Certificate of Analysis (COA) and Lab Testing Reference

This content is informational. Not medical advice. Consult a healthcare provider.

This reference covers everything needed to interpret cannabis lab test results: what a COA is, how to read each testing panel, potency calculation formulas, annotated COA examples for flower/concentrate/edible products, and a state-by-state testing requirements matrix. It is designed for retailers, catalog managers, migration specialists, and consumers who need to understand and work with cannabis lab data.

Operator-procurement angle: For lab selection, RFP template, evaluation rubric, and named lab footprints by geography, see lab-selection.md. For sampling-to-sellable workflow, failure decision trees, and remediation methods + state labeling rules, see lab-testing-operations.md. This file remains canonical for COA interpretation, testing panels, potency formulas, and annotated COA examples.

Quick Reference

What is a COA? A Certificate of Analysis is a lab-issued document reporting the results of testing performed on a cannabis product sample. It verifies potency, safety, and compliance with state regulations.

Who issues COAs? Third-party testing laboratories accredited under ISO 17025 (or state-specific standards). The lab must be independent from the producer/processor.

When are COAs required? In all legal adult-use and medical cannabis states, COAs are required before a product can be sold at retail. Specific requirements vary by state (see State Testing Matrix below).

Key formula -- Total THC:

Total THC = (THCa x 0.877) + Delta-9-THC

The 0.877 factor accounts for the mass lost when THCa converts to THC during decarboxylation (heating). THCa molecular weight is 358 g/mol; THC is 314 g/mol. Ratio: 314/358 = 0.877.

Key formula -- Total CBD:

Total CBD = (CBDa x 0.877) + CBD

The 10 testing panels:

| Panel | What It Tests | Why It Matters | |-------|---------------|----------------| | Potency | Cannabinoid concentrations (THC, CBD, etc.) | Dosing, labeling accuracy, compliance | | Terpenes | Terpene profile and concentrations | Product quality, strain differentiation | | Pesticides | Residual pesticide chemicals | Consumer safety | | Heavy Metals | Lead, cadmium, arsenic, mercury | Consumer safety, contamination detection | | Microbials | Bacteria, yeast, mold counts | Consumer safety, product integrity | | Mycotoxins | Aflatoxins, ochratoxin A | Consumer safety (carcinogenic compounds) | | Residual Solvents | Butane, propane, ethanol, etc. | Consumer safety (relevant to concentrates) | | Moisture / Water Activity | Moisture content and water activity levels | Mold prevention, shelf stability | | Foreign Material | Hair, mold, insects, glass, packaging debris | Product purity | | Homogeneity | Even distribution of cannabinoids | Consistent dosing (edibles/infused products) |

Cross-references:

• See cannabinoids.md for detailed cannabinoid science referenced in the potency panel
• See terpenes.md for the terpene encyclopedia referenced in the terpene profiling panel

---

What Is a Certificate of Analysis (COA)

Definition and Purpose

A Certificate of Analysis (COA) is an official document issued by a licensed, third-party testing laboratory that reports the results of analytical testing performed on a specific batch of cannabis product. The COA serves as the product's "report card" -- it quantifies what is in the product (cannabinoids, terpenes) and confirms what is not (pesticides, heavy metals, microbial contamination, residual solvents).

Every COA is batch-specific. A single cannabis product may have different COA results for different production batches, because cannabinoid and terpene content varies based on growing conditions, harvest timing, processing methods, and storage.

Who Issues COAs

COAs are issued by third-party testing laboratories that are:

• Independent: The lab cannot be owned by or affiliated with the producer, processor, or retailer
• Licensed: The lab must hold a state cannabis testing license
• Accredited: Most states require ISO 17025 accreditation, the international standard for testing and calibration laboratories
• State-approved: Each state maintains a list of approved testing labs

Major cannabis testing laboratories include SC Labs, Kaycha Labs, Confident Cannabis, Green Leaf Lab, Anresco Laboratories, and ACS Laboratory. Lab quality and consistency vary -- some states have experienced "lab shopping" issues where producers seek labs that report higher potency numbers.

When COAs Are Required

In all legal cannabis markets, testing is required before a product can be sold:

• Pre-sale compliance: Products must pass all required tests before being released for retail sale
• Batch-level testing: Each production batch requires its own COA. A batch is typically defined by the state (e.g., 50 lbs of flower, one extraction run)
• Retesting triggers: Products may require retesting after a specific shelf life period, after remediation (re-processing after a test failure), or if the product is repackaged
• Recall support: COAs provide traceability. If a product is recalled, the COA links the affected product to a specific test result and production batch

Why COAs Matter

For retailers:

• COAs verify that products on the shelf are safe and compliant
• Potency data from COAs populates product labels and menu listings
• COA verification protects against mislabeled or contaminated products from distributors
• Some states require dispensaries to make COAs available to customers upon request

For consumers:

• COAs are the only reliable way to verify what is actually in a cannabis product
• Potency percentages on packaging come directly from COA test results
• Safety panels confirm the product has been tested for contaminants
• Educated consumers can compare terpene profiles across products using COA data

For catalog management and migrations:

• COA data maps to key product attributes: THC%, CBD%, total cannabinoids, terpene profile
• During POS migrations, COA-sourced data is the most reliable product attribute data available
• Missing COA data means product attributes may need manual entry or estimation

Lab Accreditation Standards

ISO 17025: The primary international standard for testing laboratory quality. Requires documented procedures, equipment calibration, staff competency, proficiency testing, and uncertainty measurement. Most states require ISO 17025 accreditation for cannabis testing labs.

State-specific requirements: Some states have additional requirements beyond ISO 17025:

• California requires labs to participate in inter-laboratory comparison programs
• Colorado has a Marijuana Enforcement Division (MED) proficiency testing program
• Oregon requires labs to maintain Scientific Advisory Board certifications

Why accreditation matters: Unaccredited or poorly calibrated labs can produce inaccurate results. "THC inflation" -- where labs report higher potency than the product actually contains -- has been documented in multiple states and erodes consumer trust. Accreditation helps ensure consistent, accurate results.

---

Testing Panels

Potency / Cannabinoid Quantification

What is tested: The concentration of individual cannabinoids in the product sample. A standard potency panel tests for:

• Delta-9-THC -- the primary psychoactive cannabinoid
• THCa -- the acid precursor to THC (converts to THC when heated)
• CBD -- the primary non-psychoactive cannabinoid
• CBDa -- the acid precursor to CBD
• CBG / CBGa -- cannabigerol and its acid form
• CBN -- cannabinol (degradation product of THC; indicates aging)
• CBC -- cannabichromene
• THCV -- tetrahydrocannabivarin (minor cannabinoid, sometimes included)

Expanded panels may also include Delta-8-THC, CBDV, CBL, and other minor cannabinoids. See cannabinoids.md for detailed information on each compound.

Testing method -- HPLC vs GC:

| Method | How It Works | Advantage | Current Use | |--------|-------------|-----------|-------------| | HPLC (High-Performance Liquid Chromatography) | Separates compounds at room temperature in liquid solution | Preserves acid forms (THCa, CBDa) -- can report both acid and neutral forms separately | Current industry standard | | GC (Gas Chromatography) | Separates compounds by heating the sample to vapor | Fast, well-established | Largely replaced by HPLC for potency |

Why HPLC replaced GC: GC heats the sample during testing, which decarboxylates THCa into THC. This means GC cannot distinguish between THCa and THC -- it reports everything as THC. HPLC operates at room temperature, preserving the acid forms and allowing labs to report THCa and Delta-9-THC separately. This distinction is critical because raw flower contains mostly THCa (not active until heated), and the Total THC calculation requires knowing both values.

Results format: Potency results are typically reported as:

• Individual cannabinoid percentages (e.g., THCa: 28.3%, Delta-9-THC: 0.9%)
• Milligrams per gram (mg/g) -- divide by 10 to convert to percentage
• Total THC and Total CBD (calculated from the acid + neutral forms)

What is typical:

• Flower: 15-30% total THC, with premium strains reaching 30-35%
• Concentrates: 60-95% total THC depending on type
• Edibles: Reported in mg per serving and mg per package
• Hemp: <0.3% Delta-9-THC (federal legal threshold)

Practical relevance: Potency data is the single most important product attribute for catalog management. It drives labeling, compliance verification, dosing guidance, and consumer purchasing decisions. During migrations, potency fields are among the highest-priority data to preserve accurately.

Terpene Profiling

What is tested: Individual terpene concentrations in the product sample. A standard terpene panel tests for the 8 primary terpenes; expanded panels test 20-40+ terpenes.

Primary terpenes (tested on virtually all terpene panels): Myrcene, Beta-Caryophyllene, Limonene, Alpha-Pinene, Beta-Pinene, Humulene, Linalool, Terpinolene, Ocimene

Secondary terpenes (tested on expanded panels): Bisabolol, Nerolidol, Guaiol, Eucalyptol, Camphene, Carene, Geraniol, Borneol, Fenchol, Terpineol, Valencene, Sabinene

See terpenes.md for the full terpene encyclopedia with 46+ entries.

Testing method: Gas chromatography (GC) or headspace GC. Unlike cannabinoid testing where HPLC is preferred, GC remains the standard for terpene analysis because terpenes are volatile compounds that separate well in gas phase.

Results format: Individual terpene percentages (e.g., Myrcene: 1.23%, Beta-Caryophyllene: 0.87%) and total terpene content.

What is typical:

• Flower: 1-3% total terpenes (average); 3-5%+ is considered premium ("terpy")
• Live resin/rosin: 5-15% total terpenes (preserved through flash-freezing)
• Distillate: Near-zero (terpenes stripped during processing, often re-added)

Why terpene testing matters:

• Product quality signal: higher total terpenes generally indicates higher quality flower
• Strain differentiation: terpene profiles distinguish strains more meaningfully than THC percentage
• Consumer matching: dominant terpene predicts subjective effects better than indica/sativa classification
• "Terps over THC" movement: educated consumers and premium dispensaries prioritize terpene data

Practical relevance: Terpene data is increasingly important for product cataloging and menu optimization. Dispensaries that display terpene profiles report higher customer engagement. During migrations, terpene data is frequently missing from legacy POS exports -- this is a known gap, not an error.

Pesticides

What is tested: Residual pesticide chemicals that may remain on cannabis from cultivation. Cannabis testing labs typically screen for 60-100+ pesticide analytes depending on the state.

Common pesticide categories tested:

• Insecticides: Bifenthrin, carbaryl, imidacloprid, malathion, spiromesifen
• Fungicides: Myclobutanil, trifloxystrobin, metalaxyl, propiconazole
• Growth regulators: Paclobutrazol, daminozide
• Synergists: Piperonyl butoxide (PBO)
• Herbicides: Less common in indoor cannabis, but included in some panels

Pass/fail thresholds: Each state sets its own action levels (maximum allowable concentrations) for each pesticide. Results are reported in parts per million (ppm) or parts per billion (ppb). A product fails if any single pesticide exceeds its action level.

