In the space of four days in September 2026, the European Food Safety Authority did something it had not managed in six years of looking at cannabidiol: it said yes to one CBD product and no to two others, and in doing so drew the clearest map yet of what a legal CBD food will look like in the European Union. The yes came with a dose so small that industry consultants immediately questioned whether anyone would bother selling it. The noes came not because the products were found dangerous, but because the companies behind them stopped answering the regulator’s questions.
The starting point for this article is the opinion of EFSA’s Panel on Nutrition, Novel Foods and Food Allergens on a CBD isolate from Cannabis sativa L., published in the EFSA Journal on 21 September 2026. It is a short document with a blunt conclusion: the safety of the novel food cannot be established. To understand why, and what it means for the CBD oils, capsules and gummies sold across Europe, it has to be read alongside the first positive opinion that appeared three days earlier and the provisional safe intake level EFSA set in February. Taken together, they explain where the legal line now sits, and how far most of the market is from it.
Key Takeaways
EFSA could not establish the safety of a hemp-derived CBD isolate of at least 98 percent purity, proposed for food supplements at up to 60 milligrams a day, because the applicant did not reply to requests for data on identity, manufacturing, composition, genotoxicity, reproductive toxicity and human studies. A companion opinion on a broader hemp extract reached the same result for the same reason. Three days earlier, EFSA had issued its first ever positive opinion on CBD in food: a synthetic isolate from Chanelle McCoy, judged safe at up to 2 milligrams a day for adults aged 25 and over, excluding pregnant and breastfeeding women and anyone taking medication. That figure traces back to a provisional safe intake of 0.0275 milligrams per kilogram of body weight per day, derived in February 2026 from rat studies with an uncertainty factor of 400. A positive opinion is not an authorisation; the European Commission and member states still have to decide. In the United Kingdom the same synthetic CBD has been recommended for authorisation at 10 milligrams a day, five times the EFSA figure, though a pending UK-EU food safety agreement may eventually override British decisions with Brussels’. Nothing in these opinions establishes that CBD works at 2 milligrams, and nothing in the negative opinions establishes that hemp CBD is unsafe.
What EFSA Was Asked to Assess
Opinion 10318 concerns a CBD isolate, meaning cannabidiol purified to at least 98 percent by weight. The manufacturer extracts it from hemp with ethanol, then winterises the extract (chilling it so waxes and fats separate out), filters it, decarboxylates it (heating to convert the acid form CBDA into CBD) and crystallises the result. The intended use was as an ingredient in food supplements at a maximum of 60 milligrams a day, for adults other than pregnant and breastfeeding women.
Sixty milligrams is a typical figure for a serving of retail CBD oil. It is also thirty times what EFSA now considers provisionally safe.
During the assessment the panel identified gaps it needed the applicant to fill. EFSA asked for additional information on the identity of the substance, the production process, compositional data, specifications, genotoxicity (whether the substance can damage DNA), reproductive and developmental toxicity, and human data. The applicant did not reply. On the data available, the panel concluded that the safety of the novel food could not be established.
That phrase deserves careful reading. EFSA has not said the product is harmful. It has said it cannot judge, because the evidence was never supplied. Under Regulation (EU) 2015/2283, the novel food regulation, the burden of proof sits entirely with the applicant. Silence is not neutral; it is fatal to the application.
On the same day EFSA published a sister opinion on a hemp extract containing 57 to 65 percent CBD and 9 to 17 percent other cannabinoids. Same requests, same silence, same conclusion. In May 2026 the panel had already declined another hemp-derived isolate, in that case partly over unresolved questions about whether the intended formulations might contain nanoparticles.
The First Yes: Two Milligrams, Adults Over 25
The counterpoint is the opinion EFSA released on 18 September 2026 on synthetic CBD from Chanelle McCoy, an Irish and UK-based supplements company. Synthetic here means chemically manufactured cannabidiol with no plant extract involved. The panel found the product safe under the proposed conditions of use: up to 2 milligrams of CBD a day, for adults aged 25 and over, not for pregnant or breastfeeding women, and with an explicit carve-out for people taking medication.
How it got there matters as much as the result. The company originally applied for 25 milligrams a day and later cut the figure to 2 milligrams to match EFSA’s provisional level. It submitted a 90-day oral toxicity study in rats. According to reporting by NutraIngredients, the dossier did not include the reproductive toxicity studies or human clinical trial that EFSA had asked of other applicants; the panel compensated with the large uncertainty factor and the narrow target population.
Regulatory consultants reacted quickly. Jerome Le Bloch of FoodChain ID called it an important turning point after years of data gaps and negative opinions, while noting that the dose remains very low compared with products historically sold in Europe. Mark Tallon of Legal Products Group was blunter, describing a choice between accepting a dose that delivers no physiological benefit on current evidence, or being rejected.
