US and EU markets regulate hemp and CBD in food supplements in fundamentally different ways, and that divergence is deepening following the FDA's announcement of its new approach. A European manufacturer who does not understand both systems simultaneously risks having a product rejected at the border, having an authorisation revoked, or — in the worst case — having the product classified as a controlled substance.

1. The FDA did not legalise CBD in supplements — it said the current law does not work

The FDA's communication of 26 January 2023 is frequently misquoted as a 'green light' for CBD in dietary supplements. In fact, the FDA stated explicitly that CBD cannot be lawfully sold as a dietary supplement under the existing Federal Food, Drug, and Cosmetic Act (FD&C Act), Section 201(ff)(3)(B), because the substance was previously approved as a drug (Epidiolex, 2018). The agency simultaneously announced that it does not intend to enforce this prohibition in the manner it had previously done, and that Congress should create a new regulatory pathway. This is a legally significant distinction: a lack of enforcement is not the same as legality.

• Current legal position: CBD as an isolate remains technically non-compliant with the definition of a dietary supplement in the US under FD&C Act, Section 201(ff)(3)(B)
• Practical consequence for an EU exporter: a certificate of compliance with EU law (e.g. a novel food authorisation) does not substitute for FDA requirements and does not protect against a shipment being detained at the US border
• Contractual risk: US distributors may include regulatory clauses in contracts that transfer liability to the manufacturer in the event of a change in enforcement policy

A manufacturer in the EU exporting CBD to the US is today operating in an administratively tolerated grey area, not within a space of legality. This distinction matters for product liability insurance and for investor due diligence.

2. Novel food in the EU and pre-market approval in the US are two different mechanisms that do not overlap

The EU novel food framework under Regulation (EU) 2015/2283 and the US pre-market approval system under the FD&C Act operate independently of one another. An authorisation granted by the European Commission under the EU novel food procedure has no legal effect in the United States, and vice versa. A manufacturer seeking to place a CBD-containing food supplement on both markets must satisfy the requirements of each jurisdiction separately and in full. There is no mutual recognition arrangement, no equivalence decision, and no administrative shortcut between the two systems. Compliance documentation prepared for the EU cannot be repurposed for US regulatory submissions without substantial adaptation to meet FDA standards.

3. THC thresholds: where EU and US law diverge most sharply

In the EU, hemp cultivars used for food production must contain no more than 0.3% THC in the flowering tops of the plant, pursuant to Regulation (EU) 2021/2115 (the CAP Strategic Plans Regulation). This threshold applies to the raw agricultural material, not to the finished product. For finished food supplements, there is no harmonised EU-wide THC limit in the final product; individual Member States apply their own thresholds, which creates significant fragmentation. Germany, for example, applies a threshold of 0.005 mg THC per portion for food supplements, while other Member States apply different standards or none at all.

In the US, the 2018 Farm Bill defined hemp as Cannabis sativa L. with a delta-9 THC concentration of no more than 0.3% on a dry weight basis. This threshold applies to the plant material. The FDA has not established a specific THC limit for finished dietary supplement products containing hemp-derived ingredients, which creates additional regulatory uncertainty for manufacturers.

• EU: THC threshold applies to the agricultural raw material (0.3% in flowering tops); finished product limits vary by Member State
• US: THC threshold applies to the plant material under the Farm Bill (0.3% dry weight); no FDA-established finished product limit
• Practical risk: a product compliant with EU agricultural rules may still exceed the THC threshold applied by a specific EU Member State to finished food supplements

4. The NDI notification procedure in the US: what EU manufacturers need to know

Under the FD&C Act, Section 413, a manufacturer or distributor who intends to market a dietary supplement in the US containing a New Dietary Ingredient (NDI) — defined as a dietary ingredient not marketed in the US before 15 October 1994 — must submit a notification to the FDA at least 75 days before the product is introduced into interstate commerce. The notification must include information demonstrating that the ingredient will reasonably be expected to be safe under the conditions of use recommended or suggested in the labelling.

CBD is considered an NDI for the purposes of this analysis, but the prior drug approval issue under Section 201(ff)(3)(B) means that an NDI notification alone would not resolve CBD's legal status as a dietary supplement ingredient in the US. The FDA has not indicated that it would accept NDI notifications for CBD under the current legal framework. This is a critical point for EU manufacturers who may assume that submitting an NDI notification is a viable route to market in the US.

