Last updated 24 August 2026 · Originally published 30 July 2019
A CBD certificate of analysis, or COA, is the lab report for a sample taken from one batch of a product. It tells you how much CBD and THC that sample contained when tested, and whether it was checked for pesticides, heavy metals, solvents and mould. Almost every guide to buying CBD, including our own, tells you to check the COA. Very few explain how, so this is that article.
Why the label alone is not enough
Labels are wrong often enough to make a COA necessary. A review published in June 2026 pooled 28 studies covering 937 retail CBD products. Only 31% contained an amount of CBD within 10% of the label. Oils did best at 41%; topicals did worst at 14%.
The largest of those studies, a 2024 analysis of 202 American products, found three-quarters more than 10% off their stated CBD, one in four mislabelled as full spectrum, broad spectrum or isolate, and heavy metals detected in 44 products, five of them over the study’s comparison limits. One caution: that study was sponsored by Jazz Pharmaceuticals, which makes prescription CBD, and the company was involved in its design, analysis and writing. That does not make the results wrong, but the interest should be visible.
None of this is new. The 2017 study this article originally reported on found THC in 18 of 84 products bought online. The picture has not changed; it has just been measured more carefully.
What a COA is, and what it is not
A CBD certificate of analysis is a snapshot. It describes one batch on one day, as tested by one laboratory. It is not a certificate of quality, and it is not a guarantee that the bottle in your hand matches it. Its value depends entirely on whether you can connect it to your product and trust the lab that produced it. Those are the two things to check, and they come before any of the numbers.
First, match it to your bottle
Find the batch or lot number on your packaging. It is usually printed or stamped near the expiry date. Now find the batch number on the COA. If they match, you are reading a report from the same batch as your product. If they do not, or the COA has no batch number at all, you are reading a report about something else.
Two common mismatches are worth naming. The first is an old COA: a report from 2023 attached to a product made this year tells you what a previous batch contained. The second is a COA for an ingredient rather than the finished product. A gummy that links to a COA for “CBD isolate, 99.7%” is showing you the test on the raw powder that went into the recipe, not the test on the gummy. It says nothing about how much of that powder ended up in each piece, or whether the gummies were mixed evenly. The 2024 study found gummies among the least accurate products, although it could not establish why.
Check the date as well. Anything more than a year old should make you ask whether the company is still testing.
Then read the cannabinoid table
This is the part most COAs lead with, and it is the part most people stop at. It lists each cannabinoid the lab looked for, with a result for each. Three things to look for.
The CBD figure, in the same units as the label. Oils are usually reported in milligrams per millilitre. Gummies and capsules should be reported per piece. If the COA gives a percentage and the label gives milligrams, you will need to do the conversion yourself, and a company that makes you do that has not made it easy. Compare the measured figure with the label claim. Within 10% either way is the standard the research uses, and it is a fair one for a plant extract. Twenty per cent off is a problem. Fifty per cent off means the label is fiction.
CBD versus CBDA. Some COAs list both. CBDA is the acid form found in the raw plant, which converts to CBD when heated. A product that claims 1,000 mg of CBD but whose COA shows most of that as CBDA is a different product from the one on the label, and a less well studied one. Look for a line marked “total CBD” and check how it was calculated. Total CBD is normally worked out as CBD plus 0.877 times the CBDA. The factor accounts for the mass lost when CBDA releases carbon dioxide during conversion. If the laboratory has simply added CBD and CBDA together, the total is overstated.
THC. You will usually see “ND”, meaning not detected, or “<LOQ”, meaning below the smallest amount the lab can reliably measure. Those are not the same thing, and the difference matters if you are drug tested or want to avoid THC entirely — we go through it in what “THC-free” really means. A full spectrum product will show a THC figure. Multiply it by the size of the container to get the total THC in the bottle. Under current law, that total will matter from 12 November 2026, when finished products containing more than 0.4 mg combined total of THC and THC-like cannabinoids per container lose federal hemp status. The Senate has passed a proposal that would postpone most of the change until 11 December, but the House has not agreed and the delay is not yet law. Many current full spectrum oils will be over the limit either way — we cover it in the November 2026 hemp law change.