One further point is easy to miss. A positive EFSA opinion is a scientific assessment, not a market authorisation. The file now goes to the European Commission, which decides with member states whether to add the product, with its conditions of use, to the Union list of authorised novel foods. Until that happens, no CBD food is authorised anywhere in the EU.
Where the Two Milligrams Come From
The figure the whole sector is now measured against comes from EFSA’s updated statement on the safety of CBD as a novel food, published in February 2026. It revises a 2022 statement in which the panel paused all 19 CBD applications then under assessment because the data gaps were too large to reach any conclusion.
For the update, the panel reviewed the scientific literature up to June 2024 and found the gaps persisted. Many newer studies were short, used non-standardised protocols or tested CBD alongside medicines. Across animal studies the liver emerged as the most sensitive and consistently affected organ, with changes in liver weight and tissue appearing early. Human trials also pointed to hepatotoxic potential, particularly when CBD was combined with other drugs. There were signals on reproduction, on neurodevelopment after prenatal exposure, on thyroid hormones and adrenal tissue, and no studies at all on immunotoxicity.
From the GLP-compliant sub-chronic rat studies the panel derived a toxicological reference point using benchmark dose modelling, then applied an uncertainty factor of 400. For scale, the default factor for extrapolating from animals to humans and allowing for variation between people is 100; the extra multiples reflect the missing data. The result was a provisional safe dose of 0.0275 milligrams per kilogram of body weight per day, roughly 2 milligrams for a 70-kilogram adult.
The number applies only to food supplement formulations with CBD purity of at least 98 percent, without nanoparticles, where the production process is considered safe and genotoxicity has been ruled out. For people under 25, whose brains are still developing, for pregnant and breastfeeding women, and for anyone on medication, the panel concluded that safety cannot be established at any dose.
That EFSA named a number at all is the real change since 2022. Before, there was only the statement that safety could not be established. Now there is a door, even if it is barely ajar.
Synthetic Versus Hemp: Is There a Pattern?
It is tempting to read the September opinions as a verdict in favour of synthetic CBD and against the plant. The opinions do not support that. The difference lies in the dossiers, not in where the molecule came from. The successful applicant supplied more data, slashed its dose and narrowed its audience. The two rejected applicants did not answer the regulator at all.
That said, origin has practical consequences. A synthetic isolate is simpler to characterise: no residual cannabinoids, no terpenes, no batch-to-batch variation between harvests. The rejected hemp extract contained 9 to 17 percent other cannabinoids, each of which would need its own safety case. And the retail reality of hemp-derived products is not reassuring. A Czech analysis of 186 CBD oils sold in Europe found roughly half did not contain the labelled amount of CBD, and 39 percent would have pushed a consumer over EFSA’s acute reference dose for THC at the manufacturer’s own recommended serving.
The scale of the queue also matters. As of February 2026, EFSA reported four dossiers on synthetic CBD and 16 on hemp-derived CBD under risk assessment, with a further 24 applications awaiting validity checks. The Commission had received more than 150 CBD applications by March 2022. One positive opinion at 2 milligrams now sets the benchmark for every one of them.
The UK Comparison: Same Molecule, Five Times the Dose
The most striking contrast comes from across the Channel. The same synthetic CBD from Chanelle McCoy has already passed the UK’s separate novel food process, at a dose five times higher. The Food Standards Agency and Food Standards Scotland adopted a provisional acceptable daily intake of 10 milligrams in 2023, and in September 2026 the FSA board agreed to recommend three CBD applications to ministers for authorisation: the Chanelle McCoy synthetic, a hemp isolate from Cannaray and a hemp isolate from the European Industrial Hemp Association’s applicant consortium, together linked to roughly 3,000 products on the FSA’s public list. EFSA’s own opinion records that the British regulators had positively concluded on the product at 10 milligrams.
Two regulators, one molecule, two numbers. Both are provisional, both rest on the same patchy evidence base, and the gap between them shows how much the outcome depends on the choice of uncertainty factors rather than on any new toxicology. What makes the British position precarious is politics rather than science. The UK and EU are negotiating a sanitary and phytosanitary agreement under which Great Britain would dynamically align with EU rules, including market authorisations. The FSA’s own board papers state that once such an agreement enters force, existing GB authorisations would cease to apply and businesses would need EU authorisation to sell regulated products in Great Britain. The FSA chair, Professor Susan Jebb, told the board in September that the long-term future of the sector would lie with EU authorisations. The British CBD market, which has already lived through one forced cut to 10 milligrams, may face a second, far steeper one to 2. Readers interested in how large that market has become can compare it with the rapid growth of private medical cannabis prescriptions in the UK, which sits in a separate regulatory lane entirely.
