Lab testing and COAs: how hemp products are tested and how to check the results

What is a certificate of analysis?

A COA is batch-specific. The lab receives a sample identified by a lot or batch number, runs it through validated methods, and reports the results against that identifier. A COA for last year's batch says nothing about the bottle in your hand unless the batch numbers match, which is why batch matching gets its own section below.

The gap a COA closes is large. FDA's report covered 147 products tested for 11 cannabinoids: 18 products (18 percent) contained less than 80 percent of the labeled CBD, 38 (37 percent) contained more than 120 percent, and 72 (49 percent) contained THC or THCA above the lab's limit of quantitation (FDA 2020 report). A 2017 JAMA study of 84 extracts from 31 online sellers found 30.95 percent labeled within 10 percent of the measured value (Bonn-Miller 2017).

Finding the COA is the first step. Most brands link it from a QR code on the package, a lab-results page organized by batch number, or on request by email with the batch number from your label. The document should be a PDF issued by the laboratory, carrying the lab's report number, not a screenshot or a table retyped by the seller. If the only copy available is a brand-formatted summary, ask for the lab's original; a seller that cannot produce it has nothing to show for the batch.

A good COA answers four questions in order. Who tested it, and are they independent and accredited? Which batch, and does it match the package? How much of each cannabinoid, in units you can convert to milligrams per serving and per container? What else is in it, and did every panel pass? The sections that follow take each in turn, and the COA walk-through applies them to a single report line by line.

What does ISO/IEC 17025 accreditation mean?

Accreditation is not the same as certification. NIST explains that accreditation is used to verify that a laboratory has an appropriate quality management system and the technical competence to perform specific tests, and that the accreditation body itself operates under a separate standard, ISO/IEC 17011, for bodies that accredit conformity assessment bodies (NIST NVLAP). A lab receives a Certificate of Accreditation and a Scope of Accreditation after a satisfactory assessment and successful proficiency testing where applicable.

The scope is the part most buyers skip. Accreditation applies to the specific methods and matrices listed in the scope document, not to everything a lab does. A lab accredited for cannabinoid potency in plant material is not automatically accredited for pesticides in gummies. When a COA carries an accreditation logo, the accreditation body's public directory lets you confirm the certificate number and read the scope.

Federal hemp rules add a registration layer for the crop. USDA requires that hemp grown under its program be tested by a laboratory registered with the Drug Enforcement Administration, and the Agricultural Marketing Service is delaying enforcement of that requirement until December 31, 2026 (USDA AMS). That rule governs pre-harvest crop testing; finished-product COAs are governed by state rules and by the buyer's own standards, which is why accreditation status is worth checking on every report.

What does ND mean and what is LOQ?

Two thresholds appear on most reports. The limit of detection (LOD) is the lowest concentration the instrument can distinguish from zero; the LOQ is higher, the lowest concentration the lab will put a number on. Results between LOD and LOQ are often printed as "<LOQ" or "trace." Results below LOD are printed as ND. A COA that shows ND without stating the LOQ in the same units has left out the one number that gives ND its meaning.

Why the LOQ matters is arithmetic. Convert the LOQ from percent to milligrams per gram by multiplying by 10, since 1 percent equals 10 milligrams per gram (7 CFR 990.1, which defines concentration on a dry weight basis). An LOQ of 0.01 percent is 0.1 milligrams per gram; multiplied by a 28 gram fill, the undetectable ceiling is 2.8 milligrams. To prove a 28 gram container is under 0.4 milligrams total THC, the LOQ must be at or below 0.0143 milligrams per gram, about 14 parts per million.

Measurement uncertainty sits on top of all of this. The federal hemp rule defines measurement of uncertainty as the parameter that characterizes the dispersion of values that could reasonably be attributed to the quantity measured, and it uses that spread to decide whether a crop sample's range includes 0.3 percent (7 CFR 990.1). A finished-product COA that states its uncertainty, for example plus or minus 10 percent of the reported value, is telling you how much to trust a result that sits near a limit.

How is total THC calculated?

