A CBD lab report, formally called a Certificate of Analysis (COA), is a document that tells you exactly what’s in a CBD product and whether it’s safe to use. Every reputable CBD brand makes these available, but they’re packed with technical data that can be confusing at first glance. Once you know what each section means and which numbers actually matter, you can evaluate any CBD product in about two minutes.
Finding and Verifying the COA
Before diving into the numbers, make sure the COA you’re reading actually belongs to your specific product. Most CBD products include a batch number on the label, and many now feature a QR code you can scan with your phone’s camera. Scanning it should pull up the COA for that exact batch. Check that the batch ID printed on your product matches the one listed on the COA. If they don’t match, you may be looking at results from a different production run.
If there’s no QR code, check the brand’s website. Most companies host their lab results on a dedicated page where you can search by product name or batch number. If you can’t find a COA at all, that’s a red flag worth taking seriously.
Look at the top of the COA for the name of the testing laboratory. Trustworthy labs hold ISO/IEC 17025 accreditation, an international standard that verifies a lab operates competently and generates valid, reproducible results. This accreditation is recognized across countries, so it’s a strong indicator of reliability. Some COAs also list the lab’s state license number. If neither credential appears, the results carry less weight.
Cannabinoid Potency: The Core Numbers
The cannabinoid profile is usually the first and largest section of the report. It lists concentrations of individual cannabinoids, typically in milligrams per gram (mg/g) or as a weight percentage. This is where you confirm whether the product contains what the label claims.
Start with the CBD line. Compare the tested CBD concentration to the amount advertised on the packaging. Some variance is normal in natural products, but if a bottle claims 1,000 mg of CBD and the COA shows 600 mg, you’re being shortchanged. A reasonable margin is roughly 10 to 15 percent above or below the label claim.
You’ll likely see two related entries: CBD and CBDA (cannabidiolic acid). CBDA is the raw, unheated precursor to CBD found naturally in hemp. When heated, CBDA converts to CBD, but the conversion isn’t one-to-one because a portion of the molecule’s weight is lost. Labs calculate the total CBD using a simple formula: total CBD equals the CBD percentage plus the CBDA percentage multiplied by 0.877. If a product lists high CBDA but low CBD, it means the extract hasn’t been fully decarboxylated (heat-processed). This isn’t necessarily bad, but it’s worth knowing.
Full-spectrum products will show small amounts of other cannabinoids like CBG, CBN, and CBC. Broad-spectrum products show those same minor cannabinoids but with THC removed or reduced to undetectable levels. Isolate products should show CBD only, with everything else at zero or near zero.
THC Content and Legal Compliance
The delta-9 THC line on a COA is the one with legal significance. Under the 2018 Farm Bill, hemp is defined as cannabis with a delta-9 THC concentration of no more than 0.3% by dry weight. Any product above that threshold is legally classified as marijuana under federal law, regardless of how it’s marketed.
On the COA, look for the delta-9 THC entry specifically. Some reports also list THCA, which converts to THC when heated, similar to the CBDA-to-CBD relationship. A total THC calculation may appear using the same type of conversion formula. If the total THC exceeds 0.3%, the product fails the legal standard for hemp.
It’s worth noting that federal hemp regulations are shifting. A new law taking effect on November 12, 2026, redefines hemp more strictly, excluding products that contain intoxicating levels of THC. This will replace the current 2018 Farm Bill definition, so the rules around THC content in CBD products are tightening.
Heavy Metals Testing
Hemp is a bioaccumulator, meaning it absorbs substances from the soil efficiently. That includes heavy metals. A COA should test for at least four: arsenic, cadmium, lead, and mercury. Some labs also screen for nickel.
Results are reported in parts per million (ppm), and you want to see numbers well below the action levels. While limits vary somewhat by state, common thresholds for cannabis products are 0.5 ppm for lead, 0.1 ppm for mercury, and 0.5 ppm for nickel. Arsenic and cadmium limits are generally set even lower, in the range of 0.2 to 0.3 ppm. The ideal result for all of these is “not detected” or “ND.” A pass result means the product falls within safe limits, but lower is always better for metals you’re putting into your body regularly.
Pesticide Screening
The pesticide panel is one of the more extensive sections on a COA. Comprehensive tests screen for hundreds of compounds. A UK Food Standards Agency analysis of CBD products, for example, tested each sample against over 400 pesticides.
For most entries, you’ll see results listed as “ND” (not detected) or below the LOQ, which stands for Limit of Quantitation. The LOQ is the smallest amount of a substance the lab’s equipment can reliably measure. A result below the LOQ means that if any trace of that pesticide exists, it’s so small the instruments can’t accurately quantify it. For practical purposes, “below LOQ” and “not detected” both indicate the product is clean for that compound.
A pass or fail designation usually appears at the top of the pesticide section. Any individual pesticide exceeding its allowable limit triggers a failure for the entire panel.
Microbial Contaminants
This section checks for bacteria, yeast, and mold. Results are reported in colony-forming units per gram (CFU/g), which measures how many viable microorganisms are present. The key categories and their typical failure thresholds are:
- Total aerobic count (general bacteria): fails at 100,000 CFU/g
- Total yeast and mold: fails at 10,000 CFU/g
- Total coliforms: fails at 1,000 CFU/g
- Bile-tolerant gram-negative bacteria: fails at 1,000 CFU/g
For dangerous pathogens like Salmonella and pathogenic E. coli, there’s no acceptable level. These are tested on a simple presence or absence basis, and the only passing result is “not detected” in a one-gram sample. Any detection is an automatic failure. If you’re using ingestible CBD products like oils, capsules, or gummies, this section matters especially because these contaminants enter your digestive system directly.
Residual Solvents
CBD extracts are often made using solvents like ethanol, butane, propane, or CO2 to strip cannabinoids from the plant material. The residual solvents section confirms that these chemicals were properly purged from the final product. Results are reported in parts per million, and each solvent has its own allowable limit. CO2 extraction generally leaves fewer residual solvents than hydrocarbon methods, but both can produce clean results when done properly. Look for a “pass” designation or results showing “ND” across the board.
Terpene Profile
Not every COA includes a terpene profile, but many do, especially for full-spectrum products. Terpenes are aromatic compounds that contribute to flavor, scent, and potentially to the overall effects of the product. Results are listed as individual percentages or in mg/g, with a total terpene percentage at the bottom.
In cannabis flower, high-quality products typically contain 2 to 5% total terpenes, with premium strains reaching 6% or higher. In processed CBD products like oils and tinctures, terpene levels are naturally lower because some are lost during extraction. Common terpenes you’ll see listed include myrcene, limonene, linalool, and beta-caryophyllene. This section is less about safety and more about product quality. A richer terpene profile generally indicates a more carefully processed extract.
Red Flags on a COA
Knowing what a good COA looks like makes it easier to spot problems. Be cautious if the report is missing sections entirely, particularly pesticides, heavy metals, or microbial testing. A potency-only COA tells you what’s in the bottle but nothing about whether it’s safe. Watch for COAs that are more than a year old, since they should correspond to the specific batch you purchased, not a test from a previous production cycle.
Other warning signs include a lab name you can’t verify online, no batch number linking the COA to your product, or cannabinoid levels that don’t come close to matching the label. A CBD product that tests 30% or more below its label claim suggests either poor manufacturing or intentional mislabeling. Either way, it’s not a product worth trusting.