Cannabis in the Workplace 2026: What Employers Need to Know

Cannabis has moved from a straightforward "illegal drug" conversation into something far more complicated. Between legal cannabis-based medicines, privately prescribed cannabis, CBD supplements, vapes, and even cannabis-infused food and drink, employers and occupational health teams now have to navigate a genuinely confusing landscape, and the picture is still changing.

Here's a practical breakdown of where things stand, based on the latest expert guidance on workplace drug and alcohol testing.

Not All "Cannabis" Means the Same Thing

Before anything else, it helps to separate out the different categories, because they carry very different implications for workplace policy:

• Illegal cannabis – the recreational product most people are familiar with.

• Cannabis-based medicinal products (CBMPs) – licensed medicines listed in the British National Formulary (BNF), such as Sativex and nabilone.

• Privately prescribed cannabis – cannabis prescribed by private clinics, often for conditions well beyond what's listed in the BNF.

• CBD – sold as a food supplement, regulated by the Food Standards Agency (FSA) rather than as a medicine.

The term "medicinal cannabis" gets used loosely to cover several of these categories at once. For policy purposes, it's worth defining exactly what your organisation means by it, and staying consistent.

How Cannabis Behaves in the Body

THC (tetrahydrocannabinol), the psychoactive component of cannabis, is highly lipid-soluble. This means it's stored in fatty tissue and released gradually over time, then metabolised and excreted. That's why regular users can test positive on a urine test many weeks after last use.

Passive smoking has long been the go-to explanation offered by employees who test positive. Research from the 1980s and repeated more recently with modern, higher-THC cannabis has found that passive exposure under normal conditions produces levels well below the confirmation cutoff. Only in extreme, enclosed exposure scenarios have researchers recorded a positive confirmed result, and that required conditions serious enough that voluntary presence would reasonably be treated as implied consent to exposure and it's also the reasoning behind cutoff levels used in workplace testing.

Passive smoking is the reason behind the cutoffs, not the elimination rate or lipid solubility.

CBD: A Supplement, Not a Medicine

CBD is regulated by the FSA as a food supplement, not a medicine. Products are supposed to be listed on the FSA's novel food list, but the list is not easy to search, and plenty of pop-up market stalls and online sellers won't be on it at all.

Under FSA rules, food supplements are not permitted to make claims about treating or preventing disease, or about modifying physiological function. In October 2023, the FSA reduced its recommended daily CBD limit due to concerns raised about certain medical conditions, a reminder that the evidence base here is still developing.

Product labelling is not always reliable. Trading standards testing of seized products has found some contain THC alongside CBD, and occasionally other substances that have no place in a supplement. The purity and accuracy of labelling varies significantly by manufacturer.

Terpene oils are sometimes flagged as a potential explanation for a non-negative initial screening result. Terpenes (found in plants generally, including pine and lavender, not just cannabis) are not chemically related to THC or CBD, so a confirmatory test using gas or liquid chromatography with mass spectrometry will resolve any ambiguity here.

Privately Prescribed Cannabis: The Real Grey Area

Private clinics are prescribing cannabis for a wide range of conditions, some well outside what NICE or the BNF actually recommend. NICE guidance is explicit that CBD and THC should not be offered to manage chronic pain in adults outside a clinical trial, yet "cannabis for pain" is a common assumption people take from the headlines without reading the detail.

The BNF lists cannabis-based medicines for a narrow set of conditions: chemotherapy-induced nausea and vomiting, multiple sclerosis spasticity, and treatment-resistant epilepsy. It does not list pain, ADHD, endometriosis, or menopause, even though private prescriptions are being issued for these and other conditions.

This creates a genuine problem for laboratories and occupational health teams: testing cannot distinguish between illegal cannabis and privately prescribed cannabis. The chemical profile is the same either way, so a private prescription needs to be verified through proper channels (confirming who prescribed it, in whose name, and whether it was genuinely dispensed) rather than taken at face value.

Where an employee has a verified, legitimate prescription and tests positive, this should be recorded as a verified negative by the Medical Review Officer. That is not the end of the story, though. A separate fitness-for-work assessment still needs to consider the specific safety-critical nature of the role, in the same way it would for any other prescribed medication that could affect performance, such as a sedating drug prescribed for epilepsy.

The Legal Picture Is Shifting

A recent Employment Appeal Tribunal (EAT) case, Truman v SPL Powerlines UK Ltd, Network Rail Infrastructure Ltd and Express Medicals Ltd [2026] EAT 54, is a useful illustration of how much can go wrong when policies aren't applied carefully.

Mr Truman held a valid prescription for privately prescribed cannabis to manage chronic pain from haemochromatosis, a disability. He disclosed his prescription during a pre-employment drug and alcohol test for a safety-critical rail role. Network Rail's own policy allowed a positive result to be recorded as a "pass" where there was a legitimate medical explanation, but the testing provider recorded a "fail" without contacting him first, triggering an automatic five-year ban from safety-critical rail work.

The original tribunal found that, had the policy been correctly applied, Mr Truman's result should have been a pass, and that he had suffered an "injustice." However, the tribunal still dismissed his discrimination claims, in part because the requirement to pass drug and alcohol screening was treated as a safety-related "competence standard" under the Equality Act. On appeal, the EAT upheld that particular finding, but ruled that the tribunal's reasoning on a separate reasonable adjustments claim against Network Rail was inadequate, and sent that part of the case back for reconsideration. In other words, the outcome is more nuanced than a simple win or loss for either side, and the door remains open on the reasonable adjustments question.

The case is a strong practical reminder: a positive drug test should never automatically end the process where prescribed medication may be relevant, and engaging with the employee before recording a result matters.

Practical Steps for Your Drug and Alcohol Policy

1. Define your terms. Spell out separately what your policy says about CBD, privately prescribed cannabis, and BNF-listed cannabis-based medicines. Don't let "medicinal cannabis" cover all three ambiguously.

2. Build in verification. If someone claims a prescription, check it. Who prescribed it, in whose name, and can dispensing be confirmed?

3. Separate "verified negative" from "fit for work." A legitimate prescription doesn't automatically clear someone for a safety-critical role; a fitness assessment specific to the job still needs to happen.

4. Don't accept vaping as a substitute for smoking. Legally, vaping is not the same as smoking cannabis, and only medical-grade vaporisers would be relevant to a genuine prescription-based claim.

5. Treat CBD and food/drink products as unreliable "medical" explanations. Neither is regulated or labelled to the standard of a licensed medicine, and neither is intended or permitted to treat or prevent any medical condition.

6. Invest in education, for both employees and managers, on what these products actually are, what they can and can't do, and why label claims can't always be trusted.

The Bottom Line

Cannabis in the workplace is not going away, and the legal and regulatory landscape is still moving. What's clear right now is that laboratories cannot distinguish illegal cannabis from a private prescription, CBD is a supplement rather than a medicine, and the safest approach for employers is a policy that's specific, well-defined, and applied consistently and fairly to every case.

This article reflects current guidance as understood at the time of writing. Given how quickly this area is developing, employers should keep policies under regular review.

Stay Compliant with Evolving Workplace Health Guidance

Drug and alcohol policies need to keep pace with changing legislation, medical treatments and workplace risks. Insight Workplace Health provides expert occupational health advice to help employers develop robust policies, support employees fairly and make informed fitness for work decisions.

Get in touch with our team today to find out how we can support your organisation.