Guide

Cannabis Laboratory Testing and the Certificate of Analysis: From Sample to Release

The Certificate of Analysis (CoA) is the gate between manufacturing and the consumer. Every regulated cannabis market — California, Colorado, Massachusetts, Health Canada, EU-GMP, USDA hemp — requires a CoA from an ISO 17025-accredited laboratory before product can be sold. The recurring failure modes are not in the analytical chemistry: they are in sampling, in chain of custody, in retesting after a failure, and in matching the action limit to the right matrix. This guide walks the panel, the sampling rules, the CoA structure and the recurring inspection findings.

Start free trial Free trial, no credit card, onboard in days, not months.

The panel: potency, pesticides, metals, microbials, residual solvents

A complete CoA covers cannabinoid potency (delta-9 THC, THCA, CBD, CBDA, minor cannabinoids), terpene profile (where required), pesticide residues (state-specific lists ranging from 13 to 66 analytes), heavy metals (lead, arsenic, cadmium, mercury — and increasingly chromium, copper, nickel for inhalables), microbial contamination (total yeast/mould, Salmonella, STEC, BTGN/E. coli depending on the state), mycotoxins (aflatoxin B1/B2/G1/G2, ochratoxin A) and residual solvents (for extracts — butane, propane, ethanol, hexane, benzene). The action limits differ by matrix (flower vs concentrate vs edible) and by state — a single limit table does not cover the operation.

ISO 17025 and the lab-selection problem

Every regulated market requires testing by an ISO 17025-accredited lab; many additionally require state licensure of the lab. The recurring operator failure is treating all accredited labs as equivalent — they are not. Method validation, measurement uncertainty, reference standards and the scope of accreditation vary materially. A lab accredited for potency but not for pesticides cannot release pesticide results under accreditation, regardless of whether the analytical capability exists.

Sampling, chain of custody and the witnessed-sample problem

Most state rules require witnessed sampling — a state-licensed sampler draws the sample from the licensee's batch under defined statistical rules (sample size, increment count, batch size definition). Health Canada and EU-GMP require documented sampling plans tied to batch size. The recurring failure: producer-collected samples used to release product, with no chain-of-custody record between the batch container and the analytical instrument. A regulator reviewing the CoA traces the sample back to the batch — if the trace is incomplete, the CoA is unenforceable.

Out-of-specification results, retest rules and remediation

Most states allow retesting after an OOS result under defined rules: a single retest on a different sample from the same batch, or a remediation pathway (decarboxylation, dilution, blending) followed by retest. The framework is not a free retry — the OOS investigation must conclude either (a) laboratory error invalidates the original result, or (b) the batch is non-conforming and must be remediated or destroyed. Releasing an OOS batch on a passing retest without the investigation is the most common enforcement finding in California and Colorado.

CoA structure, public CoA and the consumer-facing record

Many states (California, Massachusetts) require the CoA to be available to the consumer via QR code on the package. The public-facing CoA must match the internal release CoA exactly — differences trigger immediate regulatory attention. Operators commonly run a separate "marketing" CoA with simplified content; this is the wrong approach. The single CoA must be defensible at both the regulator-facing and consumer-facing layer.

Standards covered in this guide

Each standard, retailer code or assurance scheme referenced above has its own deep-dive page with scope, audit detail and common pitfalls.

Where this lives in V5 Ultimate

The clauses above aren't theoretical — every one maps to a shipped module and an industry profile. Jump to the parts of the product that turn this guide into evidence on a Monday morning.

Modules that do the work

Lab accreditation register

Scope-bound CoA acceptance.

OOS investigation workflow

State-specific retest rules pre-loaded.

Sampling and chain of custody

Witnessed sample bound to batch.

Industries this hits hardest

Cannabis

Frequently asked

Can a lab test for THC potency without ISO 17025 accreditation for THC?

The lab can run the analysis, but the result cannot be reported on a regulator-accepted CoA. Accreditation scope is analyte-by-analyte; a lab outside scope must subcontract to an accredited lab for the in-scope CoA.

What is total THC and which states use it?

Total THC = THC + (THCA × 0.877), reflecting the decarboxylation conversion. Most US states label total THC on the package; some (Oregon, Washington) report delta-9 and THCA separately. Mislabelling total THC vs delta-9 is a recurring enforcement finding.

How long is a CoA valid?

Most states require the CoA to be from the specific batch being sold; there is no shelf-life-style CoA validity period. Re-testing for stability is required where the time from CoA to sale exceeds state-defined windows (often 6–12 months).

Does the hemp 0.3% delta-9 limit apply to the CoA?

Yes — for USDA hemp, the CoA must show delta-9 THC ≤0.3% on a dry-weight basis. Crops over the limit must be disposed of or remediated under the USDA framework. See the [USDA hemp guide](/guides/usda-hemp-thc-compliance-readiness).

See it on your shop floor.

Free trial, no credit card, onboard in days, not months.

Start free trial See pricing →Browse all resources →