CBD in EU Cosmetics: What Regulation (EC) No 1223/2009 Actually Says — And What Most Brands Get Wrong

Walk through the skincare aisle of any major French pharmacie right now and you’ll encounter at least a dozen products making some claim about hemp, CBD, or cannabidiol. The market has moved fast. Regulatory clarity, considerably less so.

European brands formulating with cannabidiol are navigating a genuinely complex landscape — one where the absence of an explicit prohibition in the regulation gets misread as a green light, where “hemp seed oil” and “CBD extract” get conflated in technical files, and where national enforcement authorities don’t always interpret the rules the way brands hope. The result is a category full of products currently on-shelf that carry real, underestimated compliance risk.

Here’s what Regulation (EC) No 1223/2009 actually says — and what it doesn’t.

Hemp Seed Oil vs. CBD Extract: The Ingredient Source Matters More Than You Think

This confusion runs through roughly 40% of the product files we review for EU cosmetics compliance. Brands list “Cannabis sativa seed oil” and “cannabidiol” as if they’re interchangeable. They are not, and treating them as such creates documentation errors that a qualified Cosmetic Product Safety Assessor (CPSA) — or a national market surveillance inspector — will flag immediately.

Cannabis sativa seed oil (hemp seed oil) is cold-pressed from the seeds of the hemp plant. Seeds contain vanishingly small amounts of cannabinoids — typically below 0.001% CBD and essentially zero THC. From a regulatory standpoint, hemp seed oil has a well-established safety profile, a recognised INCI name, and no meaningful issue under Regulation (EC) No 1223/2009 or its Annexes. It’s a fatty acid-rich emollient. It’s been used in EU cosmetics without controversy for years.

CBD extract — cannabidiol — is derived from the flowers, leaves, and stalks of the cannabis plant through extraction, typically supercritical CO₂ or solvent-based methods. It can be processed to varying degrees of purity: full-spectrum extracts (containing a wide range of cannabinoids including THC), broad-spectrum extracts (THC nominally removed), or high-purity isolates (typically 95–99%+ cannabidiol). Each form carries a different risk profile, because each carries a different likelihood of THC co-extraction.

And THC is where the regulation draws a hard, unambiguous line.

Where Regulation (EC) No 1223/2009 Stands on Cannabinoids

Let’s be precise about the text, because loose interpretations in both directions create problems.

Cannabidiol (CBD) itself does not appear in Annex II of Regulation (EC) No 1223/2009, which lists substances prohibited in cosmetic products. It is also absent from Annex III (restricted substances requiring specific conditions of use) and all other Annexes. On the face of the regulation, CBD sits in the grey zone that Article 3’s general safety obligation was designed to handle: cosmetic products placed on the EU market “shall be safe for human health when used under normal or reasonably foreseeable conditions of use.” That obligation belongs entirely to the Responsible Person (RP), and demonstrating it requires a complete Cosmetic Product Safety Report (CPSR).

Delta-9-tetrahydrocannabinol (THC), by contrast, IS listed in Annex II as a prohibited substance. This is the critical point for any brand working with CBD extracts: if your raw material contains detectable THC, your product is non-compliant regardless of the amount. Annex II listings are absolute. There are no de minimis thresholds beneath which a prohibited substance becomes tolerable in a finished cosmetic product.

The Scientific Committee on Consumer Safety (SCCS) has been formally asked to evaluate cannabidiol’s safety for use in cosmetics — itself an indication that the European Commission recognises both the growing market and the genuine knowledge gap around this ingredient at topical exposure levels. The SCCS process for CBD has required multiple data submission rounds, which signals how much the industry underestimated the evidentiary bar when it started launching products. An SCCS opinion, once finalised, will not eliminate the need for product-specific safety assessment; it will simply give CPSAs a reference point to work from.

The THC Problem: Why ‘CBD Isolate’ Isn’t Automatically Safe

Brands frequently tell us they’re using “99%+ CBD isolate” and therefore consider THC a non-issue. This reasoning has two specific weaknesses worth understanding.

First, analytical declarations of purity are only as reliable as the testing behind them. A Certificate of Analysis (COA) from a supplier showing “THC: not detected” is meaningful only if the method’s limit of detection (LOD) is explicitly stated and the issuing laboratory is accredited to ISO 17025. We routinely see COAs from overseas contract manufacturers with THC detection limits of 0.05% or higher — meaning the method literally cannot detect residual amounts that would still constitute an Annex II violation. An undetected substance is not the same as an absent substance.

Second, even high-purity CBD isolates can carry trace THC depending on source material composition, extraction conditions, and quality controls at the raw material supplier. EU industrial hemp varieties (Cannabis sativa cultivars with THC below 0.3% in the dried plant) are the standard source, but “low-THC starting material” combined with “high-purity extraction” does not automatically equal “zero THC in finished extract.” The conversion math requires independent analytical verification at each step.

For any finished cosmetic product containing CBD, the minimum defensible testing approach is LC-MS/MS (liquid chromatography-tandem mass spectrometry) for both CBD and THC in the final formulation, with a detection limit of 0.0001% (1 ppm) or lower. GC-MS methods appear commonly on supplier COAs but are generally less sensitive and less specific for cannabinoid profiling. The method choice isn’t a technical footnote — it determines whether you can actually demonstrate Annex II compliance to an inspector.

What Your CPSR Must Address for CBD-Containing Formulations

The Cosmetic Product Safety Report comprises two parts: the Cosmetic Product Safety Information (Part A) and the Cosmetic Product Safety Assessment (Part B). For products containing cannabidiol, both parts need explicit, ingredient-specific content that generic hemp extract templates simply do not provide.

