CBD & Hemp Packaging Compliance Guide 2026

The single biggest shift is a new federal ceiling on THC in finished consumer products. Under the 2026 Continuing Appropriations Act, the definition of legal hemp was narrowed to exclude any final product containing more than 0.4 milligrams per container of combined tetrahydrocannabinols and cannabinoids that produce, or are marketed to produce, similar effects. This applies at the container level, not as a percentage — a distinction that catches a lot of brands off guard.

This is a meaningfully different rule from what most packaging still references. If your labels were designed around the 2018 Farm Bill’s plant-level definition alone, they may already be out of step with how finished products are now regulated.

These are two separate rules that apply at two separate stages, and confusing them is one of the most common compliance mistakes in the industry right now.

A product can be sourced from fully compliant, low-THC hemp under the plant-level rule and still fail the new container-level cap if the finished formulation concentrates cannabinoids during extraction. Packaging copy that only references “0.3% THC” without addressing the per-container limit is now presenting an incomplete compliance picture.

Federally, the FDA still treats CBD as excluded from the dietary supplement definition and prohibited as a food additive, which means labeling has to be handled carefully regardless of state legality. At minimum, compliant labels typically include:

• An identity statement describing what the product is and its intended use
• A complete list of ingredients, including hemp and CBD content clearly identified
• The manufacturer, packer, or distributor’s name and address
• Net quantity and CBD amount per serving, with servings per container for multi-serving products
• A disclaimer on any wellness-adjacent statement noting the FDA has not evaluated it

What can’t appear: any claim that the product treats, cures, or prevents a disease or medical condition. The FDA continues to issue warning letters over this specific issue more than almost any other, and even implied claims — not just explicit ones — can trigger action.

Increasingly, yes, especially for edibles and higher-potency products, though the requirement varies by state rather than applying uniformly nationwide. Where child-resistant packaging is required, it must meet the CPSC’s federal standard under 16 CFR 1700, which sets a specific bar: at least 85% of tested children must fail to open the package within the first 5 minutes, and at least 80% must still fail after 10 minutes, while at least 90% of adults must be able to open it within 5 minutes.

This isn’t a design suggestion — it’s a tested, certified standard. Packaging marketed as “child-resistant” without third-party testing to this protocol is a compliance risk, not a compliance solution.

There’s no blanket federal QR code mandate, but the state-level picture has shifted quickly. Several states now require a scannable QR code or printed web address that links directly to a batch-specific Certificate of Analysis (COA) — verified third-party lab results confirming cannabinoid content and screening for contaminants. New York is among the states that mandate this for hemp products sold within the state.

Even in states without a legal requirement, linking a QR code to real batch-matched lab results has become close to standard practice, since it directly addresses one of the industry’s biggest trust problems: inaccurate potency labeling. Independent reporting has repeatedly found a large share of CBD products mislabeled on actual cannabinoid content, which is exactly what a verifiable QR-linked COA is designed to prevent.

Because CBD sits in a patchwork of state and federal rules, the safest approach for any brand shipping to multiple states is designing packaging around the strictest applicable requirement, not the federal minimum. A few examples worth knowing:

• California requires Prop 65 warning language on any product containing detectable THC, even trace amounts, since THC is a listed compound with no exempted minimum threshold.
• New York mandates QR codes linking to lab results on hemp products sold in-state.
• Indiana requires expiration dating not more than two years from the manufacture date.
• Multiple states require font size minimums for compliance text — commonly no smaller than 6pt on primary panels, with warning statements requiring roughly 1/16 inch letter height.

If you sell nationally, this patchwork is exactly why “compliant in one state” isn’t the same as “compliant everywhere” — a national brand’s packaging effectively has to satisfy the sum of every state’s individual requirements at once.

No material makes a product legally compliant on its own — that’s a labeling and formulation question. But material and structure choices directly affect whether you can physically fit required text at a readable size without wrecking the design.

• Kraft paperboard — widely used for gummies and capsule cartons; enough surface area for full compliance text, and reads as natural/eco-conscious, which aligns well with the wellness positioning most CBD brands want.
• Rigid boxes — suited to higher-potency tinctures and gift sets where a premium presentation matters and there’s still room for full labeling on an inner or outer panel.
• Matte laminate cartons — a professional finish that leaves ample flat space for dense compliance text without visual clutter.
• Custom inserts — useful for separating branding, product information, and legal text into distinct zones so each stays legible instead of competing for the same panel.

• Designing around the old 0.3% rule only. That rule governs the plant, not the finished product — the 0.4mg per-container cap is the one that determines whether your retail item is legal to sell.
• Implied health claims. Words like “relief,” “calming,” or “supports recovery” can read as therapeutic claims even without naming a specific condition, and the FDA treats implied claims seriously.
• QR codes that don’t match the batch. A generic or outdated link undermines the entire point of the code and can itself become a labeling issue.
• Undersized compliance text. Squeezing required warnings below the minimum readable size to preserve design space is a frequent, avoidable violation.
• Treating child-resistant packaging as optional everywhere. It’s state-dependent — check the specific states you ship to rather than assuming one national standard applies.

1. Confirm total THC per container is under 0.4mg, not just that the source plant tested under 0.3% dry weight.
2. Remove any disease, cure, or therapeutic language, explicit or implied.
3. Include identity statement, full ingredient list, manufacturer address, and net quantity/serving size.
4. Check whether your product category and selling states require child-resistant packaging, and test to CPSC 16 CFR 1700 if so.
5. Add a QR code linked to a batch-matched Certificate of Analysis, especially if selling into states that require it.
6. Verify compliance text meets minimum font size and contrast requirements on every panel.
7. Cross-check labeling against the strictest state you sell into, not just your home state.

Need packaging that’s built around this checklist from the start? Contact Prime Custom Boxes for a free compliance-ready quote — we’ll help you fit every required element without turning your box into a wall of text.