A CBD certificate of analysis (COA) is a lab report that verifies what’s in a batch of CBD product: how much CBD and THC it contains, and that it’s free of heavy metals, pesticides, residual solvents, and microbes. The most trusted CBD brands make a COA available for every batch, often through a QR code right on the label. It’s how they back up what their labels say, and it’s what retailers and customers increasingly look for before they buy.
This guide is written for brands that work with CBD wholesalers or manufacturers. It covers what a COA should include, how to read each section, the red flags to watch for, and how to put your COA on your product label.
Key takeaways
- A COA should come from an independent, ISO/IEC 17025–accredited lab, not the manufacturer’s own lab.
- The batch or lot number on the COA must match the product. A COA for a different batch proves nothing.
- Check total THC, not just delta-9 THC: total THC = delta-9 THC + (0.877 × THCA).
- A full-panel COA covers cannabinoids plus heavy metals, pesticides, residual solvents, microbials, and mycotoxins.
- Put a QR code on your label that links to the current batch’s COA, and confirm what your state requires.
What is a Certificate of Analysis?
A certificate of analysis (COA) is a report from an independent, accredited laboratory that lists the test results for one specific batch of product. For CBD, a COA confirms the cannabinoid content, including how much CBD and THC the product contains, and screens for contaminants. Manufacturers typically test every production batch and give the COA to the brands they supply. Brands then make it available to retailers and consumers.
Many states require CBD and hemp product labels to include a QR code or URL that links to the batch’s COA, along with other required label information. Requirements vary by state and change often, so check your state’s current rules before you print. Our guide on how to label your CBD product covers the other label essentials.
What Information Should a CBD COA Include?
A complete, trustworthy COA should include all of the following:
- The lab’s name, address, and accreditation (look for ISO/IEC 17025)
- The client’s name (the manufacturer or brand that submitted the sample)
- The product name and batch or lot number
- A sample ID and the dates the sample was received, tested, and reported
- The test methods used, such as HPLC for cannabinoids
- Results with units and the limit of quantitation (LOQ) for each test
- A pass or fail status against the applicable limits
- A signature from the lab director or analyst
How to Read a CBD Certificate of Analysis
Lab report layouts vary, but most CBD COAs follow the same structure: a header with the sample and lab details, a cannabinoid profile, and a series of contaminant panels. Here’s how to read each part.
Cannabinoid Types
The cannabinoid profile lists each compound the lab tested for, such as CBD, CBDA, delta-9 THC, THCA, CBG, CBN, and CBC. A full-spectrum product should show CBD plus a range of minor cannabinoids, including trace THC. A broad-spectrum product should show several cannabinoids but no detectable THC. A CBD isolate should show CBD and very little else. If a result reads “ND” (not detected) or “<LOQ” (below the limit of quantitation), the lab either didn’t find that compound or found too little to measure reliably.
Weight Percentage
This column, usually just to the right of the cannabinoid list, shows how much of the sample’s weight each cannabinoid makes up. For example, 0.25% CBD means CBD is 0.25% of the sample’s total weight. Federal THC limits for hemp are expressed this way: no more than 0.3% THC on a dry-weight basis.
Concentration
Concentration is usually reported in milligrams per gram (mg/g) or milligrams per milliliter (mg/mL). Since 1% equals 10 mg/g, a result of 0.25% is the same as 2.5 mg/g. To check a label claim, multiply the concentration by the product’s total weight or volume: a 30 mL tincture that tests at 33.3 mg/mL contains about 1,000 mg of CBD. Many COAs do this math for you and report mg per serving or mg per package. That number should match what’s printed on your label.
Total THC
Most COAs list both delta-9 THC and THCA, the acidic form of THC that converts to delta-9 THC when heated. Regulators now look at total THC, calculated as delta-9 THC + (0.877 × THCA). A product can show a low delta-9 number and still exceed legal limits once THCA is counted, so find the total THC line on the report, or calculate it yourself.
Heavy Metal Analysis
Heavy metal testing screens for arsenic, cadmium, lead, and mercury, which hemp plants can absorb from the soil they’re grown in. Ingesting heavy metals above safe levels can make people sick. Each result should be listed next to an action limit (the maximum amount allowed) with a pass or fail status. Results below the limit, or marked ND, are what you want to see.
