A Certificate of Analysis is the only thing standing between a marketing claim and a measured fact. Most people never ask for one, and most who do can't read it. Here's how to do both, and how to spot the ones that aren't worth the PDF they're printed on.
No COA, no sale.
Here's a sample certificate with 16 red stickers on it. Tap one to see what that part means. Work through them once and you'll never need to again.
| Analyte | Result % | mg/g | LOQ |
|---|---|---|---|
| Δ9-THC | 0.82 | 8.2 | 0.01 |
| THCA | 71.40 | 714.0 | 0.01 |
| CBD | 0.11 | 1.1 | 0.01 |
| CBDA | 0.24 | 2.4 | 0.01 |
| CBG / CBGA | 1.06 | 10.6 | 0.01 |
| Δ8-THC | ND | ND | 0.01 |
| Total THC | 63.44 | 634.4 | — |
| Total cannabinoids | 64.82 | 648.2 | — |
| Panel | Analytes | Detected | Result |
|---|---|---|---|
| Pesticides | 66 | 0 | Pass |
| Residual solvents | — | — | N/A |
| Heavy metals | 4 | 1 | Pass |
| Microbials | 5 | 0 | Pass |
| Mycotoxins | 5 | 0 | Pass |
| Water activity | 0.52 aw | — | Pass |
Methods: AOAC-based, in-house validated. Results relate only to the sample as received. This report may not be reproduced except in full.
Approved by: D. Okonkwo, Laboratory Director. Electronic signature on file.
Verify at northgate-analytics.example/verify using sample ID.
Illustrative example. "Northgate Analytics," the certificate numbers and all results above are invented for teaching purposes and do not represent a real laboratory, a real batch, or a real product.
start with no. 3
If you only read one sticker, make it the batch number. Then these are the ones that catch most of the nonsense:
Stickers you've opened turn a darker red, so you can tell what's left.
This is an illustrative example, not a real certificate. Every field on it is explained in the stickers.
A lab report on one sample from one batch, taken on one date. That sentence contains every limitation worth knowing.
It says nothing about the jar in your hand unless the batch number matches, and nothing about how the product was handled after testing. Potency and terpenes both decline with age, and contamination can be introduced after the fact.
A COA from an unaccredited lab, or one run as "R&D" rather than compliance testing, carries far less weight. The document looks identical either way. Who signed it, and under what accreditation, matters as much as the numbers.
The most common trick isn't a faked number. It's a missing panel. A potency-only COA presented as proof of safety tells you nothing about pesticides, solvents, metals or mold. Check what wasn't tested before you read what was.
The one-sentence version.A COA is worth trusting when an accredited third-party lab tested a batch you can match to your package, recently, across every panel relevant to that product type, and you can verify the report came from the lab rather than from the seller's design department.
Why "total THC" isn't what the biggest number says. Punch in the two numbers from any COA.
In the living plant almost all THC exists as THCA, an acidic form that isn't intoxicating. Heat converts it to Δ9-THC, shedding a carbon dioxide molecule and therefore some weight. The 0.877 factor accounts for that loss.
1% = 10 mg/g. So 63.44% is 634.4 mg/g. For edibles and tinctures, per-serving and per-container milligram figures matter more than percentages, and that's the number regulators are increasingly writing rules around.
Watch for percentages quoted as-received versus dry weight. Removing moisture concentrates everything, so dry-weight numbers are higher. When a result sits close to a legal limit, which basis was used stops being academic.
You're entitled to ask, and a good seller has it ready. How they respond is itself a data point, often a more useful one than the document.
Hi, I'd like to see the COA for this product before I order. Could you send: 1. The full panel COA, not potency only 2. For batch/lot the jar will ship with 3. The lab's name and accreditation 4. A link or QR to the lab's own portal Thanks.
If they won't produce one, that's your answer.In regulated cannabis markets, batch testing is mandatory and the retailer can access it. In the hemp market, testing obligations are thinner and enforcement is uneven, which is exactly why the burden falls on you. A seller who can't or won't show a COA is asking you to take an unverifiable claim on faith about something you plan to inhale or eat.
Open the COA next to this list and tick what you see. One stop sign is enough to walk.
Open whichever one you need. Nobody has to read all of these.
Knowing which panels are essential for what you're buying is the difference between reading a COA and understanding one.
There is no single national pass/fail table. Each regulated market publishes its own analyte lists and thresholds, and they differ substantially. California's inhalable pesticide list, for instance, is far longer than some states', and heavy-metal limits are tighter for inhaled products than for edibles. A "Pass" therefore means "passed the standard this lab applied," which is why the panel and analyte counts matter as much as the verdict. Check the rules where you live rather than assuming the strictest state's limits applied.
The smallest amount the instrument can reliably tell apart from nothing at all. Below this, the lab can't say whether the substance is present.