Key context:

• Cannabis has no federal EPA-approved pesticides (because it remains federally illegal), so state regulators set their own pesticide lists and limits
• California has one of the strictest pesticide testing regimes: 66 analytes with very low action levels
• Oregon tests for 59 pesticides with a "zero tolerance" policy for many
• Pesticide failures are among the most common reasons for product recalls

Why this matters: Pesticide contamination is a direct consumer safety concern. Cannabis concentrates are especially concerning because pesticide residues concentrate along with cannabinoids during extraction. A flower sample that passes pesticide testing may produce a concentrate that fails.

Practical relevance: Pesticide test results are pass/fail -- they don't typically appear as product attributes in catalogs. However, products that fail pesticide testing may be subject to recall, requiring rapid catalog updates to remove affected batches.

Heavy Metals

What is tested: Four heavy metals that are most harmful to human health:

| Metal | Sources of Contamination | Health Risk | |-------|-------------------------|-------------| | Lead (Pb) | Soil contamination, old plumbing, fertilizers | Neurotoxic, accumulates in body | | Cadmium (Cd) | Soil contamination, some fertilizers | Kidney damage, carcinogenic | | Arsenic (As) | Natural soil presence, pesticide residues | Carcinogenic, organ damage | | Mercury (Hg) | Soil and water contamination, industrial runoff | Neurotoxic, especially methylmercury |

Why cannabis is susceptible: Cannabis is a bioaccumulator -- it absorbs heavy metals from soil, water, and nutrients more readily than many other plants. This is actually why hemp has been studied for phytoremediation (cleaning contaminated soil), but it also means cannabis grown in contaminated conditions can contain dangerous metal concentrations.

Testing method: Inductively Coupled Plasma Mass Spectrometry (ICP-MS) is the standard analytical method. It can detect metals at parts-per-billion concentrations.

Results format: Reported in ppm (parts per million) or ppb (parts per billion). Each metal has a state-defined action level. Product fails if any metal exceeds its threshold.

Typical action levels (vary by state):

• Lead: 0.5 - 1.0 ppm
• Cadmium: 0.2 - 0.5 ppm
• Arsenic: 0.2 - 1.5 ppm
• Mercury: 0.1 - 0.2 ppm

Practical relevance: Like pesticides, heavy metal results are pass/fail and don't appear as catalog attributes. However, heavy metal contamination can trigger recalls and is a critical safety concern for inhalable and ingestible products.

Historical context: Cannabis's ability to bioaccumulate heavy metals was first widely recognized through its use in phytoremediation research. Hemp plants were used experimentally to clean contaminated soil near Chernobyl and at industrial waste sites. While this demonstrates the plant's remarkable metal absorption capacity, it also explains why heavy metal testing is universally required -- cannabis grown in even mildly contaminated conditions can accumulate metals to unsafe levels.

Common contamination sources for cultivators:

• Contaminated soil or growing medium
• Unfiltered water from wells or municipal sources with old pipes
• Fertilizers and nutrients (especially organic amendments from unverified sources)
• Growing containers (galvanized metal pots can leach zinc and cadmium)
• Plumbing and irrigation equipment (brass fittings can leach lead)

Microbials

What is tested: Microbiological contamination -- bacteria, yeast, and mold that can grow on cannabis flower and products.

Common microbial tests:

| Test | What It Measures | Fail Threshold (typical) | |------|-----------------|------------------------| | Total Yeast and Mold (TYM) | Overall fungal contamination | 10,000 - 100,000 CFU/g | | Total Aerobic Bacteria | Overall bacterial contamination | 100,000 - 1,000,000 CFU/g | | Coliforms | Fecal contamination indicator | 100 - 10,000 CFU/g | | E. coli | Specific pathogenic bacteria | Not detected / <100 CFU/g | | Salmonella | Specific pathogenic bacteria | Not detected per gram | | Aspergillus | Specific dangerous mold species (A. flavus, A. fumigatus, A. niger, A. terreus) | Not detected per gram |

CFU/g: Colony-forming units per gram -- the standard measure of microbial contamination.

Why this matters:

• Immunocompromised patients (medical cannabis users) are especially vulnerable to Aspergillus infections from contaminated cannabis
• Improperly dried or stored flower is prone to mold growth
• Products that are consumed by inhalation (smoking, vaping) deliver microbes directly to the lungs

Key context:

• Microbial testing is required in virtually all legal states
• Flower that "looks fine" can still fail microbial testing -- visual inspection is insufficient
• Products can be remediated (re-processed) after microbial failure in some states -- typically through irradiation or ozone treatment
• Post-remediation retesting is required

Practical relevance: Microbial failures can remove products from inventory and trigger recalls. For catalog management, products that undergo remediation may have different batch numbers and require updated COA data in the catalog.

Testing methods explained:

| Method | What It Detects | Turnaround | Pros | Cons | |--------|----------------|------------|------|------| | Culture-based (plating) | Total counts (TYM, aerobic bacteria) | 3-7 days | Industry standard, well-understood | Slow; some organisms don't grow on standard media | | qPCR (molecular) | Specific pathogens (E. coli, Salmonella, Aspergillus) | 1-3 days | Fast, specific, sensitive | Cannot distinguish live vs dead organisms | | Petrifilm | Total counts (rapid screening) | 1-3 days | Fast, cost-effective | Less accurate than traditional plating |

Key nuance: qPCR detects DNA, not living organisms. This means a product that was successfully irradiated (killing all microbes) may still show DNA from the dead organisms. Some states are moving to specify culture-based methods for post-remediation testing to avoid false positives from dead organisms.

Remediation methods for microbial failures:

• Gamma irradiation: Most effective; kills virtually all microbes. Does not affect potency. May slightly reduce terpene content. Requires specialized facility.
• Ozone treatment: Gas-phase treatment that kills mold and bacteria. Less effective for deeply embedded contamination. Can affect terpene profile.
• Re-extraction: For concentrates -- re-processing can remove microbial contamination. Changes the product form.
• Radio frequency (RF) treatment: Newer technology; uses electromagnetic waves to kill microbes. Less established than irradiation.

Mycotoxins

What is tested: Toxic compounds produced by certain mold species (particularly Aspergillus and Penicillium). Even after mold is killed (through processing or remediation), the mycotoxins it produced may persist.

Key mycotoxins tested:

| Mycotoxin | Produced By | Health Risk | |-----------|------------|-------------| | Aflatoxin B1 | Aspergillus flavus, A. parasiticus | Most potent natural carcinogen; liver damage | | Aflatoxin B2 | Aspergillus flavus, A. parasiticus | Carcinogenic, less potent than B1 | | Aflatoxin G1 | Aspergillus parasiticus | Carcinogenic | | Aflatoxin G2 | Aspergillus parasiticus | Carcinogenic | | Ochratoxin A | Aspergillus ochraceus, Penicillium spp. | Kidney damage, potentially carcinogenic |

Testing method: Liquid chromatography-tandem mass spectrometry (LC-MS/MS).

Results format: Reported in ppb (parts per billion) or mcg/kg (micrograms per kilogram). Typical action levels are 20 ppb total aflatoxins and 20 ppb ochratoxin A.

Why mycotoxin testing is separate from microbial testing: Microbial testing detects living organisms. Mycotoxin testing detects the toxins those organisms produce. A product can pass microbial testing (no live mold detected) but fail mycotoxin testing (toxins remain from previous mold growth). This is why both tests are needed.

Practical relevance: Mycotoxin contamination is relatively rare but extremely serious. Products that fail mycotoxin testing cannot be remediated and must be destroyed in most states. This is a hard fail with no path to retail.

Risk factors for mycotoxin contamination:

• High humidity during cultivation or storage (>65% RH)
• Improperly dried or cured flower
• Extended storage without moisture control
• Outdoor or greenhouse cultivation with poor environmental controls
• Warm storage conditions (mycotoxin-producing molds thrive at 25-35C / 77-95F)
• Products that have been remediated for microbial contamination may still contain mycotoxins from the original mold growth

Prevention: Proper environmental controls during cultivation (50-60% RH, good airflow), rapid drying to target moisture content (10-12%), cool storage with humidity packs, and routine environmental monitoring in cultivation and processing facilities.

Residual Solvents

What is tested: Chemical solvents that may remain in cannabis concentrates and extracts after processing. This panel is primarily relevant to extracted/concentrated products, not raw flower.

Common solvents tested:

| Solvent | Used In | Action Level (typical) | |---------|---------|----------------------| | Butane | BHO (butane hash oil) extraction | 1,000 - 5,000 ppm | | Propane | Hydrocarbon extraction | 1,000 - 5,000 ppm | | Ethanol | Ethanol extraction, winterization | 5,000 - 50,000 ppm | | Isopropanol | Purification processes | 5,000 ppm | | Acetone | Purification processes | 5,000 ppm | | Hexane | Extraction processes | 290 ppm | | Methanol | Rare in cannabis; very toxic | 3,000 ppm | | Heptane | Extraction processes | 5,000 ppm | | Pentane | Extraction processes | 5,000 ppm | | Xylenes | Purification processes | 2,170 ppm | | Toluene | Purification processes | 890 ppm | | Benzene | Contaminant; not intentionally used | 1 - 2 ppm |

Why this matters:

• Inhaling residual solvents is a direct health hazard
• Butane and propane are the most common solvents in cannabis concentrate production
• Solventless products (rosin, ice water hash) are exempt from residual solvent testing in most states because no solvents are used in production
• Ethanol is generally considered safer, with much higher allowable limits

Results format: Reported in ppm. Each solvent has its own action level. Product fails if any solvent exceeds its limit.

Practical relevance: Residual solvent results are relevant for product categorization. "Solventless" is a premium product category with specific testing exemptions. During migrations, knowing whether a concentrate is solvent-based or solventless affects which testing data should be present in the catalog.

Understanding solvent action levels: Action levels for solvents are set based on toxicity and exposure risk. The most toxic solvents (benzene, methanol) have the lowest action levels (1-2 ppm), while less toxic solvents commonly used in extraction (butane, propane, ethanol) have much higher limits (1,000-50,000 ppm). Ethanol has the highest allowable limit because it is the least toxic and is present in many food products.

The purging process: After solvent-based extraction, the concentrate undergoes "purging" -- a process of applying heat and/or vacuum to evaporate residual solvents. Insufficient purging is the primary cause of residual solvent failures. A well-purged concentrate will test well below action levels for all solvents.

Moisture / Water Activity

What is tested: Two related but distinct measurements of water in a cannabis product:

• Moisture content (MC): The total percentage of water in the sample by weight. Measured by loss-on-drying (weighing before and after oven drying).
• Water activity (Aw): The availability of water for microbial growth, measured on a scale of 0 to 1. More predictive of spoilage risk than moisture content alone.

Why both are measured: Moisture content tells you how much water is present. Water activity tells you how available that water is for microbes to use. A product can have moderate moisture content but low water activity (water is bound to sugars or other compounds and unavailable to microbes).

Acceptable ranges:

| Measure | Acceptable Range | Concern Threshold | |---------|-----------------|-------------------| | Moisture content | 8-13% for flower | >15% risks mold | | Water activity (Aw) | 0.55 - 0.65 for flower | >0.65 supports mold growth |

Key context:

• Cannabis is most stable for storage at 0.55-0.62 Aw (equivalent to 58-62% relative humidity -- hence the common "62% humidity pack" recommendation)
• Overly dry cannabis (<8% MC) loses terpenes and becomes harsh to smoke, but is less prone to mold
• Water activity testing is more reliable than moisture content for predicting microbial risk
• Some states require water activity; others require moisture content; some require both

Practical relevance: Moisture/water activity data rarely appears in product catalogs but is critical for storage and shelf life. Products with high water activity may have shorter shelf lives, which affects inventory planning.

