What a Certificate of Analysis Actually Confirms
A Certificate of Analysis, or COA, is a lab document, not a guarantee. When it works the way it's supposed to, it tells you that a specific sample, pulled from a specific batch, was tested by a named laboratory on a specific date, and came back with specific potency and contaminant numbers. What it does not automatically tell you is that the bottle, jar, or cart in your hand came from that batch, that the lab was qualified to run the test, or that anything has stayed the same since the sample was taken. Those are separate questions, and this guide walks through how to check each one using only the document itself and a few free public lookups.
If you're trying to figure out whether a product is a counterfeit in the first place — missing labels, no COA link at all, suspiciously low prices — that's a different problem covered in How to Spot Fake CBD Products. This article assumes you already have a COA in front of you and need to know what it can and can't prove.
Step 1: Match the Batch or Lot Number, Not Just the Product Name
Every legitimate COA should list a batch or lot number, along with the product name and the date the sample was taken.[1] That batch number is the link between the document and the physical product — it's what lets the numbers on the page apply to what you're holding, and it's the same identifier state regulators use to identify and recall affected products.[5]
- Find the batch or lot number on the product packaging. It's usually near the expiration date or a QR code.
- Find the batch or lot number on the COA. It should appear near the top, next to the product name.
- Confirm they match exactly. A COA lists a batch or lot number specifically so it can be matched “to the exact product in hand.”[3] A COA for a different batch of the same product doesn't tell you anything about the batch you actually bought.
If the packaging has no batch number at all, or the COA has no batch number, there's nothing to match — treat the document as unverified for that specific product.
Step 2: Check the Testing Lab and Sample Date
A COA should name the licensed testing facility that ran the analysis and the date the sample was collected.[2] Two things are worth checking here:
- Is the lab named at all? A COA that shows numbers but never identifies who produced them isn't verifiable by you or anyone else.
- How old is the sample date? Formulations, sourcing, and manufacturing conditions can change between production runs. A COA from a prior batch, or one that's years old, describes a snapshot — not necessarily what's currently on the shelf.
What lab accreditation means, and what it doesn't. Some testing labs hold ISO/IEC 17025 accreditation, a program that applies to labs performing chemical, microbiological, and related analyses of cannabis and cannabis-derived products, and that verifies a lab has the technical competence, qualified personnel, documented quality systems, and proper equipment to run the specific tests it's accredited for.[4] That's a meaningful, third-party credential about the lab itself. It's a separate question from whether any single COA the lab issued is accurate for the batch in front of you — accreditation speaks to the lab's general competence, not to an individual document. A COA that names an accredited lab is a stronger starting point than one that names no lab at all, but it still has to be matched to the correct batch using the steps above.
It's worth knowing that the testing methods behind these numbers aren't invented by individual labs from scratch. The U.S. Pharmacopeia, a nonprofit standards-setting organization, has published expert-panel testing frameworks covering cannabis identity, cannabinoid and terpene content, and contaminant limits, specifically aimed at reducing inconsistent quality across the cannabis products tested under varying state oversight.[7] A lab that follows recognized methods like these is applying a standardized approach rather than an ad hoc one — though, as with accreditation, that's a statement about method quality, not a guarantee about any single COA's accuracy.
Step 3: Read the Potency Panel Correctly
The cannabinoid or potency section typically lists results for THC, CBD, and often minor cannabinoids like CBG or CBN.[2] A few reading notes that matter:
- Check the units. Potency may be reported as a percentage by weight, as milligrams per gram, or as milligrams per serving/package — and these aren't interchangeable at a glance. A COA reporting “18%” on a concentrate means something different than a label promising “10mg per gummy.”
- Look for both THC and THCA. Raw cannabis and some concentrates contain THCA, which converts to active THC when heated. Some state consumer guidance instructs shoppers to add THCA and THC together to estimate total potency after decarboxylation, rather than reading the THC line alone.[5]
- A number on a COA is a lab result for the tested sample — not a promise about every unit in the batch. Natural variation exists within a single production run, which is part of why the batch-matching step above matters.
