CBD in EU Cosmetics vs. Novel Food: The Regulatory Line European Brands Keep Crossing

A French skincare brand launches a “CBD Recovery Serum” — CPNP notification filed, Responsible Person in place, Product Information File assembled. Six months later, a German distributor pulls it from shelves because the product description references “the body’s natural inflammatory response.” The ingredient hasn’t changed. The paperwork hasn’t changed. But the words have turned a compliant cosmetic into an unauthorised medicinal product.

This scenario plays out with uncomfortable regularity across Europe. CBD is simultaneously one of the most commercially exciting ingredients of the past decade and one of the most misunderstood from a regulatory standpoint. The confusion is understandable: the EU has not issued a single, unified ruling on hemp-derived cannabidiol. Instead, manufacturers find themselves navigating the intersection of at least three separate regulatory frameworks — and which one applies depends entirely on product format, intended use, and the claims made in marketing material.

What Regulation (EC) No 1223/2009 Actually Permits for CBD Cosmetics

Let’s be precise about what the EU Cosmetics Regulation says — and, more importantly, what it doesn’t. Cannabidiol is not listed in Annex II of Regulation (EC) No 1223/2009 as a prohibited substance. It’s absent from Annex III as well, which governs restricted substances requiring specific concentration limits or usage conditions. In the strict technical reading, CBD is a permissible cosmetic ingredient.

Hemp-derived botanicals carry distinct INCI designations depending on their origin and processing: Cannabis Sativa Seed Oil (cold-pressed hemp seed oil, which contains negligible CBD), Cannabis Sativa Leaf Extract, and Cannabidiol itself. These are not interchangeable, and formulators who conflate them on their labelling create both regulatory exposure and consumer trust problems. Hemp seed oil, notably, has a documented pre-2015 history of use in Europe and does not carry novel food status — the same cannot be said for concentrated CBD extracts.

The real constraint under 1223/2009 sits at Article 10: the requirement for a Cosmetic Product Safety Report (CPSR) signed by a qualified safety assessor. Any competent assessor will scrutinise a CBD cosmetic dossier carefully on two fronts.

First, THC contamination. EU hemp cultivation thresholds were set at 0.2% THC in plant material for decades, revised upward to 0.3% under the 2023 Common Agricultural Policy reform. But these thresholds govern cultivation, not finished products. A safety assessor cannot sign off on a CPSR if residual THC in the formulation is detectable at meaningful levels — even dermal exposure to a controlled substance creates liability that no assessor is willing to carry. Finished-product cannabinoid profiling is not optional; it’s foundational.

Second, and more commercially painful, is the claims review. Cosmetics are defined under 1223/2009 by their purpose: to clean, perfume, change appearance, protect, or maintain in good condition. Any claim that the product modifies a physiological function — reduces cellular inflammation, provides analgesic relief, treats dermatitis — crosses into medicinal product territory under Directive 2001/83/EC. This is the exact trap that catches CBD brands, because the commercial appeal of CBD rests largely on its perceived therapeutic properties. Selling those properties in copy that reaches EU consumers while trying to maintain cosmetics classification is an inherently unstable strategy.

The Novel Food Classification: What EFSA’s Assessment Changed for Supplement Brands

In 2019, the European Commission updated the EU Novel Food Catalogue to classify extracts of Cannabis sativa with above-natural CBD content as novel foods under Regulation (EU) 2015/2283. This was not a prohibition. It was a gatekeeping measure: to sell CBD-containing food supplements or functional foods in the EU market, a manufacturer must now obtain prior authorisation from the European Commission, supported by a full safety dossier evaluated by EFSA.

The practical result has been a near-complete freeze on CBD food supplements across the EU. EFSA began reviewing submitted applications and subsequently flagged significant data gaps in the available safety evidence — concerns centred on potential effects on liver enzymes, reproductive toxicity signals, and drug interaction profiles at oral doses. As of mid-2026, no CBD food supplement has received full Novel Food authorisation at the EU level. Applications are not rejected; they are pending resolution of outstanding safety data requirements that applicants have struggled to satisfy quickly.

This creates an asymmetry that genuinely confuses the market. A CBD cosmetic, properly formulated and assessed under 1223/2009, can be sold legally across the EU via CPNP notification without Commission authorisation. A CBD food supplement — regardless of purity, dosing precision, or manufacturing quality — remains in regulatory limbo pending EFSA’s conclusion.

Some member states have issued provisional national frameworks. France, working through ANSES, has been among the more pragmatic, developing national guidance that allows certain CBD products under defined conditions. But national solutions don’t travel across the single market. A product authorised under a French provisional framework does not automatically enjoy free movement to Spain or the Netherlands. This fragmentation is exactly the kind of compliance friction that catches European brands unprepared when they scale distribution.

Where the Two Regimes Collide: Dual-Use Products and the Classification Decision

The most difficult compliance cases aren’t the clear cosmetics or the clear supplements. They’re the products that straddle both frameworks — and there are more of these than most brands acknowledge.