The 0.877 factor is chemistry, not policy. THCA is a heavier molecule than THC; when heat removes the carboxyl group as carbon dioxide, the mass drops to 87.7 percent of the original. A lab that uses gas chromatography heats the sample and measures total THC directly; a lab that uses liquid chromatography measures THCA and delta-9 THC separately and applies the formula. The federal rule accepts either route and calls the result the post-decarboxylation value (7 CFR 990.1).

This matters because the definition of hemp changed. The 2018 text measured delta-9 THC alone at not more than 0.3 percent on a dry weight basis. Section 781 of Public Law 119-37 replaced it with "a total tetrahydrocannabinols concentration (including tetrahydrocannabinolic acid) of not more than 0.3 percent," effective 365 days after its November 12, 2025 enactment (7 U.S.C. 1639o). A product that passed on delta-9 alone can fail on total THC if it carries THCA.

Read both lines on every potency table. A COA that lists delta-9 THC as ND but THCA at 0.05 percent has a total THC of 0.044 percent, which is 0.44 milligrams per gram, a number that exceeds the per-container cap in any container over 1 gram. The walk-through runs this calculation with real units.

Why does mg per container matter under the 2026 rule?

The timing is set by two statutes. Section 781 takes effect November 12, 2026, 365 days after enactment (7 U.S.C. 1639o). Section 2019 of Public Law 119-103, approved September 2, 2026, provides that until December 11, 2026 the amendments apply only to products containing cannabinoids "not capable of being naturally produced by a Cannabis sativa L. plant" (P.L. 119-103). The per-container cap therefore arrives December 11, 2026.

A percent-only COA cannot show compliance. Take a 30 count gummy jar at 4 grams per gummy, a 120 gram container. Total THC of 0.01 percent is 0.1 milligrams per gram, or 12 milligrams per jar, 30 times the cap. To document compliance for that jar the lab's LOQ must be at or below 0.0033 milligrams per gram, about 3.3 parts per million, and the report must state it. The statute also directs the Secretary of Health and Human Services to publish information on the term "container" (7 U.S.C. 1639o notes); TODO: verify whether that guidance has been published as of October 2026.

The market data show how far typical products sit from the cap. FDA measured THC up to 3.1 milligrams per serving in its 2020 sample (FDA 2020 report), and the 2017 JAMA study found THC up to 6.43 milligrams per milliliter in some extracts (Bonn-Miller 2017). Ask every supplier for total THC in milligrams per innermost container, the LOQ used, and the test date; a COA built for the 0.3 percent crop standard will not answer the 0.4 milligram product standard.

What contaminants are tested?

Heavy metals can enter a product from soil, water and processing equipment. Washington's rule states that "Any product exceeding the provided limits is subject to recall and destruction" (WAC 314-55-102). Limits differ by state and by route of use, so a COA should name the standard it was judged against, not just print "pass."

Residual solvents are the trace of extraction. Washington's limits in micrograms per gram include benzene 2.0, chloroform 2.0, hexanes 290, dichloromethane 600, toluene 890, methanol 3,000, and 5,000 each for acetone, ethanol, ethyl acetate, isopropanol, propane, butanes, heptanes and pentanes (WAC 314-55-102). A CO2-extracted product should show no hydrocarbon solvents; an ethanol-extracted product should show ethanol well under its limit.

Microbial and mycotoxin panels protect against spoilage and mold toxins. Washington requires Salmonella and Shiga toxin-producing E. coli each below 1 colony-forming unit per gram, caps aflatoxins and ochratoxin A at 20 micrograms per kilogram each, and fails flower above a water activity of 0.65 (WAC 314-55-102). Pesticide panels list dozens of compounds with individual action limits; the count and the limits should be printed, not summarized. For finished hemp CBD products sold across state lines there is no single federal panel, so the buyer's standard is the full panel against a named state rule.

How do you match a COA to a batch?

A batch is a defined production unit. Washington defines a batch of extract or infused product as a single run through the extraction or infusion process, requires intermediate products to be homogenized before sampling, and bars sale until the batch's required tests are complete and passed (WAC 314-55-102). A COA for raw distillate is not a COA for the gummy made from it; the finished product is a new batch with its own dilution, its own matrix and its own test.

The sample block carries the chain of custody. Look for the sample ID the lab assigned, the client-supplied batch number, the matrix type (tincture, gummy, topical, distillate), the date received and the date tested. A reputable lab prints all of these. Some labs also print the sample mass or unit count received, which lets you check that the lab tested the retail format rather than a bulk input.

