Is CBD Oil Legal In The UK? CBD Law And Compliance For Businesses

CBD has gone mainstream in the UK - from oils and gummies to skincare and drinks. If you’re a small business owner, that’s exciting (there’s clearly demand), but it can also feel like a legal minefield.

The big question we hear all the time is whether CBD oil is legal in the UK to sell.

In many cases, CBD oil can be legal in the UK - but only if you get the details right. The legality usually comes down to things like controlled cannabinoid content (including THC), product type (food, cosmetic, vape, “medicine”), labelling, advertising/claims, and whether the product meets the UK’s “novel food” rules.

Below, we break down CBD legality in the UK from a business perspective - what the law is trying to regulate, what regulators actually care about, and what you can do to stay compliant from day one. This guide is general information only (it isn’t legal advice), and the rules and enforcement approach can differ across the UK (England, Wales, Scotland and Northern Ireland).

Is CBD Oil Legal In The UK?

Broadly speaking, CBD (cannabidiol) is not itself a controlled drug in the UK - which means CBD products may be lawful to sell.

However, CBD products are only legal to sell if they meet a few key conditions. In practice, the biggest legal risk points tend to be:

• Controlled cannabinoids (especially THC) (even small amounts can cause trouble if you don’t meet the UK’s expectations)
• Whether your product is treated as a food, supplement, cosmetic, vape product, or medicine (different rules apply)
• How you market the product (certain claims can shift a “wellness product” into a “medicinal product” category)
• Whether your ingestible CBD product meets “novel food” requirements (and which UK nation’s regime applies)

So if you’re asking whether CBD oil is legal as a retailer, brand owner, or manufacturer, the more helpful question is:

Is this specific CBD product legal to sell, in this format, with this controlled-cannabinoid profile, and with these claims?

That’s what we’ll unpack in the rest of this guide.

What Makes CBD Oil Illegal (Or High Risk) For Businesses?

In the UK, cannabis and certain cannabinoids are regulated under the Misuse of Drugs Act 1971 and the Misuse of Drugs Regulations 2001. CBD itself isn’t controlled - but THC is, and so are other cannabinoids that fall within the legal definition of “controlled drugs”.

For small businesses, the risk usually isn’t that you’re trying to sell something illegal - it’s that your supply chain, lab testing, labelling, or marketing inadvertently pushes you into non-compliance.

1) THC And Controlled Cannabinoids

As a practical matter, UK regulators focus heavily on whether a CBD product contains controlled substances (especially THC) above what is permitted/accepted in practice.

One commonly referenced benchmark in the UK is the Home Office “exempt product” approach, which is often summarised as no more than 1mg of controlled drug per finished product/container (not per serving). This is widely relied on in the market, but it’s important to treat it cautiously: whether a product is “exempt” can be fact-specific, the definition of “controlled drug” can capture more than just THC, and enforcement expectations can evolve.

This is a key compliance point that often trips businesses up, particularly where:

• the product is high volume (e.g. a larger bottle), so tiny concentrations add up across the container;
• you’re relying on overseas supplier lab reports that don’t align with UK expectations (for example, incomplete cannabinoid panels, different reporting thresholds, or different units);
• batch-to-batch variation means a “compliant” sample doesn’t match your production run.

Business takeaway: you should be able to evidence controlled-cannabinoid compliance with reliable, up-to-date Certificates of Analysis (COAs) from reputable labs, and you should have a clear process for quarantining/withdrawing out-of-spec batches.

2) “Medicinal” Claims (Even If You Don’t Mean To Make Them)

A very common compliance issue is marketing. If you describe CBD oil as treating or preventing medical conditions (for example, anxiety, depression, pain, epilepsy, inflammation), you can trigger medicines rules.

In the UK, medicines are regulated by the Medicines and Healthcare products Regulatory Agency (MHRA). If your product is presented as a medicine (by claims, imagery, testimonials you reuse, or “before/after” style outcomes), you may need authorisation - and selling without it can create serious legal risk.

You should also factor in the UK’s advertising standards regime. The Advertising Standards Authority (ASA) applies the CAP Code (and BCAP Code for broadcast). Claims must be legal, decent, honest and truthful - and health/medicinal claims are a frequent CBD enforcement hotspot.

Business takeaway: keep your marketing cautious and compliant. Product descriptions, blog content, paid ads, influencer scripts, and even customer testimonials you repost can all be treated as marketing.

3) Novel Food Rules For Ingestible CBD

If you sell CBD oil intended to be taken orally (for example, drops, capsules, gummies, drinks), you are usually in “food supplement / food” territory.