A transdermal CBD patch designed to deliver cannabidiol systemically is not a cosmetic under 1223/2009. Patches intended for systemic effect sit closer to medical device or transdermal drug delivery territory under Directive 2001/83/EC. A sublingual CBD oil could be a food supplement, a homeopathic medicinal product, or something else depending on strength, claims, and the national authority reviewing it. An aromatherapy CBD product might not attract scrutiny — unless the brand’s website makes wellness claims that travel with the product.

The CJEU’s landmark ruling in November 2020, Case C-663/18 (Kanavape), clarified one essential point: CBD derived from the whole cannabis plant is not a narcotic under the 1961 United Nations Single Convention on Narcotic Drugs, and member states cannot prohibit its free movement solely on that basis. This ruling materially advanced CBD’s legal standing in Europe. But it was a free-movement ruling, not a product registration decision. Kanavape cleared the legal air; it didn’t write a pathway to market.

Germany’s Cannabis Act, passed in April 2024, reclassified cannabis for recreational purposes — a significant domestic policy shift. But it created fresh ambiguity about the border between CBD wellness products and the newly regulated recreational category that German customs and market surveillance authorities are still interpreting. Brands distributing into Germany in 2026 should expect scrutiny that is, if anything, more detailed than it was two years ago.

Our experience working with European cosmetics and supplement brands is that the single most consequential error is delaying the product classification decision. By the time a formulator has stabilised an emulsion with 0.5% cannabidiol, switching the claims architecture to maintain cosmetics classification is workable. By the time the marketing team has built a campaign around therapeutic efficacy, it isn’t.

What Testing a CBD Cosmetic Requires Before a Safety Assessor Will Sign Off

Assuming a product has been correctly classified as a cosmetic under 1223/2009, the analytical programme for the CPSR should address several specific requirements.

Cannabinoid profiling in the finished product. Quantification of CBD, THC, CBN, CBG, and relevant minor cannabinoids by validated HPLC or LC-MS/MS. The key word here is finished product. A supplier COA for a hemp extract reflects the raw material; it does not account for cannabinoid degradation, THC migration between batches, or manufacturing cross-contamination. Assessors who accept a raw material COA as a substitute for finished-product testing are not applying appropriate professional diligence.

Heavy metals. Hemp is a well-documented bioaccumulator of cadmium, lead, arsenic, and mercury from contaminated agricultural soils. EU maximum residue limits apply, and REACH implications for heavy metal content in cosmetic formulations add a further layer. The geographic provenance of the hemp material — country of cultivation, soil certification — should be documented in the Product Information File, alongside independent finished-product heavy metals data.

Pesticide residues. Standard for botanical ingredients, but cannabis cultivation globally has a mixed pesticide compliance history. EU organic certification of the hemp source is not a substitute for analytical confirmation; certification governs process, not finished-product chemistry.

Stability under relevant conditions. CBD is relatively stable but does degrade under UV exposure and can oxidise in water-based emulsions over time. Accelerated stability data at 40°C and 75% relative humidity over a minimum of 12 weeks is standard for a new cosmetic formulation. Real-time stability data should be added to the PIF as it accumulates.

One practical detail worth stating plainly: many European contract testing laboratories are not equipped for cannabinoid profiling in complex cosmetic matrices. The extraction and quantification methods optimised for hemp flower or seed oil do not transfer cleanly to an emulsion, cream, or gel. If you’re commissioning finished-product cannabinoid testing for the first time, require the laboratory to provide method validation documentation specific to cosmetic matrices — not just a result on a COA.

Building a Dossier That Holds Up Across the Single Market

The brands managing CBD cosmetics compliance well are not waiting for a definitive EU ruling. They’re treating the current framework as the operative one and building dossiers designed to hold up simultaneously under a German customs check, a French DGCCRF inspection, and an Italian Ministero della Salute review.

That means a CPSR signed by a qualified safety assessor with completed finished-product test data in hand, claims copy reviewed against CTPA guidelines or equivalent national guidance, a Responsible Person with real visibility across all distribution markets, and a classification decision documented in writing before the product launches. It also means distinguishing clearly between what the ingredient is scientifically capable of and what the product is permitted to claim under cosmetics law.

The commercial pressure to stretch claims is real. The regulatory consequences of stretching them too far are more expensive than the legal advice to avoid it.

---

Written by Nour Abochama, Quality & Regulatory Advisor, Care Europe | VP Operations, Qalitex. Learn more about our team

Talk to our team about EU market entry — Contact us

Related from our network

• Cannabinoid Profiling in Finished Cosmetic Products — Qalitex Laboratories provides validated CBD and THC quantification in cosmetic matrices for EU Product Information Files and CPSR dossiers.
• Hemp-Derived NHP Testing for Health Canada Compliance — Androxa supports European brands entering the Canadian natural health product market with hemp ingredient testing and regulatory documentation.