Few product categories change legal status as quickly as hemp-derived goods. A bottle of CBD oil that was routine to ship last year can sit in a gray area this year, and the rules differ from state to state and country to country. Sorting out who regulates what, and which dates matter, takes some patience.
The Federal Framework in the United States
The 2018 Farm Bill
Before 2018, every cannabis plant fell under the Controlled Substances Act. The 2018 Farm Bill carved out hemp, defined as cannabis with no more than 0.3 percent delta-9 THC by dry weight, and removed it from the federal list of controlled substances. The bill gave the U.S. Department of Agriculture (USDA) oversight of hemp cultivation and left product safety with the Food and Drug Administration (FDA).
The definition relied on one measurement: delta-9 THC, tested on the plant. It said nothing about other cannabinoids or about the finished bottle. That gap would matter later.
The FDA’s role
The FDA approved Epidiolex in June 2018, the first prescription drug made from purified CBD. Because CBD is the active ingredient in an approved drug, and had been the subject of substantial clinical investigation, the agency’s position is that it cannot be added to foods or sold as a dietary supplement under federal law. The FDA has also said that the existing pathways for foods and supplements do not fit CBD. In January 2023 it told Congress that a new regulatory approach was needed. Congress has not created one.
In practice, CBD oils are sold widely anyway. Federal enforcement has centered on warning letters to companies that claim to treat serious diseases, such as cancer or Alzheimer’s. The Federal Trade Commission also polices advertising claims, so a product that promises a cure can draw attention from two agencies at once.
The agency has listed specific safety concerns. Its consumer guidance cites the potential for liver injury, interactions with other medicines, and male reproductive toxicity seen in animal studies, along with gaps in knowledge about long-term daily use. Those gaps are the stated reason the FDA has not treated CBD as an ordinary food ingredient.
Who regulates what
| Body | What it covers |
|---|---|
| USDA | Growing and licensing of hemp crops |
| FDA | Safety and labeling of foods, supplements, cosmetics, and any drug claims |
| DEA | Marijuana and other controlled substances, including anything outside the hemp definition |
| State agencies | Licensing, age limits, testing, and where products may be sold |
Two things sit outside this whole debate. Epidiolex remains a prescription drug with its own approval, and state medical marijuana programs run under separate state laws.
The 2025 Law That Redefines Hemp
What changed
On November 12, 2025, Congress passed a funding package (Public Law 119-37) that included a provision, often called Section 781, rewriting the federal hemp definition. Three pieces matter most:
- Hemp is measured by total THC, which counts THCA and delta-8 along with delta-9, instead of delta-9 alone
- Finished hemp-derived cannabinoid products are capped at 0.4 milligrams of total THC (plus similar cannabinoids) per container
- Cannabinoids made or converted outside the plant, along with those the plant cannot produce naturally, are excluded
Industrial hemp grown for fiber and grain is protected under the new text. The provision was written mainly to close the “hemp loophole” that let intoxicating products such as delta-8 and THCA flower be sold as hemp.
Under the old test, a THCA-rich flower could pass because THCA itself is not delta-9 THC, even though heat converts it into delta-9 THC when it is smoked or cooked. Delta-8 products slipped through for a similar reason: delta-8 is a different molecule, often made by converting CBD in a lab. Measuring total THC closes both routes. Measuring per container closes a third. A gummy with a meaningful dose of THC used to pass a percentage test because the weight of the candy diluted the THC, and a limit on the whole container removes that dilution.
The dates
The law originally set an effective date of November 12, 2026. A stopgap funding bill (H.R. 6500), signed on September 2, 2026, moved most of the new restrictions to December 11, 2026. Products containing cannabinoids that the cannabis plant cannot naturally produce keep the earlier November 12 date.
Reports published through late September 2026 showed those dates still in place. Several bills that would delay, repeal, or replace the change were still sitting in committee. Anyone reading this later should confirm the current status, since the date has already moved once.
Commentary from the law firm Womble noted that the law offers no sell-through grace period for existing stock. A product that falls outside the definition on the effective date has no cushion.
What it means for CBD oil
The cap applies to the whole container, not to each serving. That detail catches many CBD products.
