What to Look for on a CBD Lab Report (COA Explained)

A Certificate of Analysis (COA) is a third-party lab document that confirms exactly what's in a CBD product - cannabinoid percentages, contaminant levels, and batch-specific data. If a brand won't share its COA, don't buy the product. Here's how to read one like an expert.

What Is a COA?

A COA, or Certificate of Analysis, is an official document issued by an accredited independent laboratory after testing a specific batch of CBD product. It verifies cannabinoid content, checks for harmful contaminants, and confirms the product matches what's on the label. Reputable brands make their COAs publicly available - either as a downloadable PDF or via a QR code on the product packaging.

The key word is independent. A lab report generated by the brand's own internal team carries no meaningful weight. Look for testing from ISO/IEC 17025-accredited laboratories, which meet internationally recognized standards for accuracy and impartiality.

The 6 Core Sections of a CBD Lab Report

1. Cannabinoid Profile (Potency Panel)

This is the most-read section on any COA. It lists the concentration of every detected cannabinoid, expressed as a percentage (%) or in milligrams per gram (mg/g). The critical numbers to verify:

• CBD (Cannabidiol): Should match or come within ±10% of the label claim. If a product says 1,000 mg per bottle, the lab result should show between 900 mg and 1,100 mg.
• Total THC: Must be ≤0.3% on a dry-weight basis under the U.S. 2018 Farm Bill definition. Products exceeding this threshold are legally hemp-derived marijuana, not hemp.
• CBG, CBN, CBC, CBDV: Minor cannabinoids increasingly present in broad-spectrum and full-spectrum products. Their presence supports the entourage effect.
• THCA: A precursor to THC. Some COAs calculate "Total THC" as THC + (THCA × 0.877) - the decarboxylation formula. Confirm which calculation the lab uses.

2. Terpene Profile

Not every COA includes terpene data, but premium full-spectrum and broad-spectrum products often include it. Terpenes like myrcene, linalool, limonene, and beta-caryophyllene influence the product's aroma, flavor, and potentially its therapeutic character. If terpene content is a selling point on the label, the COA should back it up with specific mg/g figures.

3. Residual Solvents

CBD extraction commonly uses ethanol, CO₂, butane, or propane. Residual solvent testing confirms that no harmful amounts of these chemicals remain in the final product. The COA should show all tested solvents fall below USP class limits. Common solvents to check:

• Ethanol: Class 3 solvent, limit 5,000 ppm
• Butane: Class 3 solvent, limit 5,000 ppm
• Benzene: Class 1 carcinogen, limit 2 ppm - any detection is a red flag
• Hexane: Class 2 solvent, limit 290 ppm

4. Heavy Metals

Hemp is a bioaccumulator - it draws heavy metals from soil into the plant tissue. Every COA for a finished CBD product should include heavy metals testing for at least these four elements, measured in micrograms per gram (µg/g) or parts per million (ppm):

Metal USP Oral Limit (µg/day) What to See on COA Lead (Pb) 5 µg/day ND or well below action level Arsenic (As) 15 µg/day ND or well below action level Cadmium (Cd) 5 µg/day ND or well below action level Mercury (Hg) 30 µg/day ND or well below action level

"ND" stands for Not Detected, which is the result you want across all four.

5. Microbial Contaminants

Microbial testing checks for dangerous pathogens - bacteria, mold, and yeast - that can survive the extraction process and cause serious harm, especially to immunocompromised users. A clean COA will show passing results (or ND) for:

• Total Yeast and Mold Count (TYMC)
• Total Aerobic Microbial Count (TAMC)
• E. coli and Salmonella spp. - must read "Not Detected" or "Absent"
• Bile-tolerant gram-negative bacteria

6. Pesticides

Conventional hemp farming uses pesticides that can concentrate in extracted oil. The pesticide panel tests for dozens of compounds including organophosphates, pyrethroids, and fungicides. Any result above the action level set by the testing state's department of agriculture - or California's stricter CDFA limits - is a fail. Look for a clear "Pass" designation on the COA or individual "ND" results across the full panel.

