How to Read a Hemp Lab Report (COA)

Short answer: a certificate of analysis (COA) is a lab report for one specific batch of product. The three things that matter most are the batch number and test date, the cannabinoid panel in milligrams (not just percentages), and the contaminant panels — solvents, pesticides, heavy metals, microbials and mycotoxins. A COA without a batch number is a marketing document, not a test result.

Last reviewed: November 4, 2026. 420Grades does not manufacture products and does not generate lab reports. This page explains how to read the certificates that brands publish, and how to tell whether one is worth trusting.

What a COA actually is

A certificate of analysis is the output of a laboratory test on a sample. It records what was submitted, when it was tested, which method was used, and what the lab found.

The important word is sample. A COA tells you what was in the material the lab received. It does not automatically tell you what is in the package you bought. That gap — between the tested sample and the shipped product — is where most of the risk in this market lives.

The five sections to check, in order

1. Sample identification

Look for:

  • Product name that matches what you are buying
  • Batch or lot number that matches the package
  • Date the sample was received and tested
  • Who submitted it — the brand, a distributor, or the lab itself

If the COA has no batch number, stop there. You cannot connect it to your product. A COA for “Delta-8 Gummies” in general is not evidence about the gummies in your hand.

Also check the date. A two-year-old COA describes a batch that has almost certainly sold out. Cannabinoid content degrades and formulations change.

2. The cannabinoid panel

This is the part everyone reads and most people misread.

Labs usually report both percentage by weight and milligrams per unit. Percentages are useful for comparing raw material; milligrams are what you actually consume.

Example: a gummy weighs about 4 grams. A report showing 0.25% delta-8 means:

4,000 mg × 0.0025 = 10 mg delta-8 per gummy

That is a reasonable dose. A report showing 0.025% on the same gummy is 1 mg — barely anything, despite the label saying “delta-8” in large letters.

Check that the lab reports the cannabinoid separately. A blended product should show delta-8, delta-9, THCP, CBD and so on as individual numbers. A single “total cannabinoids” figure hides what you are taking.

3. Total THC versus delta-9 THC

This distinction became legally important in 2026.

Older COAs report delta-9 THC alone, because that was the only number federal law cared about. Under the amended hemp definition taking effect December 11, 2026, the standard becomes total THC — delta-9 plus THCA after decarboxylation — capped at 0.3% dry weight, with an additional limit of 0.4 mg total THC per container.

So a product can pass an old-style delta-9 test and still fail the total-THC standard. When you look at a COA, check whether it reports THCA and whether it gives a total. See the 2026 hemp law explained and the THCA guide.

4. Contaminant panels

Potency is the easy part. These panels are the ones that matter for safety:

  • Residual solvents — critical for any cannabinoid produced by chemical conversion (delta-8, delta-10, HHC, THCO, THCP). The conversion uses solvents and acids; sloppy processing leaves residues.
  • Pesticides — relevant for flower and for extracts made from outdoor material.
  • Heavy metals — lead, arsenic, cadmium, mercury. Soil and equipment sources.
  • Microbials — total yeast and mould, E. coli, salmonella.
  • Mycotoxins — aflatoxins and ochratoxin, mainly for flower and plant material.

Each panel should say Pass or Not detected, with a limit of quantification. A COA that simply omits contaminants is not a clean COA — it is an incomplete one.

5. The laboratory

Three questions:

  1. Is the lab real and independent? It should not be owned by the brand.
  2. Is it accredited? Look for ISO/IEC 17025 accreditation, which is the international standard for testing laboratories.
  3. Can you verify the report? Many labs publish results in their own portal, often behind a QR code on the COA. A PDF that exists only on the brand’s website, with no way to verify it at the lab, is weaker evidence.

You can also check whether the lab is licensed by the state agriculture or health department that regulates hemp testing where it operates.

Red flags

  • No batch number, or a batch number that does not match the package
  • No date, or a date older than the product
  • Only “total cannabinoids” reported, with no individual values
  • Percentages only, with no milligrams per unit
  • No contaminant panels at all
  • A report for a different product name or a different strength
  • A lab that shares an address with the brand
  • A screenshot of a COA instead of the original PDF

How to ask a brand for a COA

Keep it specific. A vague request gets a vague answer:

Can you send the certificate of analysis for the batch I would receive, with the batch number, the cannabinoid panel in mg per unit, and the residual solvent, heavy metal, microbial and mycotoxin results? Which lab tested it, and can I verify the report in the lab’s portal?

If a brand cannot answer those questions, that is the answer.

Why this matters more in 2026

The federal definition changes twice: November 12, 2026 excludes cannabinoids the plant cannot naturally produce, which removes HHC and THCO from hemp; December 11, 2026 adds the total-THC standard and the 0.4 mg per-container cap, and excludes naturally occurring cannabinoids manufactured outside the plant.

Both changes are enforced through testing. A brand that cannot produce a compliant COA is a brand with a legal problem, not just a documentation gap.

Frequently asked questions

What does COA stand for?

Certificate of analysis — a laboratory report describing the contents of a specific sample.

Is a COA required by law?

Requirements vary by state and by product type. Most regulated cannabis and hemp markets require testing for potency and contaminants; the specifics differ. Federal hemp rules also require pre-harvest THC testing for cultivators.

Can a COA be faked?

Yes. PDFs can be edited, and screenshots can be fabricated. The strongest check is verifying the report directly with the laboratory that issued it.

Does a COA guarantee the product is safe?

No. It shows that one sample passed the tests the lab ran on the date listed. It reduces risk; it does not eliminate it.

What is LOQ on a lab report?

Limit of quantification — the lowest amount the method can reliably measure. “Below LOQ” means the substance was not detected at a measurable level.

Why do some COAs report THCA separately?

Because THCA converts to THC when heated. Total THC calculations include THCA so the number reflects what you actually absorb when smoking or vaping.

Related guides

Sources

  • Public Law 119-37 §781; Public Law 119-103 §2019
  • Congressional Research Service, Changes to the Statutory Definition of Hemp (IF13136)
  • ISO/IEC 17025 — general requirements for the competence of testing and calibration laboratories

Educational information only. Not medical or legal advice.