Introduction

As CBD continues to feature in everyday wellness routines, UK employers face a new moment of clarity and complexity. The Food Standards Agency's updated guidance on 24 February 2026 keeps Novel Food application outcomes under active management — meaning some CBD products remain on shelves while authorisation decisions are finalised. For HR teams this creates a pressing need to revisit workplace drug and wellbeing policies, balancing staff wellbeing, legal compliance and the risk of inadvertent THC exposure triggering workplace drug tests.

What HR needs to know about the 2026 FSA update

The FSA update confirms two practical realities: Novel Food applications are still being processed, and products awaiting authorisation may lawfully remain on the market pending decisions. This regulatory limbo increases variance in product quality. Labels alone are not guarantees of nil‑THC — independent third‑party Certificates of Analysis (COAs) are essential for any risk assessment involving employee CBD use.

Practical tip

Ask employees who disclose CBD use to provide COAs from an accredited lab for the specific batch. Employers should also consider listing approved product types in policy — for example, preferring sealed capsules with reliable COAs over unbranded drops from overseas vendors.

THC contamination: the primary workplace risk

THC contamination — often the result of unverified or overseas supply chains — is the main issue for employers. Most routine workplace drug tests cannot reliably distinguish whether detected THC metabolites came from recreational cannabis or a contaminated CBD product. That means an employee using CBD in good faith can still return a positive result.

Where microdosing is common, the perceived safety can be misleading: small amounts of THC, below legal limits on paper, may still register on sensitive assays. Employers should therefore assess risk by product provenance and COAs rather than by label claims alone.

Drug‑testing methods: windows, strengths and costs

Different biological matrices and laboratory methods produce different detection windows and error profiles. A pragmatic summary for UK workplaces:

• Urine — Widely used; quicker turnaround but more prone to false positives and limited ability to indicate recency. Typical UK cost: £15–30.
• Saliva — Useful for recent use detection (hours to a couple of days); relatively quick but can be variable. Typical UK cost: £20–35.
• Hair — Shows patterns of longer‑term use (weeks to months), with higher cost and limited sensitivity to very recent use. Typical UK cost: £80–150.
• Blood — Best for detecting current impairment markers but costly and more invasive; typically £100–200 in the UK.

Given these differences, an employer choosing to test should document the rationale for method selection, consistent with proportionality and necessity principles under data protection law.

Data protection and handling of test results

Drug‑test results are classified as special category personal data under the Data Protection Act 2018 and UK GDPR. HR teams must ensure that testing programmes are lawful, minimise data collection, are transparent with employees and use secure storage and limited access. A lawful basis and an additional condition for processing special category data are required — typically employment law compliance, occupational health purposes or substantial public interest combined with appropriate safeguards.

Checklist for employers

• Carry out a data protection impact assessment (DPIA) for any routine testing regime.
• Limit retention to what is necessary and set clear access controls.
• Inform staff in plain language about testing purposes, methods and their rights.

Policy drafting: clarity on microdosing, presence vs impairment and safety roles

HR and legal advisers in 2026 stress the risks of inconsistent messaging. Key policy elements to consider:

• Define terms — set out what you mean by CBD, cannabis, THC, microdosing and impairment.
• Distinguish presence from impairment — explain that a positive metabolite result indicates presence, not necessarily impairment, and detail any further steps to assess current capability for safety‑sensitive duties.
• Require COAs — for employees wishing to use CBD in the workplace or undertake safety‑sensitive tasks, request third‑party certificates for the specific batch.
• Risk assessments — carry out role‑specific risk assessments for safety‑critical positions and consider restrictions or reasonable adjustments where appropriate.
• Supportive measures — follow CIPD and ACAS guidance by combining prevention and wellbeing (education on product quality, access to occupational health) with any disciplinary route.

Microdosing at work: practical guidance

Many people choose microdosing as a way to integrate CBD into their routine. From an employer perspective, microdosing still requires oversight: insist on independent COAs, restrict use during work hours for safety‑sensitive roles, and encourage staff to source from reputable suppliers. When discussing product choice, you may reference reputable formats such as sealed capsules or clearly labelled, COA‑backed tinctures and gummies — for example a measured capsule format or known batch‑tested products are easier to evaluate than anonymous bulk liquids.

Examples of product formats often used for controlled microdosing include sealed gel capsules and measured gummy portions, which can simplify workplace risk assessments: consider advising staff to favour these where appropriate. For those who prefer tinctures or topical approaches, encourage batch COAs and caution about sourcing.

If you wish to signpost examples for employees seeking batch‑tested options, products such as CBD Living Tincture 30ml (4500mg, 0% THC), CBD Living 5mg Gel Capsules or measured options like Wylde CBD Gummy Bears may be easier to verify via COAs than unbranded alternatives.

Final practical steps for HR teams

• Update policies now to reflect the FSA 24 February 2026 position and to set clear expectations on COAs, testing consent and the distinction between presence and impairment.
• Train managers on consistent messaging and on how to handle disclosures without rushed disciplinary action.
• Embed prevention and wellbeing—link to occupational health and provide information on product quality and COA interpretation.

Conclusion

CBD is now part of many employees' wellbeing toolkits, and the 2026 regulatory landscape places a premium on clarity and defensibility for employer policies. By insisting on independent COAs, distinguishing presence from impairment, aligning testing choices with proportionality and protecting sensitive data under UK GDPR, organisations can support staff wellbeing while managing workplace safety and legal risk. Update policies, train line managers, and keep communications consistent — doing so will make your approach both fair and defensible.

For topical approaches where contact exposures are a concern, reputable batch‑tested topicals such as the Full Spectrum CBD Healing Balm can be suggested with the caveat that COAs are checked; for staff preferring vapour formats, remind them of contamination risks and test sensitivity regarding cartridges like the Blue Zkittlez CANAVAPE Cartridge and the importance of sourcing from verified suppliers.