In the UK, ingestible CBD is generally treated as a “novel food”. That means it typically needs a valid novel food authorisation pathway before it can be lawfully sold - and in practice, businesses often rely on being linked to a credible application while authorisation is pending (where regulators accept this). The Food Standards Agency (FSA) has published guidance for England and Wales and maintains public information about products linked to applications. Scotland is overseen by Food Standards Scotland, and Northern Ireland can involve different rules and routes because it remains aligned with aspects of EU food law in certain areas.

Business takeaway: if you sell ingestible CBD, confirm which UK nation(s) you sell into and whether your products are properly covered by an appropriate novel food application/authorisation route and meet current regulator expectations. This is one of the most important CBD legality issues for consumer-facing brands.

CBD Legality UK: The Rules Change Depending On What You Sell

When you’re building (or scaling) a CBD business, one of the smartest moves is to map your products by category. The legal obligations can change significantly depending on whether you’re selling a food, cosmetic, vape product, or something that looks like a medicinal product.

CBD Oils And Supplements (Ingestible Products)

Common examples include:

• CBD oil drops to ingest
• capsules
• CBD gummies
• CBD drinks

Key compliance themes for ingestibles include:

• novel food compliance (and which UK nation’s regulator approach applies)
• food labelling rules (including ingredient lists and allergen considerations)
• no medicinal claims (including implied claims)
• controlled cannabinoid thresholds and evidence via testing

If you’re selling these products online, it also helps to have clear customer-facing documents like your online shop terms and conditions to set out ordering, delivery, returns, and limitation of liability in a way that aligns with UK consumer law.

CBD Skincare And Cosmetics

If you sell CBD-infused skincare (creams, serums, balms), you’re generally in cosmetics territory. That has its own compliance framework, including safety and documentation requirements.

Cosmetics businesses should also be careful with:

• product claims (avoid drifting into medical territory, and make sure cosmetic claims are supportable)
• ingredients and restricted substances (including how hemp/CBD ingredients are sourced and described)
• core cosmetics compliance steps such as having a Responsible Person, a Product Information File (PIF), an appropriate safety assessment, and completing SCPN notification before placing products on the GB market (and separate processes may apply for Northern Ireland)

Even if you’re not selling ingestible CBD, you still need to be cautious about what you promise the product will do.

CBD Vape Products

CBD vapes and e-liquids raise additional compliance questions around product standards, age-gating, and marketing restrictions.

If your vape products contain nicotine, you may also fall under the UK’s Tobacco and Related Products Regulations (TRPR) (including notification and packaging/health warning requirements). Even where nicotine isn’t present, you still need to ensure general product safety, compliant labelling, and responsible marketing.

If you operate an e-commerce store for vape products, ensure your website journey (including checkout language and marketing) lines up with the rules applicable to your product type - and that your website terms and conditions reflect how you actually sell and supply your products.

CBD Products Positioned As “Medical” Or Therapeutic

This is where risk spikes.

If your CBD oil is described (directly or indirectly) as a treatment for a medical condition, you may be treated as selling a medicinal product - which can trigger MHRA oversight, additional approvals, and restrictions.

For many small businesses, the safer route is to keep positioning within wellness and lifestyle boundaries, and to get specific legal advice before launching any marketing campaign that touches health outcomes.

A Practical Compliance Checklist For Selling CBD Oil In The UK

There’s no single “CBD licence” that magically makes everything compliant. Instead, compliance is usually about building a strong system: good suppliers, good documentation, careful marketing, and consumer-law compliant processes.

Here’s a practical checklist to work through.

1) Confirm Your Supply Chain (And Don’t Rely On Assumptions)

Before you even think about branding and marketing, confirm:

• where your hemp is grown and how it’s processed;
• whether your manufacturer follows good manufacturing practices;
• whether batch testing is consistent and independently verified;
• what exactly is in the extract (not just “CBD”), including the controlled-cannabinoid profile you need to manage.

If you’re white-labelling or importing, do extra checks. In CBD, documentation quality varies wildly, and you don’t want your compliance to depend on a supplier’s marketing brochure.

2) Get Reliable Lab Testing And Keep The Records

Testing is central to CBD legality because it’s how you evidence that controlled cannabinoids (like THC) stay within acceptable limits.

As a business owner, you should be aiming to keep:

• current COAs for each batch;
• a system to verify COAs match what you’re selling (SKU, batch number, container size);
• clear specifications (including acceptable tolerances) agreed with your manufacturer;
• internal procedures for what happens if a batch fails.

This is not just about enforcement risk - it’s also about customer safety, complaints handling, and protecting your brand if a retailer, marketplace, or payment provider asks for proof.

3) Get Your Labelling And Product Information Right

Labelling rules depend on the product category, but as a general rule, misleading labelling can cause trouble fast - with customers and with regulators.

Common issues include:

• unclear CBD content (e.g. “hemp extract” without specifying actual CBD mg);
• implied medicinal claims (even subtle ones);
• missing warnings (for example, appropriate use and who the product is not intended for);
• claims that can’t be substantiated.