Consider a hypothetical 30 mL bottle of full spectrum oil that holds only 2 mg of THC in total. By most standards that is a trace, and it is five times the 0.4 mg limit. A larger bottle holds more THC overall, so the same formula in a 60 mL bottle doubles the total.
Law firm Frier Levitt reported that industry stakeholders estimate 90 percent or more of full spectrum CBD products would fall outside the amended definition. That figure is an estimate, not a measurement.
| Product type | Likely position under the 0.4 mg cap |
|---|---|
| Full spectrum oil | Often above, depending on trace THC and bottle size |
| Broad spectrum oil | Varies with residual THC |
| Isolate-based oil | More likely to fall within the limit |
| Hemp seed oil and cosmetics | Within the limit if testing confirms trace THC stays low |
Lab reports matter more than before. Total THC is usually calculated as THC plus 0.877 times THCA, and a good report shows it. A result of “non-detect” needs context too. If a lab’s limit of quantification is 0.01 percent by weight, a 30 mL bottle (roughly 28 grams of oil) could still hold nearly 3 mg of THC without triggering a detection.
Whether a given result proves compliance depends on the lab’s reporting limit and on how regulators apply the per-container test. The FDA was directed to add detail on the meaning of “container,” and that guidance had not been published in the reports reviewed here.
A short timeline
- 2018: the Farm Bill removes hemp from the Controlled Substances Act, and the FDA approves Epidiolex
- January 2023: the FDA tells Congress that a new pathway is needed for CBD
- November 12, 2025: Public Law 119-37 redefines hemp
- September 2, 2026: a stopgap funding bill delays most of the change by 30 days
- December 11, 2026: the scheduled date for the total THC standard and the per-container cap
States, Other Countries, and Practical Checks
The state patchwork
States layer their own rules on top of federal law. Some require licenses to sell hemp products, set a minimum purchase age (often 21), require third-party testing, or restrict CBD in food and drink. A few examples from 2025 and 2026:
- Ohio enacted Senate Bill 56 in December 2025, restricting intoxicating hemp products, and since March 20, 2026, hemp products above 0.4 mg per container can be sold only through licensed dispensaries
- Tennessee placed hemp-derived cannabinoid products under its alcohol commission’s licensing on July 1, 2026
- Illinois signed a Hemp Act set to take effect on November 12, 2026, bringing previously unregulated intoxicating hemp products into the state’s regulated cannabis market
A product has to satisfy the state where it is sold and the federal definition at the same time. When the two disagree, the stricter rule is the one that decides what a store can safely stock.
Rules outside the United States
Approaches vary widely. The United Kingdom’s Food Standards Agency treats CBD foods as novel foods that need authorization, and in 2023 it advised that healthy adults should not take more than 10 mg of CBD a day. Other countries classify CBD as a medicine, limit it to prescription, or ban cannabis derivatives including CBD outright.
In the European Union, CBD extracts are treated as novel foods, which means a company needs authorization before selling them as food. The European Food Safety Authority said in 2022 that data gaps prevented it from setting a safe intake level. Japan, by contrast, allows CBD products made from stalks and seeds as long as they contain no detectable THC.
Travel adds risk. A bottle that is legal at home can be seized elsewhere, and customs officers rarely stop to read a lab report. Anyone carrying CBD oil across a border should check the rules at the destination and at any connecting stops.
Practical checks before buying
- Check the date on any legal article, including this one, and compare it against current federal and state sources
- Confirm the seller’s state rules on age limits and licensing
- Read the lab report for total THC in milligrams, then multiply by the size of the container
- Prefer isolate or broad spectrum when staying under a strict THC limit matters
- Keep receipts and lab reports for products used under workplace testing or carried across borders
Most reputable sellers link the lab report through a QR code or a batch lookup on the product page. A seller that cannot produce a report for the batch in hand has given the buyer useful information. The report should come from a third-party lab, show the date of testing, and match the batch number printed on the container. Legal compliance on paper means little without that paper trail.
Final Thoughts
CBD oil sits under a patchwork of federal, state, and international rules, and the federal definition of hemp is in the middle of a change. The 0.4 mg per-container cap, scheduled for December 11, 2026 for most products, could reach many full spectrum oils. Dates have already shifted once, and Congress has several competing bills pending. Reading a current lab report and checking local rules before buying is the most reliable habit.