Step 4: Read the Contaminant Panel — and Understand “Not Detected”
Separate from potency, a COA should include contaminant testing. Depending on the product and jurisdiction, this can cover pesticides, heavy metals (such as lead and arsenic), microbial contaminants (such as E. coli or Salmonella), residual solvents in concentrates, and mycotoxins.[2] For flower products, moisture content is also commonly tested, since excess moisture is linked to mold growth.[2]
- “ND” or “Not Detected” means the contaminant wasn't found above the lab's detection limit — not that zero amount is present at every possible threshold. Every test has a sensitivity floor.
- A numeric result should be compared against a stated limit, not read in isolation. A COA that shows a pesticide result without indicating the applicable action limit is harder to interpret than one that shows both.
- A full-panel COA that only reports potency, with no contaminant section at all, is telling you what it tested — and, just as importantly, what it didn't.
This is also where regulatory context matters. The FDA has noted that testing of CBD products has found many did not contain the levels of CBD they claimed on the label, and separately, that the agency has been investigating consumer reports of CBD potentially containing unsafe levels of contaminants such as pesticides, heavy metals, and undisclosed THC — adding that a lack of appropriate manufacturing controls can put consumers at additional risk.[6] The same FDA guidance points out that the agency has approved only one CBD product, a prescription drug for seizures, and that it remains illegal under federal law to market CBD by adding it to food or by labeling it as a dietary supplement.[6] None of that means every CBD product is unsafe or that every report of contamination is confirmed — but it's the regulatory backdrop for why the contaminant panel isn't optional reading.
Step 5: Verify the COA Through an Independent Path, Not Just the Link Provided
A PDF hosted on a brand's own website is the easiest document to alter or mismatch. Where possible, look for a QR code on the packaging itself that routes to an independent verification source — the testing lab's own portal, a state track-and-trace lookup, or a state regulator's dashboard — rather than relying solely on a static file linked from a product page. Some state cannabis programs explicitly warn that products sold without an accessible, verifiable COA “may be from unlicensed sources with untested contents.” If a seller can't produce a COA that traces back to an independent source — the lab itself, a state dashboard, or a QR-based verification system — treat that as a gap, not a formality.
What a Certificate of Analysis Does Not Establish
To bring the checklist together, a properly matched, current, contaminant-tested COA tells you that a specific sample from a specific batch, tested by a named lab on a specific date, returned specific results. Even a COA that passes every step above does not establish:
- That the product is safe or effective for your specific health situation. A clean contaminant panel and an accurate potency number are quality and label-accuracy checks, not a medical evaluation.
- That the product is legal to purchase, possess, or use where you live. Testing requirements and legal status vary by state and by product type, and a COA doesn't speak to either.
- Anything about drug testing outcomes. Potency and contaminant results are not a substitute for individualized guidance on drug screening.
- That nothing has changed since the sample date. Sourcing, formulation, and manufacturing conditions can shift between production runs.
When to Talk to a Professional Instead of Relying on the COA Alone
The FDA specifically recommends that consumer use of any CBD product be discussed with a healthcare provider[6] — and that's sound guidance beyond CBD specifically. A COA is a quality and testing document; it isn't a substitute for individualized medical advice, and it can't tell you whether a given product is appropriate for a medication you're taking, a condition you have, or a legal question in your state. For those questions, a healthcare provider, a pharmacist, or your state's licensing agency is the right resource — not the lab report.
What to Do Next
Before you rely on any cannabis or CBD product's Certificate of Analysis, work through the batch match, the lab and sample date, the potency units, and the contaminant panel in that order. If any one of those pieces is missing, outdated, or unverifiable, treat the COA as incomplete rather than as confirmation. For a broader look at how to catch a counterfeit or low-quality product before you even get to the COA stage, see How to Spot Fake CBD Products. For guidance on checking whether a specific product has been recalled, see Cannabis Product Recalls and Safety Alerts.
Sources
- Metrc, “Learn to Read a Cannabis Certificate of Analysis”
- Metrc, “Learn to Read a Cannabis Certificate of Analysis”
- Metrc, “Learn to Read a Cannabis Certificate of Analysis”
- ANAB, “Cannabis Testing” (ISO/IEC 17025 accreditation program)
- Maryland Cannabis Administration, “What's on a Cannabis Label”
- U.S. Food and Drug Administration, “What You Need to Know (And What We're Working to Find Out) About Products Containing Cannabis or Cannabis-derived Compounds”
- U.S. Pharmacopeia, “USP Outlines Plans That Support the Quality of Cannabis for Medical Use”