The relationship between moisture, water activity, and product quality:

| Condition | Moisture Content | Water Activity | Result | |-----------|-----------------|----------------|--------| | Too wet | >14% | >0.65 | Mold growth risk, product degradation | | Ideal range | 10-12% | 0.55-0.62 | Balanced: good smoke quality, stable storage | | Too dry | <8% | <0.50 | Terpene loss, harsh smoke, brittle flower, trichome damage | | Optimal for long storage | 9-11% | 0.55-0.60 | Minimal degradation, mold-safe, preserved terpenes |

The Boveda/Integra factor: Humidity-controlled packaging (using products like Boveda 62% or Integra Boost) has become standard in premium cannabis packaging. These two-way humidity packs maintain a target RH (relative humidity) inside the container, keeping water activity in the ideal range. For catalog and migration purposes, whether a product includes humidity control packaging is sometimes noted as a product attribute.

Why water activity is more predictive than moisture content: Two products can have the same moisture content (e.g., 12%) but different water activities. If one product contains hygroscopic compounds (sugars, salts) that bind water molecules, less water is "available" for microbes to use. Water activity directly measures this availability, making it the better predictor of microbial risk. This is why water activity testing is increasingly preferred over simple moisture content measurement.

Foreign Material

What is tested: Visual and microscopic inspection for physical contaminants that should not be present in the product.

Common foreign materials screened for:

• Biological: Hair (human or animal), insect parts, mold visible to the naked eye, animal feces
• Inorganic: Glass, metal fragments, plastic, sand, soil
• Packaging debris: Labels, bag fragments, staples
• Adulterants: Non-cannabis plant material added to bulk up weight

Testing method: Visual inspection under magnification (microscopy), sometimes supplemented with digital imaging. Some states specify minimum magnification requirements (e.g., 30x).

Pass/fail: Most states use a qualitative pass/fail standard -- any visible foreign material above a threshold size (typically 1-3mm) fails the sample. Some states also set limits on the number and type of contaminants allowed.

Key context:

• Foreign material testing is one of the simpler tests but catches real problems -- insect infestations, packaging contamination during processing, and deliberate adulteration
• Hair contamination is surprisingly common and usually indicates insufficient hygiene protocols in the processing facility
• Sand or glass contamination has been documented in illicit market products and occasionally in licensed facilities

Practical relevance: Foreign material results are pass/fail and do not appear as product attributes. However, repeated foreign material failures from a specific supplier may indicate quality control issues worth tracking.

State-specific foreign material standards:

• California requires inspection at minimum 10x magnification for all flower products and 30x for concentrates
• Colorado requires visual inspection and sets specific limits for different contaminant types
• Oregon uses a tiered system based on product type (flower vs concentrate vs edible)
• Washington requires microscopic examination with documented photographic evidence
• Most other states follow general "no visible contamination" standards

Common failure scenarios:

• Hair contamination from inadequate PPE (hairnets, gloves) during trimming or processing
• Insect fragments from pest infestations in the cultivation facility
• Plastic or packaging debris from automated packaging equipment
• Soil or growing medium residue from inadequate post-harvest cleaning
• Metal fragments from grinding or processing equipment wear

Homogeneity

What is tested: Whether cannabinoids are evenly distributed throughout infused products -- primarily edibles, beverages, topicals, and pre-filled vape cartridges.

Why homogeneity matters: An edible labeled "10mg THC per gummy" should contain approximately 10mg in every gummy, not 2mg in one and 18mg in another. Uneven distribution means unpredictable dosing, which is both a safety concern and a compliance issue.

Testing method: Multiple subsamples from a single batch are tested for potency. The variance between subsamples is compared against an acceptable range.

Acceptable variance: Most states allow +/- 10-15% variance from the labeled dose. For example, a gummy labeled at 10mg THC can test between 8.5mg and 11.5mg and still pass (+/- 15%).

Key context:

• Homogeneity testing is primarily required for edibles and infused products, not raw flower or standard concentrates
• Beverages are particularly challenging to formulate homogeneously because cannabinoids are hydrophobic (they don't mix well with water)
• Nano-emulsion technology has improved edible and beverage homogeneity significantly in recent years
• Some states require homogeneity testing for all infused products; others only require it for edibles

Practical relevance: Homogeneity results affect product labeling accuracy. During migrations, potency data for edibles should include per-serving and per-package milligrams, which come from homogeneity-verified COA results. Edible products with poor homogeneity may have wider dose variance than what's listed in the source POS.

---

Potency Calculations

Understanding potency calculations is essential for anyone working with cannabis product data -- retailers verifying labels, catalog managers populating product attributes, and consumers evaluating products.

Total THC Formula

Total THC = (THCa x 0.877) + Delta-9-THC

Why 0.877: THCa (tetrahydrocannabinolic acid) is the raw, non-psychoactive form of THC found in fresh and dried cannabis. When heated (smoking, vaping, cooking), THCa undergoes decarboxylation -- it loses a carboxyl group (CO2) and becomes Delta-9-THC, the psychoactive form.

The molecular weight of THCa is 358.48 g/mol. The molecular weight of Delta-9-THC is 314.47 g/mol. The ratio is:

314.47 / 358.48 = 0.8773 (rounded to 0.877)

This means that when THCa converts to THC, approximately 12.3% of the mass is lost as CO2. So 1 gram of THCa produces approximately 0.877 grams of THC.

Worked example (flower): A flower sample tests at:

• THCa: 28.3%
• Delta-9-THC: 0.9%

Total THC = (28.3 x 0.877) + 0.9 = 24.82 + 0.9 = 25.72%

This is the number that appears on the product label as "Total THC" or "Max THC."

Why raw flower has high THCa and low Delta-9-THC: Fresh and dried cannabis contains predominantly THCa. Small amounts of Delta-9-THC may be present from natural decarboxylation during drying and curing. A flower COA showing high THCa (20-30%+) and low Delta-9-THC (<1%) is normal and expected.

Why concentrates have high Delta-9-THC: Many concentrate production methods involve heat, which converts THCa to THC during extraction. A distillate COA may show 85% Delta-9-THC and 0% THCa because the conversion already occurred.

Total CBD Formula

Total CBD = (CBDa x 0.877) + CBD

The same 0.877 conversion factor applies. CBDa (cannabidiolic acid) is the acid precursor to CBD, with the same molecular weight ratio.

Worked example (hemp flower): A hemp flower sample tests at:

• CBDa: 15.2%
• CBD: 0.8%

Total CBD = (15.2 x 0.877) + 0.8 = 13.33 + 0.8 = 14.13%

Milligram-to-Percentage Conversion

Product potency may be expressed as a percentage (flower, concentrates) or in milligrams (edibles, tinctures). Converting between them:

mg = (weight in mg) x (percentage / 100)

Worked examples:

• 1g (1000mg) concentrate at 85% THC = 1000 x 0.85 = 850mg THC
• 0.5g (500mg) vape cartridge at 90% THC = 500 x 0.90 = 450mg THC
• 3.5g (3500mg) flower at 25% THC = 3500 x 0.25 = 875mg THC total in the package

Edible Dosing Calculation

mg per piece = total mg in package / number of pieces

Worked examples:

• 100mg package / 10 gummies = 10mg per gummy
• 200mg package / 20 mints = 10mg per mint
• 100mg chocolate bar / 10 squares = 10mg per square

State-regulated dosing limits (as of March 2026):

• Most adult-use states limit edibles to 100mg total THC per package and 10mg THC per serving
• Some states (Colorado, Oregon) allow higher per-package limits (100mg per package, but individual serving sizes vary)
• Medical products may have higher limits (200mg, 500mg, or unlimited depending on the state)

Why Potency Math Matters for Migrations

During POS migrations, potency data may be stored differently across systems:

| Scenario | What You See | What To Do | |----------|-------------|------------| | Source has THCa and THC separately | Both values present | Map both fields; calculate Total THC if target system needs it | | Source has only "THC" | Single value, unclear if total or delta-9 | If percentage is 20-35% (flower), likely Total THC. If <1%, likely Delta-9 only | | Source has mg only (edibles) | e.g., "100mg THC" | Map to mg field; calculate per-serving if target system requires it | | Source has potency as text | e.g., "High THC" | Cannot convert to numeric; flag for manual entry | | Source has percentage >40% (flower) | Likely a data entry error | Flag for review -- flower rarely exceeds 35% Total THC |

---

Annotated COA Examples

These examples walk through realistic COA results for three common product types. Each annotation explains what the number means, whether it is typical or notable, and what action a retailer or consumer should take.

Example 1: Flower COA

Product: Blue Dream (Hybrid) Batch: BD-2026-0312 Lab: SC Labs (ISO 17025 accredited) Sample received: 2026-03-08 Report issued: 2026-03-12

Potency Panel

| Analyte | Result | Notes | |---------|--------|-------| | THCa | 28.3% | High. Top 25% of flower potency. This is the acid form -- converts to THC when heated. | | Delta-9-THC | 0.9% | Normal. Small amount from natural decarboxylation during curing. | | Total THC | 25.72% | (28.3 x 0.877) + 0.9 = 25.72%. This is the label number. Above-average potency. | | CBDa | 0.08% | Minimal. This is a THC-dominant strain, not a CBD strain. | | CBD | ND (not detected) | Normal for a high-THC strain. | | Total CBD | 0.07% | Negligible. Not a selling point for this product. | | CBG | 0.12% | Normal. Small amount of CBG is typical in mature flower. | | CBN | 0.04% | Good sign. Very low CBN means the flower is fresh. High CBN (>0.5%) would indicate degradation/aging. |

What a retailer should verify:

• Total THC matches the label on the product packaging (25.72% should be rounded and displayed as ~25.7% or ~26%)
• CBN is low, confirming the product is not old or poorly stored
• If a customer asks "what is the THC?" -- the answer is 25.72%, not 28.3% (THCa is not active until heated)

Terpene Panel

| Terpene | Result | Interpretation | |---------|--------|----------------| | Myrcene | 1.23% | Dominant terpene. Myrcene dominance is typical of Blue Dream. Expect relaxation/body effects. | | Beta-Caryophyllene | 0.47% | Second highest. Adds anti-inflammatory properties via CB2 receptor activation. | | Limonene | 0.38% | Notable. Contributes citrus aroma and mood elevation. The Myrcene + Limonene combination gives Blue Dream its characteristic "relaxed but uplifted" profile. | | Alpha-Pinene | 0.21% | Moderate. May help counteract some of the sedative effects of myrcene (pinene is associated with alertness). | | Linalool | 0.15% | Supporting terpene. Adds floral notes and mild calming effects. | | Total Terpenes | 2.87% | Good. Average for well-grown flower. Premium product would be 3-5%+. |

What a retailer should note:

• Total terpenes of 2.87% is solid but not exceptional
• Myrcene dominance means this product is best recommended for evening use or relaxation
• The terpene profile supports the "hybrid" classification -- myrcene (relaxation) balanced by limonene and pinene (uplift)

Safety Panels

| Panel | Result | Interpretation | |-------|--------|----------------| | Pesticides (66 analytes) | PASS | No pesticide detected above action levels. Safe for sale. | | Heavy Metals | PASS | Lead <0.1 ppm, Cadmium <0.05 ppm, Arsenic <0.1 ppm, Mercury <0.02 ppm. All well below limits. | | Microbials | PASS | TYM: 2,400 CFU/g (limit: 10,000). Total aerobic: 8,500 CFU/g (limit: 100,000). Aspergillus: not detected. | | Mycotoxins | PASS | Aflatoxins: <1 ppb (limit: 20 ppb). Ochratoxin A: ND. | | Moisture | 10.2% | Good range. Flower at 10-12% moisture is well-cured and stable. | | Water Activity | 0.58 Aw | Ideal. Between 0.55-0.65, this flower will store well without mold risk. | | Foreign Material | PASS | No foreign material detected at 30x magnification. |

What a retailer should verify:

• All safety panels show PASS -- product is compliant and safe for sale
• Moisture at 10.2% and water activity at 0.58 mean this flower should have good shelf life if stored properly
• The microbial results, while passing, show some yeast/mold (2,400 CFU/g). This is normal and well within limits, but if numbers were approaching 8,000+ CFU/g, it would warrant monitoring storage conditions

Overall assessment: This is a strong flower COA. Above-average potency, good terpene profile, clean safety panels, and ideal moisture/water activity for storage. A retailer can confidently stock this product.