What This Means Across the EU
Because EFSA’s opinions feed a single authorisation process, their effect is felt in every member state, but not evenly. Germany’s federal food safety office has stated for years that it knows of no case in which CBD in food or supplements would be marketable, and enforcement is left to the states. France banned CBD edibles in 2026 while leaving smokable flower on sale, as we reported in our analysis of the French CBD edibles ban. Italy pulled hemp flower under narcotics law in 2025. The Netherlands tolerates consumer CBD only up to 0.05 percent THC. A country-by-country picture of this patchwork is in our comparison of CBD regulation across nine European countries.
An eventual Commission authorisation of the Chanelle McCoy product would not tidy any of this up. It would authorise one synthetic isolate, at 2 milligrams a day, for adults over 25, and nothing else. A hemp oil delivering 20 milligrams per dropper would remain an unauthorised novel food in every member state. Cosmetics containing CBD are governed by separate rules and are untouched by these opinions.
There is one more cloud on the horizon. In February 2025 the French agency ANSES proposed classifying CBD as a presumed human reproductive toxicant under the EU’s chemicals classification regulation, a proposal EFSA itself notes in its February update. If that classification is adopted, its consequences would extend well beyond food law into labelling, cosmetics and workplace rules.
The American Contrast
For readers in the United States the European process can look baffling, and the comparison is instructive. Since the 2018 Farm Bill removed hemp-derived CBD with less than 0.3 percent THC from the federal definition of marijuana, CBD has been sold in American grocery stores and gas stations with no pre-market safety review at all. The Food and Drug Administration has approved exactly one CBD product as a medicine, Epidiolex, and has never authorised CBD as a food additive or dietary supplement, but it has largely not enforced that position against the retail market. The result is the mirror image of Europe: wide availability with no assessed safe dose, versus an assessed safe dose with almost no availability. Neither system has produced the thing consumers actually want, which is a product that is both easy to buy and known to be safe at the amount on the label.
What the Opinions Do Not Tell You
A novel food opinion is not an efficacy review. EFSA answers only whether a substance at a given amount is acceptable as food for a given group. Whether 2 milligrams of CBD does anything in the body is a question it did not ask, and the existing evidence suggests not: clinical trials that found effects used 300 to 1,500 milligrams a day. The gap between what people take CBD for and what the trials support is documented in a six-country survey of 79,644 people, in which anxiety, pain and depression topped the list of reasons in every country.
The provisional intake level is exactly that, provisional. It rests on rat studies rather than long-term human data, and the factor of 400 is an expression of ignorance, not of demonstrated harm. New evidence on reproduction and the liver could move it in either direction.
And the negative opinions rest on missing answers, not adverse findings. They say less about the safety of hemp CBD than the headlines suggest. What they do say is that the route to authorisation is expensive, slow and ends at a dose few businesses consider viable. Whether the industry walks it will be decided in company budgets, not in Parma.
FAQ
No. In September 2026 EFSA issued its first positive safety opinion on a single synthetic CBD product, limited to 2 milligrams a day for adults aged 25 and over who are not pregnant, breastfeeding or taking medication. Authorisation is a separate decision by the European Commission and member states and has not yet been taken. In the same week EFSA could not establish the safety of two hemp-derived CBD products.
EFSA derived a reference point from rat studies and applied an uncertainty factor of 400 to cover missing data on liver effects, reproduction and long-term human exposure. The result is 0.0275 milligrams per kilogram of body weight, about 2 milligrams for a 70-kilogram adult. Many retail products suggest ten to fifty times that amount.
In the EU, CBD extracts and isolates are unauthorised novel foods, so placing them on the market as food or supplements is not permitted, though enforcement varies widely between member states. In Great Britain, products linked to validated applications have been allowed to remain on sale pending decisions, and three applications were recommended to ministers for authorisation in September 2026 at 10 milligrams a day. A pending UK-EU agreement could later replace British authorisations with EU ones. In the United States, hemp-derived CBD is widely sold at retail but has never been authorised by the FDA as a food ingredient or supplement.
The opinions do not support that conclusion. The two hemp products were rejected because their applicants did not supply requested data, not because of adverse findings. A synthetic isolate is easier to characterise because it contains no accompanying cannabinoids and does not vary between harvests, which simplifies the assessment.
Legal Disclaimer
This article summarises published regulatory opinions and reporting for general information only. It is not medical, legal, nutritional or regulatory advice and does not recommend the purchase, use or sale of any CBD product. EFSA’s provisional safe intake level is a scientific estimate carrying substantial uncertainty and is not a dosing recommendation. CBD can interact with prescription medicines; EFSA expressly did not assess people taking medication, pregnant or breastfeeding women, or anyone under 25. Laws governing CBD differ substantially between the European Union, its member states, the United Kingdom and the United States, and they are subject to change. Consult a qualified healthcare professional about your own health and the relevant regulator or a legal professional about the status of any product where you live.
