The cannabinoid aisle runs largely on trust, and not every brand earns it. Two products can carry near-identical labels while one is exactly what it claims and the other is over-labeled, under-tested, or contaminated. The good news is that you do not have to take a brand’s word for it. One document lets you check the product yourself: the Certificate of Analysis (COA). This guide explains how to read one. It is general educational information, not health or legal advice.
This is general educational information. It is not medical advice, and nothing here is a claim that any product diagnoses, treats, cures, or prevents a condition. Intended for adults 21 and older.
What a COA is
A Certificate of Analysis is a lab report for a specific batch of product. It records what an independent laboratory found when it tested that lot: how much of each cannabinoid is present, whether the delta-9 THC is within the legal limit, and whether the product is free of contaminants.
The key phrase is third-party tested. That means the lab is independent of the company selling the product, so it has no incentive to flatter the result. A COA from the manufacturer’s own lab is better than nothing, but a third-party COA from an ISO/IEC 17025-accredited lab is the standard to look for. A trustworthy brand makes the current lot’s COA easy to find, linked right from the product page or a dedicated lab-results page.
The cannabinoid potency section
This is the heart of a cannabinoid COA. It lists each cannabinoid the lab measured, usually as a percentage and as milligrams per unit. Check two things.
Does the potency match the label? If the bottle says 25 mg of CBD per serving, the COA should support that. Wildly over- or under-labeled products are a quality red flag.
Is the delta-9 THC within the limit? For a hemp product, the report must show delta-9 THC at or below 0.3% by dry weight. This is the line that makes the product legal hemp. For an intoxicating product, the COA also shows how much THC you are actually getting per serving, which is exactly what you need to dose responsibly and start low.
A careful note on THCa: because THCa converts to delta-9 THC when heated, a flower COA that looks compliant on delta-9 alone can still behave very differently once combusted. A good COA reports both delta-9 and THCa so nothing is hidden.
The contaminant panels
Cannabinoids are extracted from a plant grown in soil and processed in a facility, so a complete COA tests for what could come along for the ride.
- Heavy metals. Lead, arsenic, cadmium, and mercury can accumulate in the plant. A good COA shows these tested and within safe limits.
- Pesticides. Confirms no concerning agricultural chemicals carried through.
- Residual solvents. Extraction can use solvents; this panel confirms they were removed to safe levels.
- Microbials. Tests for things like mold, yeast, E. coli, and salmonella confirm the product is safe to consume.
You do not need to interpret every number. You are looking for each panel to be present and marked PASS (or within limits).
Matching the COA to your bottle
This is the step most people skip, and it is the one that matters most. A COA only means something if it matches the product in your hand.
- The batch or lot number on the COA should match the one printed on your package.
- The test date should be reasonably recent. A common quality rule is that a COA older than a year is stale.
- The product name on the report should match the product.
A brand that publishes a per-lot COA and lets you match it is showing real confidence. A brand that shows one generic, undated certificate for everything is not telling you much.
A quick reading checklist
- Find the COA. If you cannot, that is your answer.
- Confirm it is third-party, ideally from an ISO/IEC 17025-accredited lab, not the brand’s own.
- Match the batch. The lot number on the COA should match your package, and the date should be recent.
- Read the potency. Cannabinoid milligrams match the label; delta-9 THC at or under 0.3% (and THCa reported for flower).
- Scan the panels. Heavy metals, pesticides, residual solvents, and microbials each present and within limits.
Red flags
If you see several of these together, slow down:
- No COA available anywhere, or one that will not load.
- A COA with no batch number, no date, or no lab name.
- Potency that does not match the label, or a delta-9 result over 0.3% on a hemp product.
- Missing contaminant panels.
- A single generic, undated certificate used for every product.
- Health claims that promise to treat, cure, or prevent a disease. Legitimate products use structure/function wellness language and carry the standard FDA disclaimer.
Quick FAQ
What does third-party tested mean? The lab is independent of the seller, so it has no stake in the result. Independence is what makes the number trustworthy.
How recent should a COA be? Recent enough to reflect your batch. A common rule of thumb is to be cautious of a COA older than a year.
Why does the delta-9 number matter so much? Because the 0.3%-by-dry-weight delta-9 line is what legally separates hemp from marijuana, and on intoxicating products it tells you how much THC you are getting per serving.
These statements have not been evaluated by the Food and Drug Administration. These products are not intended to diagnose, treat, cure, or prevent any disease. Intended for adults 21 and older. Keep out of reach of children and pets.