Catalog Data Mapping for This COA

When entering this product into a POS or catalog system, here is how the COA data maps to product attributes:

| COA Field | Product Attribute | Value | Notes | |-----------|------------------|-------|-------| | Total THC | THC% | 25.72% | Primary potency attribute | | Total CBD | CBD% | 0.07% | May display as "<1%" or "Trace" | | THCa | THCa% | 28.3% | Some systems store separately | | Delta-9-THC | Delta-9% | 0.9% | Some systems store separately | | CBG | CBG% | 0.12% | Minor cannabinoid field | | CBN | CBN% | 0.04% | Minor cannabinoid field | | Myrcene | Dominant terpene | Myrcene | Product differentiation | | Total terpenes | Total terps% | 2.87% | Quality metric | | All safety panels | Compliance status | Pass | Required for sale | | Batch number | Batch/lot | BD-2026-0312 | Traceability link | | Lab name | Testing lab | SC Labs | Record keeping | | Report date | Test date | 2026-03-12 | Freshness indicator |

This mapping demonstrates why COA data is central to product cataloging. In a well-configured POS system, most of these fields can be populated directly from the COA without manual interpretation.

Example 2: Concentrate COA (Live Resin)

Product: Gelato #33 Live Resin Batch: GLR-2026-0287 Lab: Kaycha Labs (ISO 17025 accredited) Sample received: 2026-03-05 Report issued: 2026-03-10

Potency Panel

| Analyte | Result | Notes | |---------|--------|-------| | THCa | 52.1% | High THCa for a concentrate. Live resin preserves acid forms because extraction occurs before full decarboxylation. | | Delta-9-THC | 26.4% | Significant. Some conversion occurred during extraction. | | Total THC | 72.08% | (52.1 x 0.877) + 26.4 = 45.69 + 26.4 = 72.08%. Mid-range for live resin. | | CBDa | 0.03% | Negligible. THC-dominant product. | | CBD | ND | Normal for a THC-dominant concentrate. | | CBG | 1.8% | Notable. Higher CBG than typical flower. Concentration process preserves minor cannabinoids. | | CBN | 0.2% | Acceptable. Slightly elevated from processing heat, but well within normal range. |

What makes this different from flower:

• Total THC is much higher (72% vs 25% for flower) but lower than distillate (85-95%)
• Live resin retains more THCa because flash-freezing preserves acid forms
• The presence of CBG at 1.8% adds to the entourage effect -- this is a full-spectrum product

Terpene Panel

| Terpene | Result | Interpretation | |---------|--------|----------------| | Limonene | 3.21% | Dominant and very high. Gelato strains are typically limonene-dominant. | | Beta-Caryophyllene | 2.14% | Very high. The combination of limonene + caryophyllene gives Gelato its dessert-like profile. | | Linalool | 1.87% | High. Unusual to see linalool this high -- adds floral sweetness. | | Myrcene | 1.43% | Elevated but not dominant. Balanced profile. | | Humulene | 0.92% | Supporting terpene. | | Ocimene | 0.67% | Supporting terpene. | | Total Terpenes | 11.84% | Exceptional. Live resin preserves terpenes through flash-freezing. This is 4x the terpene content of average flower. |

What a retailer should note:

• 11.84% total terpenes is a major selling point -- this is a premium product
• The terpene profile is rich and complex, reflecting the "full-spectrum" nature of live resin
• Limonene dominance means mood elevation and citrus/sweet aroma

Safety Panels

| Panel | Result | Interpretation | |-------|--------|----------------| | Pesticides | PASS | Critical for concentrates -- pesticides concentrate during extraction. A passing pesticide test on a concentrate is more significant than on flower. | | Heavy Metals | PASS | All metals below action levels. | | Residual Solvents | Butane: 120 ppm, Propane: 45 ppm | PASS. Well below limits (5,000 ppm for butane). Low residual solvents indicate good purging during production. | | Microbials | PASS | Lower microbial risk in concentrates due to processing. | | Mycotoxins | PASS | Clean. | | Foreign Material | PASS | No contaminants detected. |

What makes concentrate COAs different:

• Residual solvent testing is critical (not applicable to flower or solventless concentrates)
• Pesticide testing is more important because contaminants concentrate during extraction
• Moisture/water activity testing is less relevant for concentrates
• Terpene percentages are much higher, which is a key quality differentiator

Overall assessment: This is a premium live resin COA. The high terpene content (11.84%) and clean safety panels make it a strong product. The residual solvent levels are very low, indicating quality processing. A retailer should highlight the terpene richness as a selling point.

Concentrate Potency Context

Understanding concentrate potency in context:

| Product Type | Typical THC Range | Why the Range | |-------------|-------------------|---------------| | Live resin | 60-85% | Flash-frozen; preserves THCa (not fully decarbed) | | Live rosin (solventless) | 60-80% | Mechanical extraction; no solvents, lower yield | | Shatter | 70-90% | BHO extraction with full purge | | Distillate | 85-95% | Multiple distillation passes; nearly pure THC | | Diamonds + sauce | 90-99% (diamonds), 40-70% (sauce) | THCa crystallization process | | RSO (Rick Simpson Oil) | 60-80% | Full-spectrum, ethanol extraction | | Ice water hash | 40-70% | Mechanical, solventless | | Kief/dry sift | 30-60% | Simple trichome collection |

The key distinction for concentrate COAs: live resin and live rosin preserve the full terpene and cannabinoid profile (full-spectrum), while distillate strips everything down to near-pure THC. This trade-off between potency and profile complexity is the central quality dimension for concentrates.

Example 3: Edible COA (Gummies)

Product: Wild Berry Gummies (10-pack) Batch: WBG-2026-0456 Lab: Anresco Laboratories (ISO 17025 accredited) Labeled: 100mg THC total, 10mg per gummy Sample received: 2026-03-01 Report issued: 2026-03-06

Potency Panel

| Analyte | Result | Labeled | Variance | Notes | |---------|--------|---------|----------|-------| | Total THC per package | 97.3mg | 100mg | -2.7% | Within tolerance. Edibles typically allow +/- 10-15% variance. | | THC per serving (avg of 5 subsamples) | 9.73mg | 10mg | -2.7% | Good consistency. Close to labeled dose. | | THC per serving (range) | 8.9mg - 10.4mg | 10mg | -11% to +4% | Acceptable. No individual gummy deviates more than ~11% from the labeled dose. | | CBD per package | 2.1mg | Not labeled | N/A | Trace CBD is common from full-spectrum extract used in formulation. |

Key interpretation points:

• The -2.7% variance from labeled dose is excellent. Industry standard allows +/- 10-15%.
• The range between individual gummies (8.9mg to 10.4mg) shows good homogeneity. A poorly formulated edible might show 5mg in one piece and 15mg in another.
• The trace CBD (2.1mg total) suggests the manufacturer used a full-spectrum extract, not pure THC isolate.

What a retailer should verify:

• Per-serving dose matches the label within tolerance (9.73mg vs labeled 10mg -- this is fine)
• Per-package dose is within tolerance (97.3mg vs labeled 100mg -- this is fine)
• No individual serving exceeds the state maximum per-serving limit (typically 10mg for adult-use)
• The 10.4mg high end is technically over the 10mg per-serving label. Most states allow this within the +/- 15% tolerance. However, if the state has a hard cap of 10mg per serving (not per label claim), this could be a compliance concern -- check state-specific rules.

Safety Panels

| Panel | Result | Interpretation | |-------|--------|----------------| | Pesticides | PASS | Clean. | | Heavy Metals | PASS | All below action levels. | | Microbials | PASS | Lower microbial concern for processed/cooked products. | | Homogeneity | PASS | RSD (relative standard deviation) of 5.8% across subsamples. Acceptable is typically <20% RSD. | | Foreign Material | PASS | No contaminants. |

What makes edible COAs different:

• Homogeneity is the key panel -- it tells you whether dosing is consistent piece-to-piece
• Potency is reported in milligrams, not percentages (because the base product weight varies)
• Per-serving AND per-package testing is required (not just total potency)
• Terpene testing is typically not performed on edibles (terpenes are mostly degraded during cooking/processing)
• Residual solvent testing depends on the extract type used in formulation
• Potency variance is expected -- +/- 10% is considered good; +/- 15% is acceptable in most states

Overall assessment: This is a well-formulated edible with consistent dosing and clean safety results. The low variance between individual gummies (RSD 5.8%) indicates quality manufacturing. A retailer can trust the labeled dose of 10mg per serving.

Edible-Specific Considerations

Onset and duration context: Unlike inhalable products where effects are felt within minutes, edible effects typically take 30-90 minutes to onset and last 4-8 hours. This delayed onset is the primary driver behind the strict per-serving dose limits (10mg) -- consumers who don't feel effects quickly may consume additional servings, leading to uncomfortable overconsumption.

Why edible homogeneity is challenging:

• Cannabinoids are hydrophobic (don't mix with water) -- creating even distribution in water-based products is technically difficult
• Temperature variations during manufacturing (cooking, cooling) can cause cannabinoids to separate or settle unevenly
• Different shapes and sizes within a batch (natural variation in gummy molding) create per-piece weight differences
• Nano-emulsion technology has significantly improved homogeneity for beverages and certain edible formats

Edible testing vs flower/concentrate testing:

| Dimension | Flower | Concentrate | Edible | |-----------|--------|-------------|--------| | Potency unit | Percentage | Percentage | Milligrams | | Key quality test | Terpene profile | Terpene + solvents | Homogeneity | | Terpene relevance | High | Very high | Low (degraded) | | Dosing precision | Approximate | Approximate | Exact (per-serving) | | Consumer risk | Overconsumption rare | Overconsumption possible | Overconsumption common (delayed onset) | | Label claim priority | THC% accuracy | THC% + terpene accuracy | mg/serving accuracy |

Migration notes for edibles:

• Edible potency should always be migrated in milligrams, not percentages
• Both per-serving and per-package mg should be preserved
• Source POS may only have one potency field -- determine if it represents per-serving or per-package
• Product weight and serving count are critical for calculating per-serving dose if not stored explicitly

---

State-by-State Testing Requirements Matrix

As of March 2026 -- testing requirements change frequently as regulations evolve. Always verify current requirements with the relevant state regulatory authority before making compliance decisions. This matrix focuses on testing requirements only, not legality status (see Phase 4 legality reference for legal status by state).

