Summary
The cannabis and CBD market is growing faster than regulators can adapt, but the FDA is closing the gap quickly through a rising volume of warning letters targeting unapproved new drugs, misbranding, and inadequate labeling. State licensing frameworks add another layer of complexity, with California alone maintaining more than 20 distinct license types. Companies that align their compliance, quality, and technology strategies with both federal and state requirements early gain a durable competitive advantage on the road to commercialization.
The cannabis industry is experiencing significant and accelerated growth in many countries.
With this growth comes a responsibility to regulate the industry in a way that ensures its long-term viability and protects public safety. The availability of products containing CBD (Cannabidiol) such as oils, sprays, patches, etc. (even for pet use) has outpaced the Food and Drug Administration as well as individual states’ ability to adapt adequately. However, this is no reason to assume that the FDA is falling behind. As the chart below indicates, the FDA is catching up quickly. This chart shows the number of warning letters issued to Cannabis companies that manufacture or distribute products containing CBD. There is an apparent upward trend as the FDA ramps up.
What the FDA Is Targeting in Its Warning Letters
The FDA is primarily focusing on the following issues with these warning letters:
- Unapproved New Drug
- Misbranded Drug (classifications of “Dietary Supplement”)
- Inadequate labeling/directions for use
And specifically, under the Federal Food, Drug and Cosmetic Act:
- Section 201(g)(1)(B)
- Section 201(ff)(3)(B)(ii)
- Section 502(f)(1)
- Section 505(a)
- Section 301(d)
The common themes in these warning letters are that the FDA is deeming these products to be “New Drugs” based on claims made by the companies themselves. And as with any new drug, they may not be legally introduced or delivered into interstate commerce without prior FDA approval. Further, the FDA also calls out, in most of these letters, that as new drug products, they are misbranded, and they are failing labeling requirements as the labels do not provide adequate directions for use.
Some companies have claimed that their product(s) are Dietary Supplements, which is also inaccurate. The FDA has concluded that since CBD containing products are designated as new drugs, they fall outside the definition of a dietary supplement.
When the FDA deems a CBD product a “New Drug” based on the company’s own claims, the regulatory burden shifts overnight—from consumer product to a system that must meet drug-grade quality, labeling, and data integrity expectations.
Why Early Compliance Pays Off
A warning letter is not just a regulatory inconvenience—it can stall distribution, freeze interstate commerce, and erode investor and customer confidence. Building quality and IT compliance into your operating model before scaling is far less costly than retrofitting it after an enforcement action. The same disciplines that protect you from FDA scrutiny—controlled records, validated systems, and defensible documentation—also make your business easier to audit, finance, and grow.
State Legislation Adds Another Layer of Complexity
Also, state legislation plays an essential role in the regulation of the industry. New York has announced new licensing requirements for growers, processors, and sellers that outlines requirements for purity, contaminant levels, etc. However, California has gone the furthest with their licensing requirements. California has currently developed 21 licensing requirements, each based on the part of the industry a company or person is classified. From small/large cultivators; indoor/outdoor cultivators; manufacturing with and without solvents; testing laboratories; or Cannabis event organizers.
But the real authority lies with the FDA. Specific information about how the FDA regulates CBD can be found on their website.
A Practical Compliance Framework for Cannabis & CBD Companies
Whether you are a cultivator, manufacturer, or testing laboratory, the path to defensible compliance follows a consistent pattern:
- Classify your products and claims accurately. Understand whether the FDA could deem your product a new drug based on your own marketing language, and align labeling and directions for use accordingly.
- Map federal and state requirements together. Reconcile FDA expectations with state licensing rules for purity, contaminant levels, and category-specific licenses so nothing falls through the cracks.
- Validate your regulated systems. Apply risk-based, phase-appropriate Computer Software Assurance (CSA) to laboratory, manufacturing, and quality systems so your software is fit for intended use without over-testing.
- Secure your electronic records. Bring records and signatures into alignment with 21 CFR Part 11 and reinforce data integrity across the product lifecycle.
- Sustain compliance over time. Replace point-in-time audits with continuous, monitored compliance so you stay ready for inspection as regulations evolve.
How USDM Helps Emerging Cannabis & Cannabinoid Companies
USDM works closely with emerging cannabis and cannabinoid companies, and we follow the global regulatory agencies to stay on top of the evolving regulations. We also realize the cannabis and hemp industries will have many regional impacts and considerations. The earlier on your road to commercialization that you align your compliance and technology strategies with both federal and state requirements, the more competitive market advantage you will have in the industry.
As your validated systems scale and move to the cloud, USDM Cloud Assurance keeps them in a continuous state of compliance so a single update doesn’t put your inspection readiness at risk.
Some of the services we offer cannabis companies are below:
- Regulatory education and training
- Establishing risk-based, pragmatic, phase-appropriate quality and IT compliance programs
- Developing a comprehensive IT strategy and 3-year cloud technology roadmaps
- Accelerating vendor selection, implementation, and validation of all regulated systems
- Validation and qualification for CSV, process, and equipment
- Compliance-as-a-Service
- Internal and mock audits to prepare for regulatory submission
FAQ: Cannabis & CBD Compliance and FDA Enforcement
Why is the FDA issuing warning letters to CBD companies?
The FDA is deeming many CBD products to be “New Drugs” based on the therapeutic claims companies make about them. New drugs cannot be legally introduced into interstate commerce without prior FDA approval, and the FDA also cites these products as misbranded and as failing labeling requirements because the labels do not provide adequate directions for use.
Can a CBD product be sold as a dietary supplement?
According to the FDA, no. The agency has concluded that because CBD-containing products are designated as new drugs, they fall outside the definition of a dietary supplement, making the “dietary supplement” classification inaccurate for these products.
How do state requirements differ from FDA requirements?
States regulate licensing for growers, processors, and sellers—including purity and contaminant-level requirements—while the FDA holds the real authority over how products are classified and marketed. New York has introduced new licensing requirements, and California has gone the furthest, developing 21 license types based on the part of the industry a company operates in.
What should an emerging cannabis company do first to prepare for enforcement?
Align your compliance and technology strategies with both federal and state requirements as early as possible. That means classifying your products and claims accurately, validating your regulated systems with a risk-based approach, securing electronic records under 21 CFR Part 11, and sustaining compliance over time rather than treating it as a one-time event.
How can USDM help with cannabis and CBD compliance?
USDM works with emerging cannabis and cannabinoid companies to build risk-based, phase-appropriate quality and IT compliance programs, validate regulated systems, prepare for audits, and keep cloud systems continuously compliant—so you can move toward commercialization with confidence.
Align Your Compliance Strategy Before You Scale
The cannabis and CBD regulatory landscape will keep shifting, but the companies that prepare early will be the ones that endure. Contact USDM to learn how we can help guide your journey to commercialization and build a compliance strategy that holds up to FDA and state scrutiny.
About the Author
Joseph Cassella is the Director of Regulatory Compliance at USDM Life Sciences. With over 25 years of experience in the pharmaceutical, biotech, and medical device industries, Joe’s background is both broad and deep in Information Technology, Laboratory and Analytical Applications, and Quality Systems. He has led many projects inclusive of IT Infrastructure, Research & Development, QA/QC, Manufacturing, Compliance, and Sales and Marketing.