COA Red Flags: 7 Warning Signs

1. No batch number or lot number: A COA without a traceable batch number can't be linked to the product you're holding. It may be outdated or fabricated.
2. Test date older than 12 months: Cannabinoid potency degrades over time. COAs should reflect the current production batch.
3. Missing contaminant panels: A cannabinoid-only COA is incomplete. Real safety verification requires metals, pesticides, microbials, and solvents.
4. Lab not ISO/IEC 17025 accredited: Verify the lab's accreditation independently on the A2LA or PJLA databases, not just by taking the brand's word for it.
5. CBD content more than 20% below label claim: Significant underdosing suggests either poor manufacturing or deliberate mislabeling.
6. Total THC above 0.3%: This is both a legal issue and a disclosure failure - especially relevant for consumers subject to drug testing.
7. COA only available upon request (not public): Transparency is the standard. Brands that obscure their lab results have something to hide.

Full-Spectrum vs. Broad-Spectrum vs. Isolate: What the COA Should Show

Product Type THC on COA Minor Cannabinoids Terpenes Expected Full-Spectrum Up to 0.3% (detectable) Yes - CBG, CBN, CBC, etc. Yes Broad-Spectrum ND (non-detectable) Yes - CBG, CBN, CBC, etc. Often yes CBD Isolate ND ND or trace No

If a brand labels a product "broad-spectrum" but the COA shows detectable THC, the label is inaccurate. If it claims "full-spectrum" but shows only CBD and nothing else, question the extraction method.

How to Verify a COA Is Legitimate

Don't stop at reading the document - verify it. Most accredited labs (SC Labs, ProVerde Laboratories, Kaycha Labs, ACS Laboratory) publish completed COAs on their own websites with searchable batch numbers. Enter the sample ID or batch number directly on the lab's portal to confirm the document matches what the brand posted. If the numbers don't align, report it to your state's department of agriculture or the FDA's MedWatch program.

Matching the COA to Your Product

Once you have a verified COA, cross-reference three things before you open the product:

1. Batch or lot number- must match what's printed on your bottle or packaging.
2. Product name and format- a tincture COA doesn't apply to gummies from the same brand.
3. Net weight or volume- a 30 mL tincture and a 60 mL tincture will have different total milligram counts even at the same concentration.

What does "ND" mean on a CBD lab report?

ND stands for "Not Detected." It means the laboratory's instruments did not detect the substance at or above the method's limit of detection (LOD). For contaminants like heavy metals, pesticides, and pathogens, ND is the result you want to see across every line item.

How often should a CBD brand update its COA?

Every new production batch requires a new COA. For high-volume brands, that can mean monthly updates. At minimum, a COA should never be more than 12 months old for any product still on sale. Cannabinoid potency degrades, and older reports don't reflect the product's current state.

Is a COA the same as FDA approval for CBD?

No. A COA is a third-party lab verification of contents and safety - it is not FDA approval or endorsement. The FDA has not approved CBD as a dietary supplement as of 2026. A COA confirms what's in the product; it does not confirm any health claims the brand makes about it.

What's the difference between Total CBD and CBD on a lab report?

CBD refers to the cannabidiol already present in its active form. Total CBD includes CBDA (cannabidiolic acid, the raw precursor) converted using the decarboxylation formula: Total CBD = CBD + (CBDA × 0.877). For oral products like oils and gummies, the Total CBD figure is the more meaningful number for dosage purposes.

Can a product pass a COA and still be unsafe?

A COA is only as comprehensive as the panels the brand ordered. A product could pass cannabinoid and residual solvent testing but still contain pesticide residues or heavy metals if those panels were skipped. Always confirm the COA covers all four major contaminant categories: heavy metals, pesticides, microbial contaminants, and residual solvents before trusting the results.