How to Read This Matrix

• R = Required for all applicable product types
• PS = Product-Specific (required only for certain product types, e.g., concentrates, edibles)
• -- = Not required
• V = Voluntary / Recommended but not mandatory

States are listed alphabetically. Product-specific notes are provided below the matrix where applicable.

Adult-Use Cannabis Testing Requirements

| State | Potency | Pesticides | Heavy Metals | Microbials | Mycotoxins | Residual Solvents | Moisture/Aw | Terpenes | Foreign Material | Homogeneity | |-------|---------|------------|--------------|------------|------------|-------------------|-------------|----------|-----------------|-------------| | Alaska | R | R | R | R | R | PS | R | -- | R | PS | | Arizona | R | R | R | R | R | PS | R | -- | R | PS | | California | R | R | R | R | R | PS | R | R | R | PS | | Colorado | R | R | R | R | R | PS | R | -- | R | PS | | Connecticut | R | R | R | R | R | PS | R | R | R | PS | | Delaware | R | R | R | R | R | PS | R | R | R | PS | | DC | R | R | R | R | R | PS | R | R | R | PS | | Hawaii | R | R | R | R | R | PS | R | -- | R | PS | | Illinois | R | R | R | R | R | PS | R | -- | R | PS | | Maine | R | R | R | R | R | PS | -- | -- | R | PS | | Maryland | R | R | R | R | R | PS | R | -- | R | PS | | Massachusetts | R | R | R | R | R | PS | R | R | R | PS | | Michigan | R | R | R | R | R | PS | R | R | R | PS | | Minnesota | R | R | R | R | R | PS | R | -- | R | PS | | Missouri | R | R | R | R | R | PS | R | -- | R | PS | | Montana | R | R | R | R | -- | PS | R | -- | R | PS | | Nevada | R | R | R | R | R | PS | R | -- | R | PS | | New Jersey | R | R | R | R | R | PS | R | -- | R | PS | | New Mexico | R | R | R | R | R | PS | R | -- | R | PS | | New York | R | R | R | R | R | PS | R | -- | R | PS | | Ohio | R | R | R | R | R | PS | R | -- | R | PS | | Oregon | R | R | R | R | R | PS | R | -- | R | PS | | Rhode Island | R | R | R | R | R | PS | R | -- | R | PS | | Vermont | R | R | R | R | R | PS | R | -- | R | PS | | Virginia | R | R | R | R | R | PS | R | -- | R | PS | | Washington | R | R | R | R | R | PS | R | -- | R | PS |

Key Observations

Universal requirements (all 26 jurisdictions):

• Potency testing is required everywhere -- this is the baseline for cannabis regulation
• Pesticide testing is required everywhere -- no state allows untested products for pesticide contamination
• Heavy metals testing is required everywhere
• Microbial testing is required everywhere
• Foreign material testing is required everywhere

Near-universal requirements:

• Mycotoxin testing is required in 25 of 26 jurisdictions (Montana is the exception)
• Residual solvent testing is product-specific (concentrates/extracts) in all states that require it
• Moisture/water activity is required in 24 of 26 jurisdictions (Maine does not explicitly require it)

Terpene testing -- the notable split:

• Required (6 jurisdictions): California, Connecticut, Delaware, DC, Massachusetts, Michigan
• Not required (20 jurisdictions): All others. Many labs offer terpene testing as an add-on even when not required.
• Terpene testing is trending toward becoming required in more states as the industry matures

Homogeneity testing:

• Product-specific in all states -- typically required for edibles and infused products only
• Not required for raw flower or standard concentrates

Residual solvent testing:

• Product-specific everywhere -- applies to solvent-based concentrates and extracts
• Solventless products (rosin, ice water hash, dry sift) are typically exempt
• Flower is exempt from residual solvent testing

State-Specific Notes

Alaska: Testing program administered by the Alcohol and Marijuana Control Office (AMCO). All flower, concentrates, and edibles require testing. Random compliance testing of retail products is conducted periodically.

Arizona: Department of Health Services oversees testing. Requires testing at the infusion/manufacturing stage, not at the cultivation stage. This means flower sold as-is may have a different testing pathway than flower used for extraction.

California: Bureau of Cannabis Control (now Department of Cannabis Control, DCC) has the most comprehensive testing requirements in the country. All 10 panels are required including terpene profiling. California also requires labs to participate in inter-laboratory comparison programs, which helps standardize results across labs. Action levels for pesticides are among the strictest nationwide.

Colorado: Marijuana Enforcement Division (MED) oversees testing. Colorado was an early mover on cannabis testing regulation and has one of the most mature testing frameworks. Requires proficiency testing for labs. Has experienced well-publicized issues with "THC inflation" from certain labs.

Connecticut: Requires terpene testing, placing it among the more comprehensive testing states. Medical program testing requirements preceded and informed the adult-use requirements.

Delaware: Relatively new adult-use program. Requires terpene testing. Testing framework draws heavily from established programs in neighboring states (particularly New Jersey and Maryland).

DC (District of Columbia): Unique regulatory environment as a federal district. Requires terpene testing. Adult-use sales through Initiative 71 (gifting market) operates outside the regulated testing framework, creating a parallel market with no testing guarantees.

Hawaii: Testing requirements established for the medical program and extended to adult-use. Geographic isolation creates challenges -- fewer testing labs available, potentially longer turnaround times.

Illinois: Department of Financial and Professional Regulation (IDFPR) oversees cannabis testing. Comprehensive testing requirements. Illinois has addressed lab shopping concerns by implementing mandatory random testing of products at the retail level.

Maine: Office of Cannabis Policy oversees testing. Notable for not explicitly requiring moisture/water activity testing, making it one of the less comprehensive programs for flower quality assurance.

Maryland: Relatively new adult-use market (since July 2023). Testing requirements are comprehensive and were developed with input from more established programs. Has experienced challenges with testing capacity as the market grows.

Massachusetts: Cannabis Control Commission (CCC) requires terpene testing. One of the more comprehensive testing programs on the East Coast. Has implemented track-and-trace integration with testing results.

Michigan: Cannabis Regulatory Agency (CRA) requires terpene testing. Large market with numerous licensed testing labs. Has experienced and addressed issues with inconsistent results across labs.

Minnesota: Newest adult-use market entry (adult-use sales began 2025). Testing framework is still maturing. Requirements are comprehensive but implementation is ongoing.

Missouri: Department of Health and Senior Services oversees testing. Adult-use market opened January 2023. Testing requirements are comprehensive with specific attention to edible homogeneity.

Montana: Notable for not requiring mycotoxin testing -- one of the only states to omit this panel. Department of Revenue oversees the cannabis program.

Nevada: Cannabis Compliance Board oversees testing. Strong testing requirements influenced by the state's tourism-heavy market -- product safety is especially critical when many consumers are from out of state.

New Jersey: Cannabis Regulatory Commission (CRC) has comprehensive testing requirements. The CRC has published detailed guides on how consumers and retailers should interpret COA results.

New Mexico: Cannabis Control Division oversees testing. Requirements are comprehensive. The state has dealt with market entry capacity issues affecting lab availability.

New York: Office of Cannabis Management (OCM) oversees testing. Comprehensive requirements but the market rollout has been slow. Illicit market competition remains a significant challenge -- untested products still widely available.

Ohio: Relatively new adult-use program (voter-approved 2023, sales began 2024). Testing framework adapted from the medical program. Comprehensive requirements.

Oregon: Oregon Liquor and Cannabis Commission (OLCC, now Oregon Liquor and Cannabis Regulation Commission, OLCRC) oversees testing. One of the most established programs. Known for strict pesticide testing with "zero tolerance" for many analytes. Has dealt with lab accreditation issues.

Rhode Island: Cannabis Control Commission oversees testing. Comprehensive requirements modeled on neighboring Massachusetts.

Vermont: Cannabis Control Board oversees testing. Comprehensive requirements. Small market with limited testing lab capacity.

Virginia: Cannabis Control Authority oversees testing. Adult-use framework is still developing. Testing requirements are comprehensive on paper but implementation is ongoing.

Washington: Liquor and Cannabis Board (LCB) oversees testing. One of the most established programs alongside Colorado and Oregon. Has implemented robust inter-laboratory proficiency testing programs to address inconsistency concerns.

Testing Stringency Comparison

States can be grouped by overall testing stringency:

Most comprehensive (all or nearly all panels mandatory, strict action levels):

• California -- the gold standard; requires all 10 panels including terpenes; strictest pesticide action levels
• Massachusetts -- comprehensive requirements including terpene testing; strong enforcement
• Michigan -- requires terpenes; active lab oversight program
• Connecticut -- comprehensive requirements including terpenes

Comprehensive (most panels mandatory, standard action levels):

• Colorado, Oregon, Washington -- established programs with strong enforcement history
• Illinois, Nevada, New Jersey -- comprehensive with active regulatory oversight
• Arizona, Maryland -- newer programs modeled on established states

Standard (core panels mandatory, some gaps):

• Alaska, New Mexico, Ohio, Minnesota, Missouri, Virginia, Rhode Island, Vermont, Hawaii, Delaware, DC, New York -- require core panels (potency, pesticides, microbials, heavy metals) with some variation in additional panels

Less comprehensive (notable gaps in required testing):

• Montana -- does not require mycotoxin testing
• Maine -- does not explicitly require moisture/water activity testing

Emerging Testing Trends (as of March 2026)

1. Terpene testing becoming standard: Currently mandatory in only 6 jurisdictions, but the trend is clearly toward universal adoption. Several states have proposed rules to add terpene testing requirements.

2. Heavy metal testing expanding: Some states are considering adding additional metals beyond the standard four (lead, cadmium, arsenic, mercury). Chromium and barium have been proposed in California rulemaking.

3. Pesticide panel expansion: As new agricultural chemicals enter the market, pesticide panels are growing. California's panel has increased from 66 to 70+ analytes over the past two years.

4. Vitamin E acetate screening: Following the EVALI crisis, several states added VEA screening for vape products. This was not on any state's radar before 2019.

5. R-value and total active cannabinoids: Some states are exploring requiring labs to report "total active cannabinoids" (TAC) rather than just THC and CBD, giving consumers a fuller picture of the product's cannabinoid content.

6. Proficiency testing mandates: More states are implementing mandatory inter-laboratory proficiency testing to address inconsistent results across labs.

7. Shelf-life testing: A few states are exploring requirements for stability testing -- verifying that products maintain their labeled potency and safety over time.

Product-Specific Testing Notes

Flower/Pre-rolls: Subject to all testing panels except residual solvents (no solvents used in flower production) and homogeneity (flower is not an infused product). Moisture/water activity is particularly important for flower.