The smallest amount the lab can put a trustworthy number on. Always at or above the LOD. Results between the two are real but not reliably measurable, often shown as "<LOQ" or "trace."
Not detected at this lab's detection limit. It is not a synonym for zero, and it is not a guarantee of absence. It's a statement about the instrument's reach.
If Lab A reports 21 terpenes down to 0.01% and Lab B reports 12 down to 0.05%, Lab A will show a higher total from the identical sample, without either lab being wrong. The same applies to cannabinoid totals and to contaminant panels: a shorter analyte list finds fewer problems. Before concluding one product is cleaner or louder than another, check that the two reports were even asking the same questions.
A PDF proves nothing on its own. Anyone can make one. These steps move you from "I have a document" to "I have confirmation."
Read the lot or batch number off the physical product and compare it character by character with the COA. If they differ, or the package carries no batch number at all, nothing else on the document applies to what you bought. Do this before anything else.
Scan the code or type the lab's URL yourself rather than following a link the seller supplied. Enter the sample ID and compare what the lab shows against what you were sent. Any discrepancy is decisive. Be aware that a QR code can be printed to point anywhere, so confirm the domain belongs to the lab.
Take the ISO/IEC 17025 certificate number to the accrediting body's public directory. A2LA, PJLA, ANAB and Perry Johnson all publish searchable registers. Confirm the lab is listed, that the accreditation is current, and that its scope actually covers cannabis or hemp testing. Accreditation is issued for specific methods, not as a general seal.
Labs field these requests routinely. Email the sample ID and ask whether the report is theirs and whether the results match. It costs you two minutes and it defeats forgery entirely, because it's the one step a seller can't intercept.
Open the PDF and look for signs of editing: inconsistent fonts within a table, numbers that don't sum, decimal places that vary between rows, a total THC figure that doesn't reconcile with the Δ9-THC and THCA values. Run the potency math yourself. It's the fastest test of whether a potency table is internally coherent.
Where cannabis is legal and regulated, testing is mandatory and product moves through a state track-and-trace system such as Metrc, with batch data tied to the license. Dispensary staff can pull the COA for a specific batch on request. The hemp market has no equivalent backbone, which is the structural reason hemp COA problems are more common. Not that hemp is inherently worse, but far less is checked by anyone other than you.
For ice water hash and rosin, the residual solvent panel should read N/A with the reason stated, since there was never a solvent involved. Treat an explicit "not applicable, solventless process" as a good sign and an unexplained blank as sloppiness.
What deserves closer attention instead: total terpene content, since it's the clearest available proxy for careful, cold handling; microbials and mycotoxins, because water-based extraction doesn't sterilize anything and toxins carry through; and pesticides, because extraction concentrates whatever the plant carried.
Also check the matrix field says what you're buying. A COA for the source flower is useful context but is not a COA for the rosin pressed from it.
Under the 2018 Farm Bill, hemp has been defined by Δ9-THC at or below 0.3% on a dry weight basis. That single number explains why hemp COAs foreground Δ9-THC so heavily.
Legislation signed in November 2025 narrows that definition considerably, moving to a total THC standard and adding a per-container milligram cap for consumable products, with the change taking effect December 11, 2026 after a signed one-month delay (synthetic cannabinoids are excluded from that delay and are still set to lose hemp status on the original November 12, 2026 date). Because total THC counts THCA as well, products that comfortably passed the old test can fail the new one without any change in formulation.
Implementation details and enforcement have been actively contested, and rules may differ in your state regardless. This is general information, not legal advice. Verify the current position where you live before relying on it. Our Legal page has more.
Sellers who expect the question keep better records. The more people ask, the better the whole market gets.
Educational information only. This page is for adults 21 and over. Nothing here is medical advice or legal advice, and nothing here is a claim that any product prevents, treats or cures any condition. It is a general guide to reading laboratory documentation, not a substitute for professional or regulatory guidance.
The certificate shown on this page is an illustrative teaching example. "Northgate Analytics LLC," the accreditation and license numbers, the sample and batch identifiers, the verification URL and every result displayed are invented and do not represent any real laboratory, batch, product or measurement.
Testing requirements, analyte lists, action limits, permitted methods and reporting conventions are set by individual jurisdictions and differ substantially between them. Figures and thresholds mentioned here are general reference points, not the rules that apply to you. A "Pass" on any certificate reflects only the standard the issuing laboratory applied. Verify the requirements and product legality in your own jurisdiction before relying on anything above.
The federal definition of hemp is changing, with legislation signed in November 2025 taking effect December 11, 2026; implementation details, timing and enforcement have been subject to ongoing dispute and may have moved since this page was written. Confirm the current position independently. If you are pregnant, nursing, taking medication or managing a health condition, talk to a qualified clinician before using cannabis or hemp products.
Adults 21+ only. A COA describes one sample from one batch, so match it to your package and check your local rules before you buy. Not medical or legal advice.