Pesticide Analysis
You aren’t the only one interested in hemp. Insects are too, so growers sometimes use pesticides that can leave residue in the final product. Pesticide panels often test for dozens of compounds. Look for a pass status on every line, and confirm the panel was actually run. Some COAs only include cannabinoid results.
Residual Solvents
Many CBD extracts are made using solvents such as ethanol, butane, or propane. This panel confirms that any solvent left in the finished extract is below safe limits. CO2-extracted products may show few or no residual solvents.
Microbials and Mycotoxins
Microbial testing screens for harmful bacteria, yeast, and mold, such as E. coli, Salmonella, and Aspergillus. Mycotoxin testing looks for toxins produced by mold, such as aflatoxins and ochratoxin A. These panels matter most for products people ingest, like tinctures, gummies, and beverages.
What to Check in Your Supplier’s COA
Your brand’s name goes on the label, so the COA behind it needs to hold up. Here’s what to check before you put your brand on a product.
1. Too Much THC, or None Where There Should Be Some
Too much THC can make a product illegal to sell. Under federal law, hemp must contain no more than 0.3% total THC on a dry-weight basis, and a federal change scheduled to take effect in late 2026 also caps finished hemp-derived products at 0.4 mg of total THC per container. Many states set their own limits on top of that. Compare total THC, not just delta-9 THC, against both federal and state rules. On the other hand, a product sold as full-spectrum that shows no THC at all may not be what it claims to be.
2. “Full-Spectrum” Products Missing Cannabinoids
A big reason customers choose full-spectrum CBD is the range of other cannabinoids and terpenes that come with it. If a “full-spectrum” product’s COA shows only CBD, the product may actually be an isolate, and your label claim would be inaccurate.
3. Lab Results Completed In-House
The highest-quality manufacturers send a sample from every batch to an independent, third-party lab. A COA from the manufacturer’s own lab has an obvious conflict of interest. Check that the lab is named on the report, that it holds ISO/IEC 17025 accreditation, and that it isn’t owned by the company selling the product.
4. Batch Numbers or Dates That Don’t Match
A COA only applies to the batch that was tested. If the batch or lot number on the report doesn’t match the product, or the report is more than a year old, it tells you nothing about what you’re actually buying. Ask your supplier for the COA that matches your batch.
5. Missing Contaminant Panels
A cannabinoids-only COA confirms potency but says nothing about safety. Ask for a full-panel COA that covers heavy metals, pesticides, residual solvents, microbials, and mycotoxins.
6. A Report You Can’t Verify
COAs are PDFs, and PDFs are easy to edit. Many labs let you verify a report on their website using the sample ID or a QR code printed on the COA. If you can’t confirm the report with the lab directly, treat it with caution.
Why a CBD COA is Essential for Selling Your Product
Retailers, distributors, and online marketplaces increasingly require a current COA before they’ll carry a CBD product, and savvy consumers expect to see one before they buy. Payment processors and e-commerce platforms may ask for COAs too. A clean, current COA for every batch makes it easier to get your product onto shelves and keep it there.
How to Put Your COA on Your Product Label
The most common approach is a QR code on the label that opens the COA for that batch. A few practical tips: point the QR code to a page you control, like a COA lookup page on your website, so you can update the destination without reprinting labels. Print the batch or lot number near the QR code so customers can match the product to the right report. And scan-test every QR code on a proof before your full print run. In a crowded market, an easy-to-find COA is one of the clearest signals of quality you can give a customer.
CBD Certificate of Analysis FAQ
What does COA stand for in CBD?
What does COA stand for in CBD?
How can I tell if a CBD COA is legitimate?
How can I tell if a CBD COA is legitimate?
What is the legal THC limit for CBD products?
What is the legal THC limit for CBD products?
How often should CBD products be tested?
How often should CBD products be tested?
What does ND mean on a COA?
What does ND mean on a COA?
Does my CBD label need a QR code that links to the COA?
Does my CBD label need a QR code that links to the COA?
We’ve worked with a variety of companies using CBD wholesale distributors, helping them create packaging labels that stand out. Our team is happy to answer any questions you have about CBD labeling and help you choose the best type of label for your CBD products.
You might also like: