A Certificate of Analysis is the only thing standing between a marketing claim and a measured fact. Most people never ask for one, and most who do can't read it. Here's how to do both — and how to spot the ones that aren't worth the PDF they're printed on.
A Certificate of Analysis is a lab report on one sample from one batch, taken on one date. That sentence contains every limitation worth knowing.
The lab tested a small sample pulled from a specific batch at a specific moment. It says nothing about the jar in your hand unless the batch number matches, and nothing about how the product was handled after testing. Potency and terpenes both decline with age; contamination can be introduced after the fact.
A COA from an unaccredited lab, or one run as "R&D" rather than compliance testing, carries far less weight. The document looks identical either way. Who signed it and under what accreditation matters as much as the numbers on it.
The most common trick isn't a faked number — it's a missing panel. A potency-only COA presented as proof of safety tells you nothing about pesticides, solvents, metals or mold. Check what wasn't tested before you read what was.
A COA is worth trusting when an accredited third-party lab tested a batch you can match to your package, recently, across every panel relevant to that product type — and you can verify the report came from the lab rather than from the seller's design department.
The request is easy • the response tells you everything
You're entitled to ask, and a good seller has it ready. How they respond is itself a data point — often a more useful one than the document.
That's your answer. In regulated cannabis markets, batch testing is mandatory and the retailer can access it. In the hemp market, testing obligations are thinner and enforcement is uneven — which is exactly why the burden falls on you. A seller who can't or won't show a COA is asking you to take an unverifiable claim on faith about something you plan to inhale or eat.
Below is an annotated example. The numbered markers correspond to the explanations that follow — work through them once and you'll never need to again.
Illustrative example. "Northgate Analytics," the certificate numbers and all results above are invented for teaching purposes and do not represent a real laboratory, a real batch, or a real product.
Why "total THC" isn't what the biggest number says
In the living plant almost all THC exists as THCA, an acidic form that isn't intoxicating. Heat converts it to Δ9-THC, shedding a carbon dioxide molecule and therefore some weight. The 0.877 factor accounts for that loss.
The same arithmetic applies to CBD: Total CBD = CBD + (CBDA × 0.877)
Our specimen COA reports Δ9-THC at 0.82% and THCA at 71.40%:
Note what happens if you skip the math: THCA alone reads 71.40%, which is roughly eight points higher than the honest figure. Labels quoting the raw THCA number aren't lying, exactly — but they aren't telling you total THC either.
1% = 10 mg/g. So 63.44% is 634.4 mg/g. For edibles and tinctures, per-serving and per-container milligram figures matter more than percentages — and that's the number regulators are increasingly writing rules around.
Watch for percentages quoted as-received versus dry weight. Removing moisture concentrates everything, so dry-weight numbers are higher. When a result sits close to a legal limit, which basis was used stops being academic.
Not every panel matters for every product. Knowing which are essential for what you're buying is the difference between reading a COA and understanding one.
| Panel | What it looks for, and why | Flower | Solventless hash & rosin | Solvent extract & distillate | Vape cart |
|---|---|---|---|---|---|
| Cannabinoid potency | The cannabinoid list and the calculated totals. Establishes both what you're getting and, for hemp, whether the product is legal at all. | ● | ● | ● | ● |
| Terpenes | Aroma and flavour compounds, plus the best available proxy for freshness and careful handling. Not a safety test. | ○ | ○ | ○ | ○ |
| Pesticides | Agricultural chemicals, typically dozens of analytes. Matters most for anything inhaled, because combustion and vaporisation can generate more harmful breakdown products. Extraction concentrates pesticides along with everything else. | ● | ● | ● | ● |
| Residual solvents | Butane, propane, ethanol, hexane and similar left behind after extraction. Genuinely inapplicable to ice water hash and rosin, which use only water, heat and pressure. | — | — | ● | ● |
| Heavy metals | Usually lead, arsenic, cadmium and mercury. Cannabis readily takes up metals from soil, and for vapes there's a second pathway: metals leaching from the cartridge hardware itself, especially when heated. | ● | ● | ● | ● |
| Microbials | Pathogens such as Salmonella, certain E. coli, and Aspergillus species. Most relevant to flower and to unprocessed material; a real concern for anyone immunocompromised. | ● | ● | ○ | ○ |
| Mycotoxins | Toxins produced by mould — aflatoxins and ochratoxin A. They survive processing that kills the mould that made them, so a clean microbial result doesn't cover this. | ● | ● | ● | ● |
| Water activity & moisture | How much free water is available for microbial growth. A flower result at or below roughly 0.65 aw is the usual benchmark for storage stability. Predicts whether mould can develop after testing. | ● | ○ | — | — |
| Foreign matter | Visual inspection for hair, insects, insect frass, mould and debris. Unglamorous, occasionally decisive. | ● | ○ | — | — |
There is no single national pass/fail table. Each regulated market publishes its own analyte lists and thresholds, and they differ substantially — California's inhalable pesticide list, for instance, is far longer than some states', and heavy-metal limits are tighter for inhaled products than for edibles. A "Pass" therefore means "passed the standard this lab applied," which is why the panel and analyte counts matter as much as the verdict. Check the rules where you live rather than assuming the strictest state's limits applied.
