CBD Safety in Edibles: What Regulators are Thinking

Despite the popularity of cannabidiol (CBD) infused edibles among consumers there are storm clouds on the horizon for this market. The potential threat stems from continuing uncertainty about the regulatory status of CBD in the United States (US) and the European Union (EU). Recent statements by government agencies in both areas are reminders that regulators could make decisions or take actions that would suddenly end the viability of this market. Any company that sells, or is planning to sell, CBD infused edibles such as bakery items, candy and beverages needs to understand what the regulators are thinking now and what might happen in the future.

in the US, the 2018 Farm Bill created a category of products called hemp that are derived from the Cannabis sativaplant and contain less than 0.3% tetrahydrocannabinol (THC). This law also explicitly confirmed the authority of the US Food and Drug Administration (FDA) to regulate the safety of hemp-derived infused edibles. This means CBD needs to navigate the New Dietary Ingredient pathway for dietary supplements, and either the food additive petition process or the Generally Recognized as Safe (GRAS) pathway for foods before it can be used as an ingredient in a food. All three of these processes require that someone (an individual, a company or a group) acting as a petitioner or notifier must submit safety data to the agency or arrange for a safety evaluation by independent experts.

In the EU, CBD is regulated as a Novel Food in a process that is triggered by a submission to the European Commission. The submission must include safety data that is evaluated by the European Food Safety Authority (EFSA). In England and Scotland, CBD products are also novel foods and are evaluated using a process like that in the EU. As in the US, it is the responsibility of an applicant to provide the safety data.

The standard used by the FDA to judge the safety of new food substances in all three pathways is that there should be a “reasonable certainty in the minds of competent scientists that the substance is not harmful under the conditions of its intended use.” The standard used by EFSA for novel foods is, “the food does not, on the basis of the scientific evidence available, pose a safety risk to human health.”

It is important to realize that both in the US and the EU the safety standard for evaluating new food substances only considers the safety of that substance. The laws or regulations that define agency authority do not allow for consideration of any potential benefits. Approval (or rejection) must be based solely on the safety of the substance. Further, safety is evaluated in the context of the intended use of the substance, the planned level of use and the resulting consumer exposure to that substance.

What do we know about FDA’s and EFSA’s current thinking about CBD safety? 

Unfortunately, both the FDA and EFSA have made it abundantly clear that they believe the available scientific data does not meet the required safety standards. FDA has issued multiple warning letters to companies that sell CBD products and has rejected two NDI notifications for CBD. Although these actions were primarily based on non-safety issues (illegal health claims and the drug exclusion provision in the FD&C Act, respectively), in each case the FDA also raised safety concerns. This was done by saying that the agency is not aware of any data that would support a GRAS determination or that the products raise “concerns about the adequacy of the safety evidence.” This doubt echoes statements from the agency in public meetings and advisories. These doubts were expressed as recently as June 2022 during a meeting of the FDA Science Advisory Board.

Similarly, EFSA has stated that they feel that there are critical gaps in the existing CBD safety data. In April 2022, they published a statement with a detailed analysis of the relevant scientific literature and explicitly identified critical data gaps. EFSA said that these data gaps prevented them from evaluating CBD as a novel food.

What do the regulators see as data gaps?

Although the details of each of the data gaps are technically complex, for both the FDA and EFSA they fall into few broad categories.

The first is that the agencies feel that they need better information on how CBD behaves in the human body. This is described as understanding the absorption, distribution, metabolism and excretion (ADMA) of CBD. The agencies also would like to see data on whether repeated use of CBD might cause damage to specific organs that does not occur from single exposures.

The second need is for more data related to the negative effects that have been observed in some previous work. This includes effects on the liver and reproductive system.  In particular, the agencies would like to know whether it is possible to identify a level of exposure that is low enough to not cause any negative effects. This is termed the No Observed Adverse Effect Level (NOAEL). In an ingredient safety assessment, the NOAEL is used to establish a safe intake level, called the Acceptable Daily Intake (ADI). Comparing the ADI to the expected exposure for the intended use allows the regulators to assess overall safety for a substance.  If the expected exposure is below the ADI, the substance is considered safe. Both agencies feel that the existing data do not allow them to identify a NOAEL for CBD.

The third data need relates to the composition of the CBD products used in safety studies. Food safety determinations are based on the total composition of an ingredient that is produced using a fully defined process. Even if the potential ingredient is 95% or 99% pure, a safety evaluation needs to know what is in that other 5% or 1%, and that this is the same from batch to batch. For example, the presence or absence of residual processing chemicals (such as extraction solvents) and the nature and concentration of substances such as other cannabinoids and terpenes will differ between manufacturers and processes. These differences could affect the overall safety profile for each CBD product. Therefore, it is considered important that studies supporting a safety determination for a new substance be carried out with the actual article of commerce.

Unfortunately, many different CBD preparations have been used in past studies, and in most cases these preparations were poorly characterized. This makes it difficult or impossible to combine the safety data obtained using one product with data obtained with a different product. For example, data obtained using CBD isolates from two different sources cannot be combined unless it can be shown that they were made using the same process and have the same overall composition.

What does this mean for the future?

Neither the FDA nor EFSA is likely to take any positive action on CBD until they receive safety data that fill the gaps that they have identified.

Given these data problems, it is likely that there will be little or no movement on regulatory approvals for CBD in edibles (or dietary supplements in the US) for at least several years. In the US, these products will remain in legal limbo, with state regulations playing the leading role in determining what is allowed on the market. Products with health claims will continue to be particularly vulnerable to FDA action.  The situation in the EU will be at least as confusing because, in the absence of action from EFSA, the regulatory and market status of CBD edibles will be determined by each member country independently.

In view of this uncertainty and business confusion, that are three ways that companies making CBD and CBD edibles can respond. First, in the short term, they can develop and implement manufacturing processes that ensure that their products are consistent from batch to batch and that they have the intended dose of CBD per serving or per product unit. This includes working with the analytical community and organizations such as AOAC and ASTM to ensure that there are validated testing methods available for the CBD and for the final edible products.

In the medium term, business risk management plans for companies that make CBD and CBD infused edibles should consider the possibility that new scientific data will push food safety authorities to actively conclude the CBD does not meet the current regulatory safety standards. In that case, the regulators might start to act against all CBD-containing products.

Businesses should also be aware that the agencies could make a positive safety determination but that they would use the available data to establish a low maximum allowed dose per serving or set very low limits on the presence of specific contaminants such as other cannabinoids.

In the longer term, the CBD industry as a whole might consider advocating for legislative changes. The best statutory fix is likely to be one that that regulates all cannabis-derived products in a system or agency that is separate from the food safety system. This approach is being used in Canada under the Cannabis Act. It is also similar to the way that alcoholic beverages are regulated in the US. This approach, if appropriately designed, could avoid the need for safety determinations but might also limit market access. While this approach could bring clarity and certainty to the market, it is important to remember that it will take time and effort to create a functionally system under this scenario.

There are many market reports that forecast on-going high rates of growth for the CBD market.  However, the regulatory and scientific developments that are likely to occur of the next couple of years will determine whether those projections can become reality.

Companies making these products need to monitor changes and prepare to respond to either positive or negative events.

These companies should also remember that edible products are mostly made from food ingredients using standard food product processes. It is critical that these products be made under a system that prevents food-borne hazards.