QR codes make matching easy and spoofing easy. A QR code on the package should resolve to a COA hosted by the laboratory, or to a page that links to the lab's own copy, showing the same batch number. A QR code that opens a brand's marketing page, or a PDF with the batch number blanked, is not verification. When the product is one you plan to use for months, save the COA file with the purchase date; the page on COAs lists what to archive.

What are the signs of a weak COA?

Potency-only reports are the most common shortfall. A single cannabinoid table with no pesticide, metal, solvent, microbial or mycotoxin results tells you the dose but nothing about safety. The second most common is the percent-only report: potency in percent with no fill weight or milligrams per unit, which cannot be checked against a per-container THC cap of 0.4 milligrams (P.L. 119-37, section 781).

Internal consistency is a quick test. Milligrams per gram should equal percent times 10. Total THC should equal delta-9 THC plus 0.877 times THCA, using the formula in 7 CFR 990.1. Milligrams per container should equal milligrams per gram times the stated fill weight. If any of these fail, either the lab made an error or someone edited the document after the lab issued it.

Context is the last check. A COA that is more than a year old, that lists a matrix different from the product, that lacks a signature or a reviewer, or that cannot be found on the laboratory's own site is weak regardless of its numbers. Inter-laboratory programs exist because results vary between labs: NIST describes its CannaQAP exercises as "akin to a proficiency testing (PT) scheme but without the pass/fail grade," built to help cannabis labs demonstrate and improve measurement comparability (NIST CannaQAP). A lab that participates in such programs is a lab checking its own work.

How consistent are hemp testing labs with each other?

The program's design tells you what the problem was. Participants identified their sample preparation and analytical methods so that NIST could draw conclusions about potential method biases, results were anonymized, and every exercise report was peer-reviewed and published (NIST CannaQAP). Exercise 2 added toxic elements and moisture in plant material; Exercise 3 covered cannabinoids in plant and oil materials. NIST has stated that CannaQAP will not offer additional exercises.

For a buyer the lesson is to read a COA as a measurement with a spread, not a fixed truth. A potency result within 10 percent of the label is agreement given typical method variation; a result 40 percent off is a labeling problem. The 2017 JAMA study of 84 products classified 42.85 percent as underlabeled and 26.19 percent as overlabeled against a 90 to 110 percent accuracy window (Bonn-Miller 2017).

When two COAs for the same batch disagree, ask which lab is accredited for that matrix, which stated its measurement uncertainty, and which has a lower LOQ. Then ask whether the samples were drawn from the same homogenized batch. Most disagreements trace to sampling, not instruments.

How often should products be retested?

Cannabinoids change in the bottle. In dried cannabis resin held at 50 to 80 degrees Celsius, CBD and THC degraded while CBN formed, and in solution CBD was most stable at pH 4 to 6, with faster breakdown at higher temperature and in acidic conditions (Jaidee 2022). Acid forms such as CBDA decompose with light, air and heat (Citti 2018). A COA from the day of manufacture describes the day of manufacture.

Storage decides how fast the numbers move. The same kinetics work points to the conditions that slow it: lower temperature, a closed container that limits air, protection from light, and a formulation that avoids strongly acidic conditions, since CBD held between pH 4 and 6 was the most stable case measured (Jaidee 2022). A tincture kept in a cupboard at room temperature ages more slowly than one left on a sunny counter, and a retest after a known storage excursion is cheaper than guessing.

CBN is the clock. Because CBN is a degradation product of THC whose level rises as plant material ages (Chousidis 2020), a rising CBN line between the batch COA and a later retest is a direct measure of age and storage. A product that shows CBN where the original COA showed none has been through heat, light or time.

The 2026 rule creates a one-time retest for inventory. Any product still on a shelf on December 11, 2026 is judged against total THC in milligrams per container (P.L. 119-103), and most existing COAs report percent at an LOQ built for the 0.3 percent crop standard. Retesting with a method whose LOQ is low enough to resolve 0.4 milligrams in the actual container, and recording the result per SKU, is the only way to know which products stay inside the definition. The legality cluster tracks the deadlines.