Almost every misreading of a COA traces back to one of these. They're simple once stated plainly.
The smallest amount the instrument can reliably tell apart from nothing at all. Below this, the lab can't say whether the substance is present.
The smallest amount the lab can put a trustworthy number on. Always at or above the LOD. Results between the two are real but not reliably measurable, often shown as "<LOQ" or "trace."
Not detected at this lab's detection limit. It is not a synonym for zero, and it is not a guarantee of absence — it's a statement about the instrument's reach.
If Lab A reports 21 terpenes down to 0.01% and Lab B reports 12 down to 0.05%, Lab A will show a higher total from the identical sample — without either lab being wrong. The same applies to cannabinoid totals and to contaminant panels: a shorter analyte list finds fewer problems. Before concluding one product is cleaner or louder than another, check that the two reports were even asking the same questions.
What to check, in order, in about ninety seconds
A PDF proves nothing on its own — anyone can make one. These five steps move you from "I have a document" to "I have confirmation," and the first two take under a minute.
Read the lot or batch number off the physical product and compare it character by character with the COA. If they differ, or the package carries no batch number at all, nothing else on the document applies to what you bought. Do this before anything else.
Scan the code or type the lab's URL yourself rather than following a link the seller supplied. Enter the sample ID and compare what the lab shows against what you were sent. Any discrepancy is decisive. Be aware that a QR code can be printed to point anywhere, so confirm the domain belongs to the lab.
Take the ISO/IEC 17025 certificate number to the accrediting body's public directory — A2LA, PJLA, ANAB and Perry Johnson all publish searchable registers. Confirm the lab is listed, that the accreditation is current, and that its scope actually covers cannabis or hemp testing. Accreditation is issued for specific methods, not as a general seal.
Labs field these requests routinely. Email the sample ID and ask whether the report is theirs and whether the results match. It costs you two minutes and it defeats forgery entirely, because it's the one step a seller can't intercept.
Open the PDF and look for signs of editing: inconsistent fonts within a table, numbers that don't sum, decimal places that vary between rows, a total THC figure that doesn't reconcile with the Δ9-THC and THCA values using the formula above. Run that calculation yourself — it's the fastest arithmetic test of whether a potency table is internally coherent.
Where cannabis is legal and regulated, testing is mandatory and product moves through a state track-and-trace system such as Metrc, with batch data tied to the licence. Dispensary staff can pull the COA for a specific batch on request. The hemp market has no equivalent backbone, which is the structural reason hemp COA problems are more common — not that hemp is inherently worse, but that far less is checked by anyone other than you.
For ice water hash and rosin, the residual solvent panel should read N/A with the reason stated — there was never a solvent involved. Treat an explicit "not applicable, solventless process" as a good sign and an unexplained blank as sloppiness.
What deserves closer attention instead: total terpene content, since it's the clearest available proxy for careful, cold handling; microbials and mycotoxins, because water-based extraction doesn't sterilise anything and toxins carry through; and pesticides, because extraction concentrates whatever the plant carried.
Also check the matrix field says what you're buying. A COA for the source flower is useful context but is not a COA for the rosin pressed from it.
Under the 2018 Farm Bill, hemp has been defined by Δ9-THC at or below 0.3% on a dry weight basis. That single number explains why hemp COAs foreground Δ9-THC so heavily.
Legislation signed in November 2025 narrows that definition considerably, moving to a total THC standard and adding a per-container milligram cap for consumable products, with the change taking effect in November 2026. Because total THC counts THCA as well, products that comfortably passed the old test can fail the new one without any change in formulation.
Implementation details and enforcement have been actively contested, and rules may differ in your state regardless. This is general information, not legal advice — verify the current position where you live before relying on it.
"It has a COA, so it's safe."
A COA is a test result, not a verdict. It's only meaningful if the lab was accredited, the batch matches your package, the relevant panels were actually run, and the date is recent. A potency-only COA from an unaccredited lab on a two-year-old batch is a document, not an assurance.
"The highest THC number on the shelf is the strongest product."
Often it's the number most favourable to whoever chose the lab. Potency inflation is a documented, well-studied problem across several markets, driven by producers being able to select both the sample and the testing laboratory. Treat outlier-high potency as a reason for scepticism rather than excitement.
"ND means there's none in there."
It means none was found above that lab's detection limit. A lab with a higher limit reports ND more often. Absence of detection is not detection of absence — and the limit is usually printed right next to the result.
"Hemp products are federally legal, so they're federally regulated for safety."
These are separate things. Hemp's legal status under the 2018 Farm Bill did not create a mandatory consumer-safety testing regime comparable to state cannabis programmes, and published surveys have repeatedly found hemp and CBD products whose contents didn't match their labels. That gap is the entire reason this page exists.
Sellers who expect the question keep better records. The more people ask, the better the whole market gets.
See This Week's Menu ↗ Terpenes 101 ↗ Legal 101 ↗