Cannabis Laboratory Testing and the Certificate of Analysis
The Certificate of Analysis (CoA) is the gate between manufacturing and the consumer.
In Short
- A complete CoA covers cannabinoid potency (delta-9 THC, THCA, CBD, CBDA, minor cannabinoids), terpene profile (where required), pesticide residues (state-specific…
- Every regulated market requires testing by an ISO 17025-accredited lab; many additionally require state licensure of the lab.
- Most state rules require witnessed sampling — a state-licensed sampler draws the sample from the licensee's batch under defined statistical rules (sample size,…
Every regulated cannabis market — California, Colorado, Massachusetts, Health Canada, EU-GMP, USDA hemp — requires a CoA from an ISO 17025-accredited laboratory before product can be sold. The recurring failure modes are not in the analytical chemistry: they are in sampling, in chain of custody, in retesting after a failure, and in matching the action limit to the right matrix. This guide walks the panel, the sampling rules, the CoA structure and the recurring inspection findings.
The panel: potency, pesticides, metals, microbials, residual solvents
A complete CoA covers cannabinoid potency (delta-9 THC, THCA, CBD, CBDA, minor cannabinoids), terpene profile (where required), pesticide residues (state-specific lists ranging from 13 to 66 analytes), heavy metals (lead, arsenic, cadmium, mercury — and increasingly chromium, copper, nickel for inhalables), microbial contamination (total yeast/mould, Salmonella, STEC, BTGN/E. coli depending on the state), mycotoxins (aflatoxin B1/B2/G1/G2, ochratoxin A) and residual solvents (for extracts — butane, propane, ethanol, hexane, benzene). The action limits differ by matrix (flower vs concentrate vs edible) and by state — a single limit table does not cover the operation.
ISO 17025 and the lab-selection problem
Every regulated market requires testing by an ISO 17025-accredited lab; many additionally require state licensure of the lab. The recurring operator failure is treating all accredited labs as equivalent — they are not.
More on iSO 17025 and the lab-selection problem
Method validation, measurement uncertainty, reference standards and the scope of accreditation vary materially. A lab accredited for potency but not for pesticides cannot release pesticide results under accreditation, regardless of whether the analytical capability exists.
Sampling, chain of custody and the witnessed-sample problem
Most state rules require witnessed sampling — a state-licensed sampler draws the sample from the licensee's batch under defined statistical rules (sample size, increment count, batch size definition). Health Canada and EU-GMP require documented sampling plans tied to batch size.
Common gap. The recurring failure: producer-collected samples used to release product, with no chain-of-custody record between the batch container and the analytical instrument.
More on sampling, chain of custody and the witnessed-sample problem
A regulator reviewing the CoA traces the sample back to the batch — if the trace is incomplete, the CoA is unenforceable.
Out-of-specification results, retest rules and remediation
Most states allow retesting after an OOS result under defined rules: a single retest on a different sample from the same batch, or a remediation pathway (decarboxylation, dilution, blending) followed by retest. The framework is not a free retry — the OOS investigation must conclude either (a) laboratory error invalidates the original result, or (b) the batch is non-conforming and must be remediated or destroyed.
More on out-of-specification results, retest rules and remediation
Releasing an OOS batch on a passing retest without the investigation is the most common enforcement finding in California and Colorado.
CoA structure, public CoA and the consumer-facing record
Many states (California, Massachusetts) require the CoA to be available to the consumer via QR code on the package. The public-facing CoA must match the internal release CoA exactly — differences trigger immediate regulatory attention.
More on coA structure, public CoA and the consumer-facing record
Operators commonly run a separate "marketing" CoA with simplified content; this is the wrong approach. The single CoA must be defensible at both the regulator-facing and consumer-facing layer.
Questions
Can a lab test for THC potency without ISO 17025 accreditation for THC?
The lab can run the analysis, but the result cannot be reported on a regulator-accepted CoA. Accreditation scope is analyte-by-analyte; a lab outside scope must subcontract to an accredited lab for the in-scope CoA.
What is total THC and which states use it?
Total THC = THC + (THCA × 0.877), reflecting the decarboxylation conversion. Most US states label total THC on the package; some (Oregon, Washington) report delta-9 and THCA separately. Mislabelling total THC vs delta-9 is a recurring enforcement finding.
How long is a CoA valid?
Most states require the CoA to be from the specific batch being sold; there is no shelf-life-style CoA validity period. Re-testing for stability is required where the time from CoA to sale exceeds state-defined windows (often 6–12 months).
Does the hemp 0.3% delta-9 limit apply to the CoA?
Yes — for USDA hemp, the CoA must show delta-9 THC ≤0.3% on a dry-weight basis. Crops over the limit must be disposed of or remediated under the USDA framework. See the [USDA hemp guide](/guides/usda-hemp-thc-compliance-readiness).
Practical orientation, not legal advice. Rules differ by jurisdiction; your quality and compliance team decides what applies.
The Cannabis and Hemp Guide
Authorised inputs. Tested batches. Packs that meet your market's rules.
- Which rules reach your product
- Supplier to vault
- Extract, formulate, test, approve
- Pack, trace and respond
Plus Evidence map and four worksheets.
Get the cannabis and hemp guideWe ask for your name and email so we can handle this request. The full guide then opens on this site, ready to translate, print or save. Privacy policy. Practical orientation, not legal advice; your quality unit decides which rules apply.
UltimateFree guide
The Cannabis and Hemp Guide
Authorised inputs. Tested batches. Packs that meet your market's rules.
Keep reading
Global Cannabis Quality & Compliance Readiness Guide
Cannabis Labelling and Child-Resistant Packaging Readiness
US Cannabis State GMP Readiness for Multi-State Operators
Cannabis Traceability and Recall Readiness: Lots, Labs and State Systems
EU GMP for Medicinal Cannabis: GACP, Annex 7 and Herbal Starting Materials
Canada Cannabis Regulations (SOR/2018-144): GPP, Testing, Recall and Labels