Concentrates (solvent-based): Subject to all testing panels. Residual solvents testing is the key additional requirement. Pesticide testing is especially critical because contaminants concentrate during extraction.

Concentrates (solventless): Subject to all testing panels except residual solvents. Products labeled "solventless" must be produced without chemical solvents -- ice water, heat/pressure, and dry sifting are the permitted methods.

Edibles/Infused products: Subject to all testing panels plus homogeneity. Terpene testing is typically not performed (terpenes are degraded during cooking). Potency testing requires per-serving and per-package results.

Vape cartridges: Subject to all testing panels applicable to their extract type (solvent-based or solventless). Some states have additional testing requirements for vape-specific concerns (e.g., vitamin E acetate screening post-EVALI crisis).

Topicals: Subject to limited testing in most states -- typically potency and microbials. Heavy metals and pesticide testing may also be required depending on the state.

---

Practical Relevance

How COAs Affect Product Cataloging

COA data is the source of truth for several critical product attributes in a cannabis catalog:

| COA Data | Catalog Attribute | Priority | |----------|------------------|----------| | Total THC | THC percentage | Highest -- drives labeling and consumer purchasing | | Total CBD | CBD percentage | High -- especially for CBD-dominant and balanced products | | Individual cannabinoids (CBG, CBN, etc.) | Minor cannabinoid attributes | Medium -- valued by knowledgeable consumers | | Total terpenes | Terpene content field | Medium -- quality signal | | Dominant terpene(s) | Terpene profile attributes | Medium -- product differentiation | | Individual terpene percentages | Per-terpene fields | Lower -- data-rich but less commonly displayed | | Safety panel results | Compliance status | Required -- pass/fail, not displayed but must be on file | | Batch number | Batch tracking | Required -- links product to specific COA |

Migration Context

When migrating product data between POS systems, COA-related fields require special attention:

Common migration challenges:

• Potency format inconsistency: Source POS may store "THC" as a single field (ambiguous -- is it Total THC or Delta-9-THC?). Target system may require THCa and Delta-9-THC separately.
• Missing COA data: Many products in legacy POS systems have incomplete or missing potency data. Do not fabricate values -- flag for manual entry from the actual COA.
• Stale potency data: Potency data should correspond to the current batch on the shelf. If a product has been restocked with a new batch, the COA data in the system may be outdated.
• Terpene data gaps: Terpene data is frequently missing entirely from source POS exports, especially from older systems or states where terpene testing is not required.
• Unit mismatches: Source may report potency in mg/g while target expects percentage, or vice versa. Convert: mg/g divided by 10 = percentage.

Best practices:

• Always preserve the original potency values from the source system during migration
• Map to Total THC/CBD fields when the source has a single "THC"/"CBD" field and the value is in the expected range for the product type
• Flag any potency values that seem abnormal (flower >35% THC, edible mg not matching package size) for manual review
• Document which products have COA data and which do not -- this informs catalog health scoring

Retailer Guidance: Verifying Products from Distributors

When receiving products from distributors, retailers should verify:

1. COA exists for the batch: Every product should have a COA that matches the batch number on the packaging
2. COA is recent: The COA should correspond to the current batch, not a previous production run
3. All required panels pass: Verify that all state-required testing panels show passing results
4. Potency matches the label: Total THC/CBD on the COA should match the product label within regulatory tolerance
5. Lab is accredited: Verify the testing lab is listed on the state's approved lab registry
6. No remediation flags: If the product was remediated (re-processed after a test failure), the COA should clearly indicate this and show passing retest results

Red flags on a COA:

• Missing or illegible batch number
• Potency numbers that don't add up (Total THC doesn't match the THCa + Delta-9-THC calculation)
• Test dates more than 12 months old
• Lab not on state-approved list
• Pesticide or heavy metal results near (but just under) action levels -- may indicate contamination concerns
• Multiple remediation notes on the same batch

Consumer Education: How to Find and Read a Product's COA

Finding a COA:

• Ask the retailer: Dispensaries are required in many states to provide COAs upon request
• Scan the QR code: Many cannabis products include a QR code on packaging that links to the COA
• Visit the lab's website: Some labs publish COA results searchable by batch number
• Check the brand's website: Premium brands often publish COAs for transparency
• Confident Cannabis platform: Many labs upload results to this third-party verification platform

What information is on a typical COA document:

• Lab name, address, license number, and accreditation status
• Producer/client name and license number
• Sample name (product name) and batch/lot number
• Date sample received and date report issued
• Sample type (flower, concentrate, edible, etc.) and weight
• Individual test results organized by panel
• Pass/fail determination for each panel
• Lab director or authorized signatory signature
• QR code or web link for digital verification

Reading a COA as a consumer:

1. Start with Total THC and Total CBD -- these are the most relevant potency numbers
2. Check the terpene profile if available -- dominant terpene predicts effects better than indica/sativa
3. Verify all safety panels show PASS -- any fail means the product should not have been sold
4. Check the batch number matches your product -- the COA is only valid for the specific batch it tested
5. Note the test date -- COAs older than 6-12 months may not reflect current product quality

---

Common COA Interpretation Mistakes

Mistake 1: Confusing THCa with Total THC

The error: Seeing "THCa: 28%" on a COA and telling a customer "this is 28% THC." The reality: THCa 28% converts to approximately 24.6% THC after decarboxylation (28 x 0.877 = 24.56). The actual THC percentage is ~3.5 percentage points lower than the THCa number. Why it matters: Overstating potency by 3-4% misleads consumers and could create compliance issues.

Mistake 2: Comparing Potency Across Product Types

The error: Thinking a 90% THC distillate is "stronger" than 25% flower. The reality: They have different potency per unit weight, but dosing is what matters. A 0.5g dab of 90% distillate delivers much more THC than a single hit of 25% flower. But nobody consumes 0.5g in one hit. Effective dose depends on consumption method, not just potency percentage. Why it matters: Consumers and retail staff should think in terms of effective dose, not raw percentages.

Mistake 3: Ignoring the Terpene Profile

The error: Choosing products based solely on THC percentage. The reality: Two strains at 25% THC can produce very different experiences. A myrcene-dominant strain may be sedating while a limonene-dominant strain at the same potency may be energizing. The terpene profile is a better predictor of subjective effects than THC percentage. Why it matters: Retailers who train staff on terpene profiles report higher customer satisfaction and fewer returns.

Mistake 4: Assuming "PASS" Means "Clean"

The error: Interpreting a passing safety panel as "zero contaminants." The reality: PASS means below the action level, not absent. A sample can have detectable pesticides, heavy metals, or microbials and still pass -- the amounts are below the threshold considered harmful. Why it matters: Transparency with customers. "Passed all safety testing" is accurate. "No pesticides found" may not be.

Mistake 5: Applying One State's Standards to Another

The error: Assuming California's strict testing requirements apply in all states. The reality: Testing requirements vary significantly between states. California requires all 10 testing panels including terpenes. Montana does not require mycotoxin testing. Maine does not explicitly require moisture testing. A product that passes in one state may not meet another state's requirements. Why it matters: Multi-state operators (MSOs) must test to each state's specific standards, not apply a single testing protocol across all markets.

---

The Sampling Process

How Cannabis Samples Are Collected

The accuracy of a COA begins with proper sampling. If the sample does not represent the batch, the test results are meaningless regardless of lab quality.

Who collects samples:

• In most states, a trained lab employee or state-certified sampler collects the sample on-site
• The sampler is typically independent from the producer to prevent cherry-picking
• Some states allow the producer to submit their own sample (less secure but reduces logistics costs)

How samples are collected (flower):

1. The batch is defined (e.g., a specific harvest lot, typically 10-50 lbs)
2. Multiple subsamples (increments) are taken from different positions in the batch
3. Increments are combined into a composite sample
4. The composite is divided into test portions and retention samples
5. Test portions are sent to the lab; retention samples are stored in case of retesting

Sample size requirements (typical):

• Flower: 1-10 grams depending on state and testing panel
• Concentrates: 0.5-5 grams
• Edibles: Multiple units from a batch (e.g., 5-10 pieces from a production run)
• For homogeneity testing: Multiple individual units tested separately

Chain of custody:

• Every sample has a documented chain of custody from collection through testing
• The chain records who handled the sample, when, and how it was transported and stored
• Chain of custody documentation is maintained as part of the COA record
• Breaks in chain of custody can invalidate test results

Why sampling matters for COA interpretation:

• A COA only represents the specific sample tested, which is a small portion of the batch
• Flower batches are inherently heterogeneous -- different nugs from the same plant can have different potency
• Proper sampling technique (multiple increments from different positions) minimizes this variation
• When comparing COA results, keep in mind that even perfect labs will report slightly different results from different subsamples of the same batch

Sampling Challenges

| Challenge | Impact | Mitigation | |-----------|--------|------------| | Heterogeneous flower batches | COA may not represent every nug in the batch | Multiple increments from different positions | | Temperature during transport | Terpenes degrade in heat; moisture changes in cold | Climate-controlled transport, quick turnaround | | Light exposure | THC degrades to CBN with UV exposure | Opaque containers, minimal light exposure | | Sample prep at lab | Grinding, temperature, moisture affect results | Standardized SOPs, equipment calibration | | Delayed testing | Sample degrades between collection and testing | Same-day or next-day delivery to lab |

Lab Testing Methods Summary

| Method | Full Name | Used For | How It Works | |--------|-----------|----------|-------------| | HPLC | High-Performance Liquid Chromatography | Cannabinoid potency | Separates compounds in liquid phase at room temperature | | GC | Gas Chromatography | Terpene analysis, legacy potency | Separates compounds by heating to vapor phase | | LC-MS/MS | Liquid Chromatography-Tandem Mass Spectrometry | Mycotoxins, pesticides | Separates and identifies compounds by molecular mass | | ICP-MS | Inductively Coupled Plasma Mass Spectrometry | Heavy metals | Ionizes sample, measures elemental composition | | qPCR | Quantitative Polymerase Chain Reaction | Microbials (specific pathogens) | Detects DNA of specific organisms | | Culture-based | Plating and colony counting | Microbials (total counts) | Grows organisms on media, counts colonies (CFU) | | Karl Fischer | Karl Fischer titration | Moisture content | Measures water via chemical reaction | | Microscopy | Visual/optical microscopy | Foreign material | Physical examination under magnification |

---

Glossary of COA Terms

| Term | Definition | |------|-----------| | Action level | Maximum allowable concentration of a contaminant (e.g., pesticide, heavy metal). Exceeding the action level = test failure. | | Aw (water activity) | Measure of available water for microbial growth, on a 0-1 scale. Lower = less available water = less spoilage risk. | | Batch | A defined production unit of cannabis product. All products in a batch share the same COA. | | CFU/g | Colony-forming units per gram. Standard measure of microbial contamination. | | Decarboxylation | Heat-driven chemical reaction that converts THCa to THC (and CBDa to CBD) by removing a carboxyl group. | | LOD | Limit of Detection. The lowest concentration a lab can reliably detect. Results below LOD are reported as "ND" (not detected). | | LOQ | Limit of Quantification. The lowest concentration a lab can reliably measure with precision. Higher than LOD. | | ND | Not Detected. The analyte was below the lab's limit of detection. Does not mean "absent" -- it means below the detectable threshold. | | ppb | Parts per billion. Common unit for mycotoxin and heavy metal results. | | ppm | Parts per million. Common unit for pesticide and residual solvent results. 1 ppm = 1 mg/kg. | | Remediation | Re-processing a product that failed initial testing. Common methods: re-extraction, irradiation, ozone treatment. Retesting required. | | RSD | Relative Standard Deviation. Measure of variance in homogeneity testing. Lower RSD = more consistent dosing. | | Total THC | Calculated maximum THC content: (THCa x 0.877) + Delta-9-THC. The number on the product label. | | Total CBD | Calculated maximum CBD content: (CBDa x 0.877) + CBD. Same conversion factor as THC. | | Accreditation | Formal recognition that a testing lab meets specific competency standards (typically ISO 17025). | | Analyte | The specific substance being tested for. Each pesticide, cannabinoid, terpene, or metal on a panel is an individual analyte. | | BioTrack | A cannabis track-and-trace system used by some states (alternative to Metrc). | | Chain of custody | Documented trail showing how a sample was collected, transported, and handled from the point of sampling to the lab. Ensures sample integrity. | | Compliance testing | Testing required by state law before a product can be sold. Distinguished from voluntary or R&D testing. | | Desiccant | Moisture-absorbing material sometimes used in cannabis packaging to control humidity and extend shelf life. | | EVALI | E-cigarette or Vaping product use-Associated Lung Injury. Outbreak in 2019-2020 linked to vitamin E acetate in illicit vape cartridges. Led to additional testing requirements. | | Full-spectrum | An extract that retains the complete range of cannabinoids, terpenes, and other plant compounds from the source material. Valued for the entourage effect. | | Homogeneous | Evenly distributed. A homogeneous edible has the same cannabinoid content in every serving. | | Isolate | A cannabis extract refined to a single, pure compound (e.g., CBD isolate is 99%+ CBD with no other cannabinoids or terpenes). | | Lab accreditation body | Organizations that accredit cannabis testing labs, such as A2LA (American Association for Laboratory Accreditation) or ANAB (ANSI National Accreditation Board). | | Matrix | The type of material being tested (flower, concentrate, edible, topical). Different matrices require different sample preparation and may have different action levels. | | Metrc | The most widely used cannabis track-and-trace system in the US, used by California, Colorado, Oregon, Michigan, and many other states. | | Proficiency testing | A quality control process where labs test blind samples with known values to verify their accuracy. | | QR code | Quick Response code printed on cannabis packaging that links to the product's COA or testing results. | | Quarantine | The period during which a cannabis product awaits test results and cannot be sold. | | R&D testing | Testing performed for research and development purposes, not for regulatory compliance. Often used to optimize cultivation or processing methods. | | Remediation | Re-processing a product that failed initial testing. Common methods: re-extraction, irradiation, ozone treatment. Retesting required. | | Sample | A representative portion of a cannabis batch submitted for testing. Proper sampling technique is critical for accurate results. | | Solventless | Produced without chemical solvents. Includes rosin (heat + pressure), ice water hash, and dry sift/kief. | | VEA | Vitamin E Acetate. Thickening agent found in illicit THC vape cartridges, identified as the primary cause of the EVALI outbreak. | | Yield | The amount of extract produced from a given amount of starting material. Affects cost and, indirectly, testing requirements. |

---

Frequently Asked Questions

Q: How do I know if a COA is real/authentic? A: Verify through the testing lab's website using the batch number or sample ID printed on the COA. Most accredited labs maintain searchable databases. If the lab's website does not have the COA, it may be fraudulent. Also check that the lab appears on the state's list of approved testing laboratories.

Q: Can a product fail one test panel but pass others? A: Yes. Panels are independent. A product can pass potency, terpenes, and heavy metals but fail pesticides. In most states, a failure on any required panel means the product cannot be sold until it passes remediation and retesting (if the state allows remediation for that type of failure). Some failures (like mycotoxins) cannot be remediated.

Q: Why does the same strain test differently from different growers? A: Terpene and cannabinoid expression is influenced by genetics, growing medium, nutrients, light spectrum and intensity, temperature, humidity, harvest timing, and post-harvest handling (drying, curing). Two growers starting with the same genetic clone will produce different COA results. This is why COAs are batch-specific, not strain-specific.

Q: What does "ND" (Not Detected) mean on a COA? A: "Not Detected" means the analyte was present below the lab's Limit of Detection (LOD). It does not mean the substance is completely absent -- it means the amount is too small to reliably measure. For safety panels (pesticides, heavy metals), ND is the best possible result. For cannabinoids or terpenes, ND means the compound is present only in trace amounts.

Q: How often should a retailer request new COAs from suppliers? A: Every time a new batch is received. If the batch number on the product packaging differs from the last COA on file, a new COA is needed. Best practice: verify batch number on receipt and confirm a matching COA is available before accepting delivery.

Q: What is the difference between "action level" and "zero tolerance"? A: An action level is a specific numeric threshold -- the product passes if the contaminant is below the level, fails if above. "Zero tolerance" means the product fails if the contaminant is detected at any level above LOD. Oregon uses zero tolerance for many pesticides, meaning any detectable amount results in failure.

Q: Do medical cannabis products have different testing requirements than adult-use? A: In most states, medical and adult-use products go through the same testing panels. However, medical products may have stricter action levels (lower thresholds for contaminants) and may be allowed higher potency limits (especially for edibles). Some states maintain separate testing frameworks for medical and adult-use.

Q: Can a consumer get their own cannabis tested? A: Some testing labs accept consumer samples for private testing, but this is not available in all states and is typically expensive ($200-500+). Some states prohibit labs from testing unlicensed cannabis. Consumer testing is primarily useful for verifying claims about products purchased from licensed dispensaries.

Q: What happens to products that fail testing? A: Depending on the state and the type of failure:

• Remediable failures (microbials, moisture): Product can be re-processed (irradiated, re-dried) and retested
• Non-remediable failures (mycotoxins, certain pesticides): Product must be destroyed
• Remediation not allowed (some states for certain failures): Product must be destroyed
• In all cases, failed products must remain in quarantine and be tracked in the seed-to-sale system

Q: Why do some COAs show different THC numbers on the same page? A: A COA may show THCa, Delta-9-THC, and Total THC. These are related but different measurements. THCa is the raw acid form. Delta-9-THC is the active form. Total THC is the calculated maximum if all THCa were converted. Additionally, some COAs show results both as percentage and mg/g (which differ by a factor of 10).

Q: Are there COA standards for hemp vs cannabis? A: Yes. Hemp products (defined as <0.3% Delta-9-THC by dry weight under federal law) have their own testing requirements under the 2018 Farm Bill and subsequent state programs. Hemp COAs must verify that Delta-9-THC is below the 0.3% threshold. Cannabis (marijuana) products are tested under state cannabis programs with no federal framework. The testing methodologies are similar but the regulatory context is different.

---

Industry Issues in Cannabis Testing

THC Inflation and Lab Shopping

The problem: Some cannabis testing labs report higher THC potency numbers than the product actually contains. Producers then preferentially send samples to these labs because higher THC numbers on the label command higher wholesale and retail prices.

How it works:

• Lab A consistently reports THC results 2-5% higher than Lab B for the same product
• Producers learn which labs report higher and direct their testing there
• Labs that report "low" (accurate) results lose customers to labs that report "high" (inflated) results
• This creates a race to the bottom where accuracy is penalized and inflation is rewarded

Evidence:

• A 2020 University of Northern Colorado study found significant discrepancies between labs testing identical samples
• Colorado MED investigations have resulted in lab suspensions and penalties
• A 2022 PSI Labs study in Michigan found that 50% of products exceeded labeled THC by more than 15%
• Oregon has documented cases of labs losing accreditation over inflated potency results

Impact on the industry:

• Consumers lose trust in potency labels
• Honest labs are at a competitive disadvantage
• Products labeled at 30%+ THC may actually test at 22-25% -- a meaningful difference for dosing
• Retail purchasing decisions based on inflated numbers lead to suboptimal product selection

What states are doing:

• Mandatory proficiency testing programs (sending labs blind samples with known potency)
• Inter-laboratory comparison programs (same sample tested by multiple labs)
• Random compliance testing of products at retail (re-testing products already on shelves)
• Stricter accreditation standards and more frequent audits
• Some states considering a single state-run lab or rotating lab assignments

Practical relevance: When migrating product data, THC percentages from the source POS may reflect inflated results from the original testing lab. There is no way to correct this during migration -- the data should be migrated as-is, with the understanding that potency accuracy varies by testing lab and state.

The EVALI Crisis and Its Impact on Testing

Background: In late 2019 and early 2020, a nationwide outbreak of e-cigarette or vaping product use-associated lung injury (EVALI) hospitalized thousands and killed dozens of people. The primary cause was identified as vitamin E acetate (VEA), a thickening agent used in illicit THC vape cartridges to dilute concentrates while maintaining visual viscosity.

Impact on testing requirements:

• Several states added vitamin E acetate screening to their required testing panels for vape products
• California, Colorado, and Oregon specifically require VEA testing for inhalable concentrates
• The crisis accelerated the push for comprehensive testing of all cannabis products
• Consumer awareness of testing and COA verification increased dramatically

Why EVALI matters for this reference:

• EVALI demonstrated that untested cannabis products can cause serious, life-threatening harm
• It underscored the importance of purchasing tested products from licensed dispensaries
• The crisis remains a powerful argument for mandatory comprehensive testing
• Some states added testing panels specifically in response to EVALI that were not previously required

Current status (as of March 2026): VEA is largely eliminated from licensed, tested products. The risk remains in unregulated/illicit market vape cartridges where no testing is required. States that implemented VEA screening maintain it as part of their standard vape cartridge testing panels.

Sample Preparation and Its Effect on Results

The underappreciated variable: How a lab prepares a cannabis sample before testing can significantly affect results. This is one reason identical products can produce different results at different labs.

Key sample preparation variables:

| Variable | Effect on Results | Magnitude | |----------|------------------|-----------| | Grinding consistency | Finer grind = more surface area = higher extraction efficiency | 5-10% variance | | Sample size | Larger samples reduce heterogeneity effects | 2-5% variance | | Temperature during prep | Heat degrades THCa and terpenes | 3-8% variance | | Moisture equilibration | Wet samples test lower (dilution effect) | 5-15% variance | | Extraction solvent | Different solvents extract cannabinoids with different efficiency | 5-10% variance | | Homogenization method | Blending vs grinding vs freezing and crushing | 3-7% variance |

Why this matters: A lab reporting "28% THCa" and another reporting "26% THCa" for the same flower batch may both be accurately measuring their respective samples -- the difference could be attributable to sample preparation differences, not analytical error. This is why comparing potency numbers across different labs requires caution.

Turnaround Time and Cost

Typical testing timelines:

| Panel | Turnaround Time | Approximate Cost (per sample) | |-------|----------------|-------------------------------| | Potency | 1-3 business days | $30-75 | | Full terpene panel | 1-3 business days | $50-100 | | Pesticides | 2-5 business days | $100-250 | | Heavy metals | 2-5 business days | $50-100 | | Microbials | 3-7 business days (culture-based) | $75-150 | | Mycotoxins | 2-5 business days | $50-100 | | Residual solvents | 1-3 business days | $50-100 | | Moisture/Aw | 1-2 business days | $25-50 | | Foreign material | 1-2 business days | $25-50 | | Homogeneity | 3-5 business days | $100-200 | | Full compliance panel | 5-10 business days | $400-1,000+ |

Cost drivers:

• California testing is typically the most expensive due to the most comprehensive requirements
• Volume discounts are common for large producers
• Rush processing (24-48 hour turnaround) typically costs 50-100% more
• Retesting after remediation adds full testing cost again

Impact on business operations:

• 5-10 day turnaround means product sits in quarantine (not generating revenue) during testing
• Failed tests require remediation (if allowed by state) and retesting, adding weeks and cost
• Lab capacity constraints during harvest season can extend turnaround times significantly
• Some states allow conditional release (product can be shipped to distributor but not sold at retail until results are in)

COA Record Retention

How long must COAs be kept? Requirements vary by state, but common standards:

| Retention Requirement | States | |-----------------------|--------| | 2 years | Maine, Montana | | 3 years | Oregon, Washington | | 5 years | California, Colorado, Illinois | | 7 years | Massachusetts, Michigan | | Duration of license | Several states tie retention to license validity |

Best practice: Retain COAs for a minimum of 7 years regardless of state requirement. COAs serve as evidence of compliance in the event of a recall, lawsuit, or regulatory investigation. Digital storage (PDF) is acceptable in all states.

Migration relevance: When migrating POS data, COA documents (PDFs, images) should be migrated along with product data when possible. The COA itself is a compliance document, not just a data source.

---

Interpreting COA Results by Product Type

Flower / Pre-rolls

Expected ranges:

| Metric | Low | Average | High | Exceptional | |--------|-----|---------|------|-------------| | Total THC | 10-15% | 18-25% | 25-30% | 30-35% | | Total CBD (THC strain) | <0.5% | <0.5% | <0.5% | <0.5% | | Total CBD (CBD strain) | 5-10% | 10-15% | 15-20% | 20-25% | | Total terpenes | 0.5-1% | 1-2.5% | 2.5-4% | 4-6%+ | | Moisture content | 8-10% | 10-12% | 12-14% | N/A | | Water activity | 0.50-0.55 | 0.55-0.62 | 0.62-0.65 | N/A |

Red flags on flower COAs:

• Total THC >35%: Almost certainly inflated. Very few strains genuinely test this high.
• Total terpenes <0.5%: Indicates poor quality, improper storage, or old product.
• CBN >1%: Product is degrading. THC converts to CBN over time and with heat/light exposure.
• Moisture >14%: High mold risk. Should not pass water activity testing.
• No terpene data in a state that requires it: Compliance issue.

Concentrates

Expected ranges by type:

| Concentrate Type | Total THC | Total Terpenes | Typical Testing | |-----------------|-----------|----------------|-----------------| | Distillate | 85-95% | <1% (often re-added) | Potency, solvents | | Live resin | 60-85% | 5-15% | Full panel + solvents | | Live rosin | 60-80% | 5-12% | Full panel (no solvents) | | Shatter | 70-90% | 1-5% | Full panel + solvents | | Budder/Badder | 70-85% | 3-8% | Full panel + solvents | | Rick Simpson Oil (RSO) | 60-80% | Variable | Full panel + solvents | | Ice water hash | 40-70% | 3-8% | Full panel (no solvents) | | Dry sift / Kief | 30-60% | 2-6% | Full panel (no solvents) |

Red flags on concentrate COAs:

• Residual solvents approaching action levels: Indicates insufficient purging
• Pesticide detection at any level: Concentrates amplify contaminant concentration
• Terpene content <1% on live resin: Product may not be true "live" (flash-frozen) resin
• Very high THC (>95%) with significant terpene content: Unusual combination; verify methodology

Edibles / Infused Products

Expected ranges:

| Metric | Standard Adult-Use | Standard Medical | Notes | |--------|-------------------|------------------|-------| | THC per package | 100mg (max in most states) | 200-500mg+ (varies) | State-set limits | | THC per serving | 5-10mg | 10-50mg+ | Most common: 10mg per serving | | Dose variance (RSD) | <15% (good) | <10% (good) | Lower = more consistent | | CBD per package | Variable | Variable | Common in balanced products |

Red flags on edible COAs:

• Per-serving variance >20% RSD: Poor manufacturing consistency
• Any individual serving >15% above labeled dose: Potential compliance issue
• Total package potency >15% below label: Consumer is underdosed; label inaccuracy

---

COA Data in the Cannabis Supply Chain

The Flow of COA Data

Cultivator/Processor → Testing Lab → COA Issued → Distributor → Retailer → Consumer

At each step, COA data may be:

1. Entered into the track-and-trace system (Metrc, BioTrack, etc.) -- potency and pass/fail results
2. Uploaded to the POS system as a product attribute (THC%, CBD%, terpene profile)
3. Printed on the product label (Total THC, Total CBD, sometimes terpenes)
4. Made available to consumers via QR code, retailer request, or brand website

Common Data Loss Points

| Stage | What Gets Lost | Why | |-------|---------------|-----| | Lab → Track-and-trace | Minor cannabinoids, detailed terpene data | Track-and-trace systems may only capture potency and pass/fail | | Track-and-trace → POS | Terpene profile, individual cannabinoid results | POS systems may only have fields for THC%, CBD%, and pass/fail | | POS → Product label | Everything except Total THC, Total CBD, and sometimes dominant terpenes | Label space is limited; regulations specify minimum required info | | POS migration | All data not mapped in the source POS | Legacy POS systems may have stored COA data in free-text notes fields |

Migration implication: The farther downstream you are from the original COA, the more data has been lost. During migrations, if the source POS has limited COA data, the original COA documents (PDFs) are the most reliable source for populating product attributes in the target system.

COA Verification Tools

Several services help verify COA authenticity and accuracy:

• Confident Cannabis: Cloud platform where labs upload results; retailers and consumers can verify by scanning a QR code or entering a batch number
• Metrc Integration: In states using Metrc for track-and-trace, COA results are linked directly to the batch in the system
• Lab websites: Most accredited labs maintain searchable databases of their results
• State regulatory portals: Some states (California, Colorado) offer public databases of testing results

---

Track-and-Trace Integration

How COA Data Flows Through Track-and-Trace Systems

In legal cannabis markets, COA data is integrated with the state's seed-to-sale tracking system. The two major systems are Metrc (used by the majority of states) and BioTrack (used by a smaller number of states).

Metrc integration flow:

1. Sample creation: When a sample is pulled from a batch, a sample package is created in Metrc with a unique tag number
2. Lab receives sample: The lab logs receipt of the tagged sample in Metrc
3. Testing performed: Lab conducts all required panels
4. Results uploaded: Lab uploads results directly to Metrc, linked to the sample tag
5. Batch released or held: Based on results, the production batch is either released for sale or held for remediation
6. Retail tracking: When the product reaches a dispensary, the batch retains its link to the COA in Metrc

Data captured in Metrc from COA results:

• Total THC percentage
• Total CBD percentage
• Pass/fail status for each required safety panel
• Lab name and license number
• Test date and report number
• Batch/lot number linkage

Data NOT typically captured in Metrc:

• Individual terpene percentages (stored in lab reports but not in Metrc fields)
• Individual minor cannabinoid percentages
• Detailed numerical results for safety panels (only pass/fail)
• Lab methodology details

Migration implication: When migrating from one POS to another, Metrc data can serve as a backup source for potency information. If the source POS has incomplete COA data, Metrc records may have the potency values that can fill gaps. However, Metrc data is limited to the fields the state captures, which is typically just Total THC, Total CBD, and pass/fail.

Track-and-Trace Systems by State

| System | States | |--------|--------| | Metrc | Alaska, California, Colorado, DC, Louisiana, Maine, Maryland, Massachusetts, Michigan, Missouri, Montana, Nevada, Ohio, Oklahoma, Oregon, West Virginia | | BioTrack | Hawaii, Illinois, New Hampshire, New Mexico, New York, North Dakota | | Leaf Data Systems | Washington | | State-built/Other | Connecticut, Minnesota, Vermont, and others with custom systems |

Why this matters for catalog management: The track-and-trace system is often the source of truth for product compliance data. POS systems pull potency and compliance data from the track-and-trace system. During migrations, understanding which track-and-trace system the state uses can help identify where to find authoritative COA data when the source POS is incomplete.

---

COA Data Quality Assessment

Evaluating COA Data in a Product Catalog

When auditing catalog data quality or performing a migration, assess COA-derived data fields using this framework:

| Quality Level | Criteria | Score Impact | Action | |---------------|----------|-------------|--------| | Complete | THC%, CBD%, terpene profile, batch #, test date all present from COA | High quality score | No action needed | | Adequate | THC% and CBD% present, terpene data missing, batch # present | Moderate quality score | Flag for terpene data enrichment if available | | Minimal | Only THC% present (single field), no batch linkage | Low quality score | Verify source; may need COA re-entry | | Estimated | Potency values present but clearly estimated (round numbers like "20%" without decimals) | Low quality score | Flag for verification against actual COA | | Missing | No potency data at all | Failing quality score | Manual COA entry required; high priority | | Stale | Potency data present but batch number doesn't match current inventory | Misleading | Update with current batch COA data |

Signs of COA Data Problems in a Catalog

| Red Flag | What It Indicates | Recommended Action | |----------|-------------------|-------------------| | All products at exactly the same THC% | Copy-paste error or template data | Review each product against its actual COA | | THC% values without decimals (20%, 25%, 30%) | Estimated, not from actual COA | Flag for COA verification | | No CBDa/THCa separate from CBD/THC | Source POS may only store total values | Accept as-is; note limitation | | Terpene data for some products but not others | Inconsistent data entry practices | Flag gaps; prioritize high-visibility products | | Batch numbers missing or identical across products | Poor data hygiene | Verify with distributor/producer | | Test dates >12 months old | Product may have been restocked with new batch | Request current COA from supplier | | Potency >40% for flower | Likely data entry error or THC inflation | Verify against COA; flag for review | | CBD% >0.5% on a THC-dominant strain | Unusual but possible; may indicate a 1:1 or balanced strain | Verify product type classification |

COA Data Freshness

How long is COA data valid? Technically, a COA is valid for the specific batch it tested -- forever. But in practice, product quality changes over time:

• Terpenes degrade: Total terpene content decreases with storage, especially for flower. A COA from 6 months ago accurately reflects the terpenes at time of testing, but current product may have significantly less.
• THC converts to CBN: Over time and with heat/light exposure, THC degrades to CBN. Very old product may have lower THC and higher CBN than the original COA reports.
• Moisture changes: Storage conditions affect moisture content and water activity. Original COA moisture readings may not reflect current conditions.

Best practice: COA data is most trustworthy within 6 months of the test date for flower products. For concentrates and edibles (more stable), 12 months is reasonable. Beyond these timeframes, the COA is still a valid compliance document, but the product's actual profile may have shifted.

---

Last updated: March 2026 This reference is hand-authored and maintained. Testing requirements change frequently -- verify current state regulations before making compliance decisions. Cross-reference: cannabinoids.md for cannabinoid science, terpenes.md for terpene encyclopedia