TL;DR:
- Running a CBD retail business involves complex federal, state, and FDA compliance requirements that change frequently.
- Retailers must manage product classification, THC thresholds, marketing claims, and state-specific regulations to avoid legal liabilities.
Running a CBD retail business feels straightforward until you realize how fast a “compliant” product can become a legal liability overnight. CBD compliance in the United States is not as simple as selling hemp-derived products and calling it a day. The rules span federal statutes, FDA frameworks, and a patchwork of state-level mandates that shift without warning. Retailers who assume they are protected simply because their products come from hemp are often the ones most exposed to enforcement risk, because compliance across federal and state rules governs everything from how you manufacture to how you market.
Table of Contents
- What does CBD compliance really mean?
- Federal requirements: Hemp, marijuana, and the THC threshold
- FDA rules: Product categories, claims, and what’s allowed
- State-specific rules: Labeling, documentation, and operational demands
- Common pitfalls and best practices for CBD compliance
- Our take: Why most CBD compliance advice misses the mark
- How Get Blazy supports your compliant CBD journey
- Frequently asked questions
Key Takeaways
| Point | Details |
|---|---|
| Multi-level compliance | CBD compliance requires meeting federal, FDA, and state rules for legal manufacture, sale, and marketing. |
| THC threshold is critical | Whether CBD comes from hemp or marijuana is defined by evolving THC limits, which affect legal status. |
| FDA restrictions remain | Adding CBD to foods or supplements is currently prohibited under federal law regardless of source. |
| State demands add complexity | Labeling, COA access, registration, and age rules differ across states and need constant monitoring. |
| Ongoing vigilance needed | Frequent law changes mean retailers must track updates to avoid costly compliance mistakes. |
What does CBD compliance really mean?
With misconceptions clarified, let’s define what CBD compliance really means for your business. Most people treat compliance as a single certification or a one-time test result. That framing is dangerously incomplete.
CBD compliance in the United States covers the full lifecycle of a product: how it is manufactured, what claims appear on the label, how it is sold, where it can be shipped, and how it is marketed to consumers. It is not one checklist but a web of overlapping rules shaped by federal law and individual state requirements.
“Compliance is not one checklist: the lawful status of your CBD depends on multiple ‘axes,’ including product category, marketing claims, THC and hemp status, contamination levels, and state and local rules.” Source
The key compliance dimensions every CBD retailer needs to understand include:
- Product classification: Is your product a cosmetic, a food, a dietary supplement, or something else? Each category carries distinct rules.
- THC content and hemp status: Federal law sets a ceiling on how much THC is permissible before a product crosses from hemp into marijuana territory.
- Marketing claims: Language on your website, product packaging, and social media is heavily scrutinized by regulators.
- Contamination standards: Heavy metals, pesticides, and residual solvents must meet testing thresholds to be lawful.
- State and local rules: Where you sell and ship determines an entirely separate layer of compliance obligations.
Regulatory complexity trips up well-intentioned retailers every year. A product that was perfectly compliant when launched may become non-compliant as definitions shift or new state legislation takes effect. The only way to stay protected is to build compliance into your operations as an ongoing process, not a launch-day task.
Federal requirements: Hemp, marijuana, and the THC threshold
Armed with the basics, it is vital to understand what makes a CBD product legal under federal law. The distinction between hemp and marijuana is the single most consequential line in federal cannabis regulation.
The 2018 Farm Bill drew a clear boundary: cannabis plants and their derivatives containing no more than 0.3% THC on a dry-weight basis are classified as hemp and are generally lawful under federal law. Any product exceeding that threshold is legally marijuana and subject to the Controlled Substances Act (CSA), regardless of how it is marketed or labeled.
That threshold sounds simple. It is not.
| Feature | Hemp-derived CBD | Marijuana-derived CBD |
|---|---|---|
| THC limit | 0.3% delta-9 or below | Exceeds 0.3% delta-9 |
| Federal status | Generally lawful | Federally restricted |
| Controlled Substances Act | Not covered (when compliant) | Covered under Schedule I |
| Interstate shipping | Generally permitted | Federally prohibited |
| FDA oversight | Yes, still applies | Yes, still applies |
As of late 2025 and into 2026, the landscape has grown more complicated. Federal hemp-definition changes now use a “total THC” measurement rather than just delta-9 THC when defining lawful hemp status. Total THC calculations include delta-8, delta-10, THC-O, and other cannabinoids alongside delta-9. Products that passed the old delta-9 threshold may now fail under total THC calculations, creating a new wave of compliance uncertainty for retailers.
This is not a minor technical adjustment. It is a redefinition that could render products that were selling legally for years suddenly non-compliant. Retailers must actively confirm their current product line still meets the updated federal definition, and they must demand up-to-date certificates of analysis (COAs) from their suppliers that reflect total THC testing, not just delta-9.
