By Marcus Reid | Last updated: July 13, 2026
A Certificate of Analysis is the single most important document in the CBD industry. It is the only way to verify that a product contains what the label claims and nothing it should not. Understanding how to read one takes about five minutes and protects you from mislabeled, contaminated, or ineffective products.
What Is a CBD Certificate of Analysis?
A COA is a document produced by an independent, third-party laboratory that has tested a specific batch of CBD product. It is not produced by the brand itself. A legitimate COA comes from an external lab with no financial relationship to the CBD company, using validated analytical methods to measure what the product actually contains.
The key word is third-party. In-house testing by the manufacturer is not a COA. A legitimate COA comes from an accredited external lab and carries that lab’s name, accreditation number, and contact details so buyers can verify authenticity.
The 5 Things to Check on Every CBD COA
1. CBD Potency – Does It Match the Label?
The COA will show the measured CBD content per serving and per container. Compare this to the label. A reasonable tolerance is plus or minus 10 to 20 percent – minor variation is normal in botanical products. A variance of 30 percent or more in either direction is a red flag. Some products, particularly cheaper imports, have been found to contain significantly less CBD than labeled.
2. THC Level – Is It Below 0.3%?
For full-spectrum products, THC should appear on the COA at or below 0.3% by dry weight – the US federal legal limit. For broad-spectrum products, the COA should show THC as “ND” (non-detectable) or below the limit of quantification. For isolate, THC should be absent entirely. If a product claims to be THC-free but the COA shows detectable THC, avoid it. For more on extract types, see: Full Spectrum vs Broad Spectrum vs CBD Isolate.
3. Contaminant Panel – Pesticides, Heavy Metals, Residual Solvents
A comprehensive COA includes a contaminant panel showing results for:
- Pesticides – Hemp is a bioaccumulator that absorbs compounds from soil. USDA organic certified hemp is preferred. Look for “pass” or “ND” (non-detectable) across the pesticide panel.
- Heavy metals – Lead, arsenic, cadmium, and mercury should all be ND or below safety thresholds. These accumulate in hemp grown in contaminated soil.
- Residual solvents – Ethanol and CO2 extraction can leave trace solvents. These should be at or below USP limits.
- Microbials – E. coli, salmonella, and mold/yeast counts should all pass. Important for gummies and other ingestible products.
4. Batch Number – Is It Specific to Your Product?
A legitimate COA will carry a batch or lot number that matches the product you purchased. Some brands post a single generic COA that does not correspond to any specific production run – this is meaningless. Your COA should be traceable to the exact batch of product in your hands. If the brand cannot provide a batch-specific COA, treat it as a red flag.
5. Lab Accreditation – Is It ISO 17025?
ISO 17025 is the international standard for testing laboratory competence. An accredited lab has been independently audited to confirm its testing methods are valid and its results are reliable. Check that the COA includes the lab’s name and accreditation number, and verify it against the accrediting body’s public database if needed.
COA Red Flags to Watch For
| Red Flag | What It Means |
|---|---|
| No COA available | Brand is hiding what is in the product |
| COA from the brand’s own lab | Not independent – not a real third-party COA |
| No batch number on COA | Generic document, not linked to your product |
| COA older than 12 months | Does not reflect current production standards |
| THC above 0.3% on full-spectrum | Illegal in most US states |
| No contaminant panel | Incomplete testing – only potency tested |
| Lab not ISO 17025 accredited | Results may not be reliable |
Where to Find a CBD Product’s COA
Reputable brands make COAs easy to find. Common locations: the product page itself, a dedicated “Lab Results” or “Transparency” page, or by scanning a QR code on the product packaging. If you cannot find a COA after a reasonable search and the brand does not respond to a direct request, choose a different product. For guidance on choosing a trustworthy CBD product, see: How to Choose a CBD Product: Complete Buyer’s Guide.
Frequently Asked Questions
What does ND mean on a CBD COA?
ND stands for non-detectable – the compound is either absent or present below the lab’s detection limit. For THC in broad-spectrum products and for all contaminants (pesticides, heavy metals), ND is the result you want to see.
Can a CBD COA be faked?
Technically yes, though it is uncommon among established brands. To verify a COA, contact the testing lab directly using contact details from their own website (not from the brand’s website) and provide the batch number for confirmation. Reputable brands welcome this verification.
Does every CBD product need a COA?
Any ingestible CBD product intended for human consumption should have a current, batch-specific COA from an ISO-accredited lab. This applies to oils, gummies, capsules, and topicals. There is no federal requirement in the US that mandates COAs, but any reputable brand will provide them voluntarily as a mark of quality and transparency.