The cannabinoid table also lets you test the spectrum claim, although these terms have no single federal definition. Under ordinary industry usage, full spectrum should contain CBD plus several other plant cannabinoids and may show measurable THC. Broad spectrum should retain several cannabinoids with THC removed to non-detectable levels. Isolate should contain CBD and almost nothing else. A “full spectrum” product whose COA shows CBD alone does not provide much support for the claim. Our guide to the three spectrums covers the distinctions in more detail.
Then look for the safety panels, and notice if they are missing
A useful full-panel COA contains more than a cannabinoid table. After the cannabinoids there should be separate sections for pesticides, heavy metals, residual solvents and microbes, and often mycotoxins. Each section lists what was tested for, the limit applied, the result and whether it passed.
Many COAs stop at the cannabinoid table. That is a potency report, not a certificate of analysis, and it tells you nothing about what else is in the bottle. Given that the 2024 study detected heavy metals in roughly one product in five, and found five products over its comparison limits, this is the page you most want to see. If a company publishes potency only, ask for the rest. If they cannot provide it, you have no evidence that it was tested.
On the heavy metals panel, “pass” is only meaningful if the limits are stated. Lead, arsenic, cadmium and mercury are the four most commonly included. On solvents, look for what the product was extracted with. If the manufacturer says ethanol or hydrocarbons, the panel should show any remaining solvent is below the applicable limit. CO2 extraction leaves no extraction solvent, although other solvents may still be used later in processing.
Then check the lab
The COA should name the laboratory, give its address and contact details, and carry a report number. The lab should be independent of the company selling the product, and it should be accredited, usually to the ISO/IEC 17025 standard, and its accreditation scope should cover the cannabinoid and contaminant tests shown on the report. Accreditation is not a guarantee of honesty, but its absence is a reason to walk away.
Better still, verify the report on the lab’s own website. Many labs let you look up a report by number or scan a QR code, which takes you to the lab’s copy rather than the company’s. This is the strongest check available to a consumer that the PDF you were given has not been edited. If the QR code takes you to the company’s own website, it has proved nothing.
Labs themselves are not beyond doubt. California has revoked or cancelled the licences of several cannabis testing laboratories, and in one 2024 case regulators alleged that a laboratory had manipulated equipment and records, reported a banned pesticide as “non-detected” and repeatedly inflated THC results. The state cancelled its licence. That was the licensed cannabis market, which is far more supervised than hemp CBD. The lesson transfers. A COA is only as good as the lab, and the lab is only as good as whoever is checking it. The NIST effort to standardise cannabis testing exists because labs testing the same sample were getting different answers.
Signs that a COA is not doing its job
A CBD certificate of analysis is not doing its job if it has no batch number, or a batch number that does not match yours. A test date more than a year old. A cannabinoid table with no contaminant panels. No lab name, or a lab that does not appear to exist outside the COA. A QR code that leads to the seller. A report for an ingredient standing in for a report on the product. Results that match the label exactly across different batches, which real measurements rarely do.
What a COA cannot tell you
A COA does not tell you whether the product will do anything for you. That depends on the dose, and for many of the medical effects claimed for CBD, retail servings of 10 to 25 mg remain below the doses used in controlled trials, which is a reason for caution about what those trials can promise rather than a reason to take more — we set out what the trials actually used separately. A COA also cannot tell you how much of the CBD you swallow will reach your bloodstream, which for oral CBD is a fraction of the labelled dose.
A good COA gives you the best available evidence about what was in a sample from your product’s batch. It does not guarantee that every bottle is identical, and it cannot tell you whether the product will work. But it helps answer the narrow question: is this product reasonably close to what it claims to be? For a substance sold without consistent federal product standards or premarket verification, that is not a small thing to know. It is the difference between taking a measured dose and taking a guess.
Nothing in this article is medical advice. If you take prescription medication, speak to a doctor or pharmacist before using CBD, as it can interact with a range of common drugs.
Podcast: Play in new window | Download