Part A must include:

• The specific form of CBD used (isolate, broad-spectrum, or full-spectrum) and its precise concentration in the finished formulation
• The correct INCI name — “Cannabidiol” for an isolated compound, not the softer-sounding “Cannabis sativa flower extract” — with consistency between the technical file and the product label
• A raw material specification for the CBD ingredient, including a declared maximum THC limit and batch-specific COAs from an ISO 17025-accredited laboratory
• Method of sourcing, extraction process description, and supplier qualification documentation

Part B, the safety assessment conducted by a qualified CPSA, must address:

• Available dermal absorption data for cannabidiol at the concentration used, or a scientifically justified surrogate where such data are limited
• A toxicological profile for cannabidiol specifically — not Cannabis sativa generically — referencing relevant published literature and any applicable SCCS opinions
• An explicit evaluation of THC residual risk in the raw material and finished product
• Systemic exposure estimation for the relevant product type (leave-on vs. rinse-off) and consumer use pattern

In our experience reviewing product files from brands across France, Germany, and the Netherlands, CBD-containing CPSRs are the most consistently deficient category we encounter. Safety assessors frequently adapt boilerplate hemp extract assessments without addressing cannabidiol’s specific toxicological data requirements. Given that national competent authorities are actively pulling CBD cosmetics from the market for documentation review, this is a risk that comfortable assumptions cannot protect you from.

National Enforcement: France, Germany, and the Member State Reality

EU harmonisation under Regulation (EC) No 1223/2009 does not produce uniform enforcement. Member states retain their own market surveillance authorities, and their interpretation and enforcement posture on CBD cosmetics diverge meaningfully in practice.

In France, ANSM (Agence nationale de sécurité du médicament et des produits de santé) has taken an active role in CBD product surveillance across food, supplement, and cosmetics categories. French administrative practice has been notably attentive to the cosmetic-drug boundary: any product communicating a benefit around inflammation, chronic pain, stress, or sleep — even when phrased cosmetically — risks reclassification as a medicinal product under Article L.5111-1 of the French Public Health Code. Once classified as a drug, the product cannot be sold as a cosmetic without full marketing authorisation. A brand whose UK-facing website refers to CBD’s anti-inflammatory “effect” and whose French-facing website calls it a “soothing” cosmetic ingredient may find those two claims viewed inconsistently by French regulators.

Germany’s Bundesinstitut für Risikobewertung (BfR) has published risk assessments addressing CBD’s safety profile for various exposure routes and population groups. German market surveillance authorities have taken enforcement action against CBD cosmetics with unverifiable concentration claims, inadequate THC documentation, and supply chains lacking auditable traceability — particularly for products sold through e-commerce channels where origin documentation is weakest.

The Netherlands and Belgium have also seen market withdrawals of CBD cosmetic products where Responsible Persons could not produce compliant CPSRs on request.

The practical implication: even if your formulation is THC-free and your CPSR is technically complete, the way you communicate about CBD — on the label, on your website, in retailer presentations, and on social media — can create regulatory exposure under the drug-cosmetic boundary in ways that vary by market. Your Responsible Person needs to be prepared to defend not just the technical file but the totality of product communication for each member state where you’re active.

The Compliance Checklist Before You Launch a CBD Cosmetic in the EU

Getting this right before launch is substantially less expensive than managing a market withdrawal after one. For any EU cosmetic brand working with cannabidiol, the minimum viable compliance posture involves these five steps:

1. Raw material specification with THC limit: Establish a written specification for your CBD supplier declaring a maximum THC limit of 0.001% (10 ppm) or lower, supported by batch-specific COAs from an ISO 17025-accredited laboratory using LC-MS/MS methodology.
2. Independent finished product testing: Commission third-party THC and CBD quantification on the finished formulation before launch — not only at raw material intake. Product matrix effects can affect cannabinoid recovery, and release testing on the final product is the standard you’ll need to defend.
3. CBD-specific CPSR: Ensure Part B addresses cannabidiol by its correct INCI name with a toxicological profile specific to this compound. The safety assessor must explicitly evaluate THC residual risk at the finished product level.
4. INCI labeling accuracy and technical file consistency: The INCI name on your ingredient list must match the substance assessed in your CPSR. Inconsistencies between label, technical file, and CPNP notification are among the first things competent authorities check.
5. Claims review for each target market: Before each national launch, have your Responsible Person review all product communications — label, website, point-of-sale — against the cosmetic-drug boundary as interpreted in that member state. France, Germany, and the Benelux countries each have nuances worth addressing explicitly.

CBD in EU cosmetics isn’t prohibited. But the compliance burden on brands using it is meaningfully higher than for most cosmetic ingredients, the market surveillance environment is intensifying, and the documentation standards expected by competent authorities have become clearer as enforcement activity has grown. The grey zone is narrowing.

---

Written by Nour Abochama, Quality & Regulatory Advisor, Care Europe | VP Operations, Qalitex. Learn more about our team

Talk to our team about EU market entry. Contact us

Related from our network

• ISO 17025 accredited LC-MS/MS cannabinoid testing for cosmetic raw materials and finished products — Qalitex Laboratories provides validated cannabinoid profiling with THC quantification to 1 ppm for EU cosmetics Annex II compliance documentation
• Botanical identity testing and supplier qualification for hemp-derived NHP ingredients — Androxa supports Health Canada NHP applications with cannabinoid testing and traceability documentation for Canadian market entry