CBD & Hemp Supplements: Federal Farm Bill, FDA Position, State Patchwork and Lifecycle Controls

The Agricultural Improvement Act of 2018 (2018 Farm Bill) amended the Controlled Substances Act to remove hemp from Schedule I, defining hemp as Cannabis sativa L. and any part of that plant with a delta-9 tetrahydrocannabinol concentration of not more than 0.3 percent on a dry weight basis. The threshold is delta-9 THC specifically — not total THC including delta-9, delta-8, delta-10 and acid forms — though USDA hemp production rules require total THC (delta-9 plus THCA converted) at testing of growing crops, creating divergence between production and finished-product testing logic. The bill transferred hemp regulation from DEA to USDA with state plans for production licensing. Hemp-derived CBD is therefore not a controlled substance at federal level provided the source plant meets the 0.3% threshold and is produced under a compliant state plan. Above 0.3% delta-9 THC the material reverts to marijuana classification under the CSA. The Farm Bill explicitly preserved FDA authority to regulate hemp and hemp-derived products under FFDCA — and the FDA has used that authority to maintain the exclusionary clause position on CBD in supplements.

The FDA position on CBD in dietary supplements rests on FFDCA section 201(ff)(3)(B), which excludes from the dietary supplement definition any article authorised for investigation as a new drug for which substantial clinical investigations have been instituted and made public, unless the article was marketed as a dietary supplement or food before such authorisation. CBD was investigated as a new drug leading to FDA approval of Epidiolex (cannabidiol oral solution, GW Pharmaceuticals, approved June 2018 for specific pediatric epilepsy indications). The FDA holds that CBD was not marketed as a supplement before the drug investigation, and therefore CBD is excluded from the supplement definition by operation of law. The FDA has issued warning letters to CBD supplement marketers — primarily targeting disease claims, drug claims, products marketed for infants and children, food and beverage incorporation, and untested high-dose products — but has not pursued systematic enforcement against the broader CBD supplement market. The agency has issued multiple statements requesting Congressional action to create a new regulatory pathway for CBD; legislative proposals have not yet been enacted. The de facto situation is a large, semi-tolerated CBD supplement market operating under FDA enforcement-discretion conditions that may shift with administration priorities, headline adverse events, or new clinical findings.

State-level CBD and hemp regulation diverges sharply. Outright bans or near-bans (Idaho — historically zero THC tolerance, Iowa, South Dakota, several restrictions in Kansas and Nebraska). Comprehensive registration and labelling regimes (California — Department of Public Health hemp product registration, AB 45 framework, prohibition of inhalable hemp products; Florida — Department of Agriculture hemp programme with specific labelling and testing requirements; Texas — Department of State Health Services registration with testing requirements). Delta-8 THC and synthetic cannabinoid derivative bans (delta-8 THC produced by isomerisation from CBD is treated as an unlawful synthetic in over twenty states even though delta-8 from hemp is arguably federally legal under the Farm Bill; the DEA position on synthetically-derived cannabinoids creates additional federal-state ambiguity). Pet CBD product divergence (some states permit hemp-derived CBD in pet products, others restrict). The discipline requires a per-state regulatory register with current registration status, ingredient-form acceptability (full-spectrum, broad-spectrum, isolate), permitted dosage forms (tinctures, capsules, gummies, topicals, no inhalables in many states), maximum THC content, label warnings, and a per-SKU per-state release decision integrated with the e-commerce and retail distribution system.

CBD and hemp businesses operate under elevated banking, payment processing and platform constraints. Many national banks decline CBD merchant accounts due to internal risk policies even where federal law permits the business. Major payment processors (Stripe historically restricted, Square offers limited CBD processing under a specific programme, PayPal restricts most CBD transactions) impose category-specific underwriting, higher chargeback ratios, mandatory disclosure, and reserve requirements. Amazon prohibits CBD supplement sales in its US dietary supplement category. Meta and Google ad platforms restrict CBD advertising with category-specific carve-outs and approval processes. Shopify permits CBD with payment-processor restrictions. The result is structural cost overlay (higher payment processing rates, limited advertising channel access, mandatory CBD-specialist payment processors) and structural growth ceiling (no Amazon listing, restricted ad reach). The discipline includes building CBD-compliant payment processor relationships, CBD-specialist banking, alternative customer-acquisition channel mix, and continuous monitoring of platform policy shifts that can disrupt commerce overnight.

CBD and hemp product testing carries elevated technical and regulatory demand. Cannabinoid potency by HPLC-DAD or HPLC-MS — quantifying CBD, CBG, CBN, CBC, delta-9 THC, delta-8 THC, THCA, CBDA against label claim and the regulatory THC ceiling. Heavy metals by ICP-MS — hemp is a bioaccumulator of soil heavy metals, so per-lot ICP-MS is essential, not periodic. Pesticide residues — Cannabis is uniquely susceptible to pesticide residue accumulation, and lab capability varies; California, Colorado and Oregon cannabis testing rules (which apply to recreational/medical cannabis but inform hemp testing practice) define multi-residue pesticide panels by LC-MS/MS and GC-MS/MS. Microbiological including yeast and mould (Aspergillus species are a specific concern in cannabis testing). Mycotoxins (aflatoxin B1/B2/G1/G2, ochratoxin A). Residual solvents (where ethanol, supercritical CO2 or hydrocarbon extraction is used). Adulterant screen for synthetic cannabinoids in products marketed as natural full-spectrum. Defensible programmes use ISO/IEC 17025 accredited labs with documented cannabinoid and pesticide method validation, per-lot testing of every released batch, supplier qualification with COA verification at receipt, and adulterant screening. Pharmacovigilance: the CBD adverse event profile (drug-drug interactions via CYP3A4 and CYP2C19 inhibition, hepatotoxicity at high dose) drives specific intake and signal detection requirements, with elevated medical-channel and pediatric exposure attention.