Last updated: 25 August 2026.
A certificate of analysis, or COA, is the third-party lab report showing what is actually in a CBD product. A valid one names the lab, matches the batch number on your bottle, is dated within the last twelve months, and reports cannabinoid potency plus tests for pesticides, heavy metals, residual solvents and microbials. Anything missing those is not a COA, it is marketing.
Why the COA matters more than the label
Label claims on CBD products are not verified before sale the way pharmaceutical labelling is. Independent testing has repeatedly found products containing meaningfully more or less CBD than stated, and occasionally THC in products sold as THC-free. The COA is the only document that closes that gap, and reading one takes about two minutes once you know the layout.
The first checks, before you read any numbers
- Batch number match. The number on the report must match the number printed on your bottle or box. A generic company-wide COA proves nothing about the unit in your hand.
- Report date. Within twelve months. Cannabinoids degrade, and an old report describes a product that no longer exists.
- Independent lab. A named third-party laboratory with a contactable address, ideally ISO 17025 accredited. In-house testing is a conflict of interest.
- Product name match. The report should name the same product and strength you bought, not a neighbouring SKU.
If any of those four fail, stop. Nothing further on the report is worth your attention.
Section one: cannabinoid potency
This is the table people look at first. It lists each cannabinoid with a concentration, usually in mg per gram or mg per millilitre, plus a total per container.
| Term | What it means |
|---|---|
| CBD | The active cannabinoid you are paying for |
| CBDa | The raw acidic form, converts to CBD with heat |
| Total CBD | CBD plus a conversion factor applied to CBDa |
| Delta-9 THC | Must be at or below 0.3% by dry weight for US hemp |
| THCa | The acidic precursor, converts to THC when heated |
| Total THC | Delta-9 plus converted THCa, the figure regulators increasingly use |
| ND or <LOQ | Not detected, or below the limit of quantification |
| LOD / LOQ | The lowest amount the instrument can detect or reliably measure |
The 10 percent rule
Compare the total CBD on the report against the label claim. A well-made product lands within roughly 10 percent either way. A 1,000mg bottle testing at 940mg is normal manufacturing variance. One testing at 600mg is a different product from the one you were sold.
Broad spectrum and isolate
If the label says THC-free, the THC line should read ND or below the limit of quantification. Any measurable delta-9 in a product marketed as THC-free is a labelling failure, and it matters for anyone facing a drug test.
Section two: the contaminant panels
Potency alone is half a COA. A complete report carries four safety panels, each with a pass or fail against a stated limit.
| Panel | What it screens for | Why it matters |
|---|---|---|
| Pesticides | Agricultural chemical residues | Hemp is grown outdoors at scale; residues concentrate during extraction |
| Heavy metals | Lead, arsenic, cadmium, mercury | Hemp is a bioaccumulator, it draws metals out of soil |
| Residual solvents | Ethanol, butane, propane and similar | Confirms the extraction solvent was properly purged |
| Microbials | Mould, yeast, E. coli, salmonella | Contamination from harvest, drying or storage |
Hemp’s bioaccumulation is the point most buyers miss. The same property that makes the plant useful for soil remediation makes the heavy metals panel non-negotiable.
Extras worth having
- Terpene profile. Not a safety test, but it tells you whether a full spectrum product genuinely retained its aromatics.
- Mycotoxins. Sometimes broken out separately from microbials, screening for mould byproducts.
- Water activity. Relevant for flower, it predicts mould risk in storage.
Red flags on a COA
- No batch number, or a batch number that does not match your product
- Potency panel only, with no contaminant testing at all
- A report older than a year, or with no date
- Lab name absent, or the lab is the brand itself
- An image of a report rather than a downloadable PDF, which is trivially editable
- Total CBD more than 10 percent off the label claim
- Measurable delta-9 THC on a product sold as THC-free
- A QR code that leads to a marketing page instead of a report
Frequently asked questions
What is a COA for CBD?
A third-party laboratory report showing a specific batch’s cannabinoid content and its results for pesticides, heavy metals, residual solvents and microbial contamination.
How recent should a COA be?
Within twelve months, and matched to the batch you bought. Older reports describe product that has since degraded or sold through.
What does ND mean on a lab report?
Not detected. The compound was not found above the instrument’s detection threshold, which is not the same as certainly zero.
Why does total THC differ from delta-9 THC?
Total THC adds the THC that THCa would produce if heated. Regulators are moving toward total THC as the compliance figure, so it is the more conservative number to check.
Can a COA be faked?
Yes, and it happens. Prefer reports hosted on the testing laboratory’s own portal, or verify the batch directly with the named lab.
What if a brand will not provide a COA?
Treat that as your answer and buy elsewhere. Any legitimate brand publishes them without being asked.