Pro Tip: When reviewing COAs from your supplier, look specifically for a “total THC” figure rather than just delta-9. If your COA only reports delta-9, request a corrected test from an ISO-accredited laboratory that provides the full cannabinoid profile.
FDA rules: Product categories, claims, and what’s allowed
Understanding hemp status is only part of the puzzle. FDA rules further shape what you can sell and how you market your products. The Food and Drug Administration (FDA) oversees CBD products through the Federal Food, Drug, and Cosmetic Act (FD&C Act), and the rules it applies depend heavily on what type of product you are selling.
FDA-regulated CBD products are subject to the same legal and regulatory requirements as any other FDA-regulated product in the same category. That means the same rules that apply to conventional foods, dietary supplements, drugs, and cosmetics apply equally when CBD is an ingredient.
Here is where most retailers run into trouble:
- Foods and beverages: Adding CBD to conventional foods or drinks for interstate commerce is currently unlawful under the FDA’s interpretation of the FD&C Act drug-exclusion framework. This rule catches many retailers off guard, especially those selling CBD-infused gummies, chocolates, or beverages marketed as food products.
- Dietary supplements: The same drug-exclusion logic applies. Because CBD was first studied as a drug (it is the active ingredient in FDA-approved Epidiolex), the FDA’s position is that CBD cannot be lawfully introduced into a dietary supplement intended for interstate commerce.
- Cosmetics and topicals: These occupy a different regulatory lane. Topical products like lotions and balms that are applied to the skin and do not make drug claims face fewer federal restrictions, though they must still comply with cosmetic safety and labeling requirements.
- Drug claims: Any product, regardless of category, that makes claims about treating, curing, or preventing a disease immediately becomes subject to drug approval requirements. Statements like “relieves chronic pain” or “treats anxiety disorder” will draw FDA scrutiny.
| Product type | Federal CBD status | Key risk area |
|---|---|---|
| CBD-infused food/beverage | Generally unlawful under FDA | Drug-exclusion rule |
| CBD dietary supplement | Generally unlawful under FDA | Drug-exclusion rule |
| CBD topical/cosmetic | Generally permissible | False/drug claims |
| CBD as approved drug | Lawful if FDA-approved | Full drug approval required |
High-risk edge cases almost always cluster around ingestible products and any product that makes medical or disease-treatment claims. Retailers should audit every piece of marketing copy, including email newsletters, social media posts, and product descriptions, against FDA’s claim standards before publishing.
Pro Tip: Replace disease claims with structure/function language. Instead of “cures insomnia,” write “supports restful sleep.” Instead of “treats inflammation,” write “supports post-workout recovery.” Still be cautious: even wellness language can attract FDA scrutiny if it implies a medical effect.
State-specific rules: Labeling, documentation, and operational demands
Beyond federal hurdles, state-level rules present additional layers of compliance for retailers and entrepreneurs. Each state that permits CBD sales can set its own requirements, and those requirements often exceed federal minimums.
State-level compliance obligations commonly include:
- COA disclosure: Many states require that each product carry a QR code or barcode linking to an independent laboratory certificate of analysis showing the batch number, THC content, and contaminant levels.
- Age restrictions: Sales to individuals under 21 are prohibited in many jurisdictions, similar to alcohol regulations.
- Registration and licensing: States like California, under the AB 45 framework, require specific manufacturing and distribution registration before CBD products can be legally sold.
- FDA disclaimer language: Some states mandate label language indicating that the product has not been evaluated by the FDA and is not intended to diagnose, treat, cure, or prevent any disease.
- Batch-level traceability: Regulators may require retailers to trace any product back to a specific production batch and its corresponding COA.
“Retailers should treat labeling and documentation, including COAs linked on-pack, as part of compliance, because state regulators may require batch-level traceability and THC and contaminant disclosure even where federal hemp thresholds are met.” Source
For retailers operating across multiple states or shipping nationally, compliance requirements vary by destination state and are subject to change as laws evolve. A product that ships legally to one state may be banned or require additional documentation to ship to another. Keeping a state-by-state compliance matrix updated quarterly is not optional for national operators. It is a basic operating requirement.
Pro Tip: Create a vendor requirements checklist for every supplier you work with. Include fields for total THC COA availability, batch-level documentation, ISO-accredited lab verification, and state registration status. Review it every time federal or state definitions change.
Common pitfalls and best practices for CBD compliance
To avoid legal headaches, let’s review the most common compliance mistakes and how top retailers stay ahead.
The patterns that get retailers into trouble are surprisingly consistent. Most violations come from operational gaps rather than intentional wrongdoing.
Top compliance mistakes to avoid:
- Using outdated COAs. COAs have shelf lives. A test result from six months ago does not reflect the current batch. Require suppliers to provide COAs dated within 90 days of delivery, tied to the specific batch you received.
- Relying on delta-9-only test results. As noted earlier, total THC is now the relevant measure under current federal definitions. Delta-9-only COAs leave your business exposed.
- Making unapproved claims. Disease claims, structure/function overreach, and unsubstantiated wellness statements are among the fastest ways to attract FDA warning letters.
- Ignoring destination-state rules. Shipping CBD into a state without checking its specific labeling, registration, and age-verification requirements is a compliance violation waiting to happen.
- Treating compliance as a one-time task. Federal definitions and state rules change. Batch-level traceability and documentation standards that were sufficient last year may not be sufficient today.
Best practices that keep top retailers protected:
- Maintain a running compliance log organized by product SKU, batch number, supplier, COA date, and state-specific approval status.
- Schedule a formal compliance review at least quarterly, or whenever a major federal or state rule change is announced.
- Work with legal counsel who specializes in hemp and CBD regulation when entering new states or launching new product categories.
- Train your entire team, including customer-facing staff, on what claims are permissible. A well-meaning employee making an off-script health claim to a customer can create liability.
- Subscribe to regulatory update services that monitor federal definition shifts and state legislative changes specific to hemp and CBD.
Pro Tip: Build compliance into your supplier contracts. Require suppliers to notify you within 30 days of any change to their formulation, testing protocols, or applicable state registration status. This shifts some compliance burden back to the source.
Our take: Why most CBD compliance advice misses the mark
Stepping back, most mainstream advice on CBD compliance focuses on headline rules but fails to address the underlying complexity retailers face day to day. The reality is that most “compliance guides” treat the topic like a static rulebook when it is actually a living, moving target.
Most articles tell you to “follow the Farm Bill” and “test your products.” That is the easy part. The harder part, and the part that actually determines whether your business survives regulatory scrutiny, is what happens operationally. Are your staff trained on claim restrictions? Does your marketing team know which phrases trigger FDA concern? Is your inventory tracking system granular enough to pull up a batch-specific COA within minutes if a regulator asks?
The retailers who get hurt are rarely the ones trying to break the rules. They are the ones who got compliant once, then stopped paying attention. The hemp and CBD regulatory environment has seen more definitional shifts in the past two years than in the prior decade combined. Total THC thresholds, state registration frameworks, and FDA enforcement priorities are all in motion simultaneously.
What separates businesses that thrive from those that face enforcement actions is the decision to treat compliance as a core operating cost. Legal reviews are not a luxury. They are a line item. Ongoing state monitoring is not excessive caution. It is basic due diligence.
The other failure in most compliance advice is the absence of practical detail. Knowing that “states may have labeling requirements” is useless without understanding which states, what exactly they require, and what enforcement looks like if you get it wrong. Smart retailers go deeper. They build state-by-state requirement matrices, they maintain direct relationships with compliance-focused suppliers, and they invest in legal counsel before a problem arises rather than after.
How Get Blazy supports your compliant CBD journey
Navigating CBD compliance on your own is possible, but it is also time-consuming, risky, and constantly evolving. Getting your sourcing right is one of the most effective ways to reduce compliance exposure from the start.
At Get Blazy marketplace, every product in our selection is sourced from reputable manufacturers and lab-tested for purity and compliance. We understand that for CBD retailers and entrepreneurs, documentation is not just paperwork. It is protection. Our team curates products with traceability and legal standards in mind, so you can build your business on a foundation that holds up to scrutiny. Whether you are stocking CBD tinctures, gummies, vape products, or topicals, Get Blazy gives you access to fully vetted options that align with current federal and state requirements. Stop guessing and start sourcing with confidence.
Frequently asked questions
What is the difference between hemp-derived and marijuana-derived CBD for compliance?
Hemp-derived CBD contains no more than 0.3% THC on a dry-weight basis and can be lawful under federal law, while marijuana-derived CBD exceeds that threshold and is federally restricted under the Controlled Substances Act.
Is it federally legal to add CBD to foods or supplements?
No. The FDA currently prohibits adding CBD to conventional foods or marketing it as a dietary supplement in interstate commerce due to the FD&C Act drug-exclusion framework.
What labeling elements are often required for CBD products at the state level?
States may require COA links, THC content, and contaminant disclosure along with batch numbers, age restriction notices, and FDA evaluation status disclaimers on product labels.
How often do CBD compliance rules change?
Rules can shift frequently at both federal and state levels, and keeping a change-tracking process for both federal definitions and state regulations is critical for any retailer operating across multiple markets.
Do I need a separate license to sell CBD products in each state?
Many states require specific registrations or licenses, and state-level operational requirements such as manufacturing registration and age verification mandates vary significantly by jurisdiction.