If you’re selling online, your product page is part of your labelling in practice - so treat it with the same care as physical packaging.

4) Be Careful With Advertising And Social Media

CBD marketing is a common enforcement area because claims can drift quickly in ads, influencer posts, and “educational” blog content.

To reduce risk:

• avoid medical claims (treating, preventing, or curing conditions);
• avoid presenting outcomes as certain or guaranteed;
• review influencer scripts and affiliate content before it goes live;
• have internal guidelines for how staff respond to customer health questions;
• check your ads and website content against ASA/CAP requirements as well as MHRA risk (they’re not the same thing).

It can also be wise to include an appropriate disclaimer on your website where you publish educational content, so you’re not accidentally implying medical advice or guaranteed outcomes.

5) Make Sure Your Consumer Law House Is In Order

CBD products can generate strong customer expectations - which means your refunds, complaints handling, and delivery processes need to be legally solid.

UK consumer protection rules (including the Consumer Rights Act 2015 and the Consumer Contracts Regulations) can apply to many CBD sales, especially online.

That means you’ll want to ensure:

• your returns/refunds approach is compliant and clearly communicated;
• your delivery timelines are accurate (and you meet them);
• your product descriptions aren’t misleading;
• your terms don’t try to unfairly exclude consumer rights.

Practical tip: clear contractual terms can help reduce disputes, but they need to be drafted properly for your specific business model - especially if you sell subscriptions, bundles, or promotional offers.

6) Don’t Forget Data Protection If You Sell Online

Most CBD brands operate online, run email marketing, use cookies/analytics, and process customer orders - which means you’ll be handling personal data.

That’s where UK GDPR and the Data Protection Act 2018 come in. You’ll typically need a clear Privacy Policy, and if your site uses non-essential cookies (which most e-commerce stores do), you’ll also want a compliant cookie policy.

This isn’t just a “big business” issue. Small e-commerce stores can still face complaints, customer distrust, and platform restrictions if privacy compliance is ignored.

What Legal Documents Should A CBD Business Have?

CBD is a regulated-ish space, and it’s also a high-expectation consumer product category. That combination makes good legal documents especially important.

While your exact documents depend on how you trade (online only, retail, wholesale, white-label, subscriptions), many CBD businesses should consider the following.

Customer-Facing Website And Sales Documents

• Website terms covering site use and key disclaimers, often set out in your website terms and conditions
• Online store terms covering orders, payment, delivery, returns and liability, often set out in your online shop terms and conditions
• Privacy compliance documents, including your Privacy Policy and cookie policy
• Appropriate disclaimers (especially if you publish wellness content), using a tailored disclaimer

These documents do more than “tick a box”. They help you set expectations, reduce disputes, and show platforms/payment providers that you run a legitimate operation.

Supplier And Manufacturing Agreements

Your supply chain is often your biggest legal risk in a CBD business.

Depending on your setup, you might need:

• manufacturing terms (including testing and quality obligations);
• white-label / private label arrangements;
• distribution terms;
• recall procedures and responsibility allocation;
• clear warranties and indemnities around compliance (including controlled cannabinoid thresholds and ingredient legality).

This is one of those areas where generic templates can be risky - because your real-world commercial setup (and who controls what) matters a lot.

Brand Protection (Often Overlooked Until It’s Too Late)

If you’re building a CBD brand, your name and visual identity can become one of your most valuable assets.

Many growing consumer brands consider trade mark protection - especially before investing heavily in packaging design, influencer marketing, and retail onboarding. If that’s relevant to you, registering a trade mark can be an important step in protecting your brand as you scale.

Key Takeaways

• CBD oil can be legal in the UK, but legality depends on your specific product, its controlled-cannabinoid profile, and how it’s marketed.
• If your product contains controlled cannabinoids (including THC) above what is permitted/accepted in practice, you can run into serious legal issues - even if the product is labelled “CBD”.
• Ingestible CBD is generally treated as a novel food, so you should check your product’s position against current regulator expectations (and the rules in the UK nation(s) you sell into) before selling.
• Medicinal claims are a major risk area - and both MHRA rules and ASA/CAP advertising standards can apply to your marketing.
• CBD businesses selling online should get their legal foundations right early, including customer terms, a Privacy Policy, and clear returns and complaints handling processes.
• Strong supplier/manufacturer contracts and reliable batch testing help protect your business if problems arise later (and they often do in fast-growing product categories).

If you’d like help with the legal side of launching or scaling a CBD business - whether that’s reviewing your website terms, tightening up your disclaimers and marketing risk, or putting the right contracts in place - you can reach us at 08081347754 or team@sprintlaw.co.uk for a free, no-obligations chat.