5. EFSA's safety assessment of CBD: where the EU process stands

The European Food Safety Authority (EFSA) received novel food applications for CBD extracts from Cannabis sativa L. following the European Commission's classification of such extracts as novel food in 2019. As of the date of this article, EFSA has not issued a final positive opinion on any CBD novel food application. EFSA published a preliminary assessment in 2022 identifying data gaps, particularly regarding the safety of CBD at the doses typically used in food supplements, potential hepatotoxicity, and effects on the central nervous system. Applicants were required to submit additional data to address these gaps.

The practical consequence for manufacturers is that no CBD extract novel food authorisation has been granted by the European Commission to date. Products containing CBD extracts placed on the EU market without a novel food authorisation are non-compliant with Regulation (EU) 2015/2283, regardless of whether they are marketed as food supplements, foods, or beverages.

• No CBD novel food authorisation has been granted in the EU as of the date of this article
• EFSA identified data gaps in 2022; applicants submitted additional data; final opinion pending
• Placing CBD extract products on the EU market without authorisation constitutes a breach of Regulation (EU) 2015/2283
• National food inspection authorities (including the Polish Chief Sanitary Inspectorate (GIS)) are empowered to order withdrawal of non-compliant products

6. The drug/supplement boundary: reclassification risk in the EU

Directive 2001/83/EC establishes the legal framework for medicinal products in the EU. Article 2(2) of the Directive provides that where a product falls within the definition of a medicinal product and within the definition of a product covered by other EU legislation, the medicinal product rules apply. This is the so-called 'medicinal product by function' doctrine: a product that is presented as having properties for treating or preventing disease, or that can restore, correct or modify physiological functions, may be classified as a medicinal product regardless of how the manufacturer has labelled it.

For CBD products, the reclassification risk is heightened by several factors. First, CBD was approved as a medicinal product (Epidiolex) in both the US and the EU (as Epidyolex, authorised by the European Medicines Agency in 2019 for the treatment of seizures associated with Lennox-Gastaut syndrome and Dravet syndrome). Second, the pharmacological activity of CBD at higher doses is well-documented in the scientific literature. Third, marketing materials that reference therapeutic effects — even indirectly — can trigger reclassification proceedings by national competent authorities.

7. Health claims: the absolute prohibition that many manufacturers overlook

Regulation (EC) No 1924/2006 on nutrition and health claims made on foods prohibits the use of health claims that have not been authorised by the European Commission and included in the Union Register of authorised claims. As of the date of this article, no health claim relating to CBD has been authorised. This means that any statement on a label or in marketing materials that attributes a health benefit to CBD — including statements about stress, sleep, inflammation, or general wellbeing — constitutes a breach of Regulation (EC) No 1924/2006 if it implies a relationship between CBD consumption and a health benefit.

The prohibition applies to all forms of commercial communication, including websites, social media, and point-of-sale materials, not only to the physical label. The Polish Chief Sanitary Inspectorate (GIS) and the Office of Competition and Consumer Protection (UOKiK) both have enforcement competence in this area. UOKiK has issued decisions against manufacturers of food supplements for the use of misleading health-related claims, with financial penalties that can reach 10% of annual turnover.

8. Practical compliance checklist for EU manufacturers considering the US market

• Confirm that your CBD source material qualifies as hemp under the 2018 Farm Bill (delta-9 THC ≤ 0.3% dry weight)
• Obtain independent third-party laboratory testing for THC content in both the raw material and the finished product
• Do not assume that a novel food authorisation application in the EU provides any regulatory protection in the US
• Review all labelling and marketing materials for disease claims and health claims under both EU Regulation (EC) No 1924/2006 and FDA regulations (21 CFR Part 101.93)
• Include regulatory compliance representations and warranties in all distribution agreements, with clear allocation of liability for regulatory changes
• Monitor FDA guidance documents and Congressional activity on CBD legislation on a quarterly basis
• Ensure that your product liability insurance policy explicitly covers CBD-containing products and US market exposure

Summary

The regulatory landscape for CBD and hemp in food supplements remains genuinely complex on both sides of the Atlantic, and the complexity is not diminishing. In the EU, the absence of a granted novel food authorisation for CBD extracts means that the market is operating in a state of widespread non-compliance that national authorities are beginning to address more systematically. In the US, the FDA's 2023 announcement changed enforcement priorities but not the underlying law. For a European manufacturer, the key takeaway is this: regulatory tolerance is not regulatory approval, and a business strategy built on tolerance rather than compliance is inherently fragile. The cost of building genuine compliance into your product development and market entry process is a fraction of the cost of a regulatory enforcement action, a product recall, or a reclassification proceeding.

Frequently Asked Questions