Last Updated: April 2026

Quick Answer

A Certificate of Analysis (COA) is a third-party lab report that verifies exactly what is in your THC gummies — cannabinoid potency, contaminant levels, and overall safety. COAs are produced by independent, accredited laboratories and serve as the only reliable proof that a product matches its label claims. Always check the COA before buying any THC gummy product.

What Is a Certificate of Analysis?

A Certificate of Analysis is a formal laboratory document produced by an independent, third-party testing facility that analyzes and reports the chemical composition and safety profile of a cannabis or hemp-derived product. In the THC gummy market, COAs are commonly referred to as “third-party lab tests,” “lab reports,” or simply “test results.”

What makes a COA credible is the laboratory behind it. Legitimate testing labs hold ISO/IEC 17025 accreditation, the international standard for testing and calibration laboratories. This accreditation is typically granted by bodies such as the American Association for Laboratory Accreditation (A2LA) or the ANSI National Accreditation Board (ANAB). ISO/IEC 17025 requires labs to demonstrate technical competence, maintain validated testing methods, participate in proficiency testing programs, and follow strict quality management systems.

Third-party testing matters because it eliminates the conflict of interest inherent in in-house testing. When a company tests its own products, there is a financial incentive to report favorable results. Independent labs have no stake in the outcome, which is why most state cannabis programs and the USDA hemp testing framework require third-party testing from accredited facilities. The USDA requires DEA-registered laboratories for hemp compliance testing, though enforcement of this requirement has been delayed until December 31, 2026.

Why COAs Matter for THC Gummies

Label Accuracy Problems

Independent testing has repeatedly exposed widespread labeling inaccuracies across the cannabis and hemp product market. A landmark 2017 study published in the Journal of the American Medical Association (JAMA) examined 84 hemp-derived CBD products purchased online and found that approximately 70% inaccurately reported their CBD concentration. Some products contained more THC than advertised, potentially exposing consumers to unexpected intoxicating effects. A 2023 UK study reinforced these findings, reporting that only 8% of 63 products tested contained cannabinoid concentrations within 10% of their advertised levels. Without independent verification through COAs, consumers are essentially trusting label claims with no evidence behind them.

Contamination Risks

THC gummies can harbor contaminants introduced during cultivation, extraction, or manufacturing. Pesticide residues, heavy metals absorbed from soil, residual solvents from extraction processes, and microbial pathogens from poor manufacturing hygiene all pose real health risks. The FDA has issued multiple warning letters to delta-8 THC companies specifically citing contamination concerns and unsafe manufacturing processes. Between January 2021 and February 2022 alone, poison control centers received 2,362 delta-8 exposure cases, with 8% requiring ICU admission.

Legal Compliance

COAs serve as the primary documentation proving a hemp-derived THC product meets legal requirements. Under current federal law, hemp-derived products must contain no more than 0.3% delta-9 THC by dry weight. With the passage of P.L. 119-37 (Section 781), the legal landscape shifts dramatically effective November 12, 2026 — the definition changes from delta-9 THC only to total THC (including delta-8, delta-10, THCA, and all THC isomers), with a strict 0.4 mg total THC per container cap on finished products. COAs that test for total THC will become essential for any product claiming legal compliance. For a full overview of the current legal landscape, see our guide to THC gummy legality.

Consumer Protection

Many states now require COAs as a condition of sale. Texas DSHS requires COAs for all consumable hemp products with batch numbers and THC content on labels. California mandates full contaminant testing with COA access via QR code on the label. Colorado enforces strict testing and labeling compliance under SB 23-271, with the AG imposing penalties up to $20,000 per violation per product per day. Florida’s FDACS has escalated enforcement through 2025-2026 with warnings, fines, and license suspensions for untested or mislabeled products.

13 Testing Categories Explained

A comprehensive “full-panel” COA covers the following testing categories. Not all COAs include every category — the more panels covered, the more thoroughly a product has been vetted.

1. Cannabinoid Potency

The potency panel reports concentrations of individual cannabinoids including delta-9 THC, CBD, CBN, CBG, CBC, THCA, CBDA, and others. Results are expressed in percentage (%) and milligrams per serving (mg/serving). For THC gummies, the mg/serving figure tells you exactly how much THC is in each piece. This panel distinguishes between delta-9 THC and total THC, a critical distinction under evolving federal law. To learn more about minor cannabinoids like CBN, CBG, and CBC, see our dedicated guide.

2. Pesticide Screening

Pesticide panels screen for 60 to 100+ analytes, including organophosphates, pyrethroids, and fungicides. Myclobutanil is particularly important — banned in cannabis cultivation in many states because it releases hydrogen cyanide gas when heated. Other commonly tested pesticides include bifenazate, imidacloprid, spiromesifen, and abamectin. Results are reported in parts per billion (ppb) or parts per million (ppm) and compared against state-specific action levels.

3. Heavy Metals

Heavy metals testing focuses on the “Big Four”: lead, cadmium, arsenic, and mercury. Cannabis plants are effective bioaccumulators, readily absorbing heavy metals from contaminated soil and water. Chronic exposure can cause neurological damage, kidney disease, and cancer. Results are reported in ppm and compared against FDA limits and state-specific thresholds. Some advanced panels also test for chromium and nickel from extraction equipment.

4. Residual Solvents

During extraction, solvents like butane, propane, ethanol, hexane, and isopropanol separate cannabinoids from plant material. Residual solvents testing ensures these chemicals have been adequately purged. The United States Pharmacopeia (USP) Class 1, 2, and 3 solvent classifications guide acceptable limits. CO2-extracted products may show minimal residues, while hydrocarbon extractions require more rigorous purging.

5. Microbial Testing

Microbial panels screen for E. coli, Salmonella, total yeast and mold counts (TYM), and specific Aspergillus species (A. fumigatus, A. flavus, A. niger, A. terreus). These organisms can cause serious infections, particularly in immunocompromised individuals. Total yeast and mold counts are reported in colony-forming units per gram (CFU/g), with most states setting action levels between 1,000 and 10,000 CFU/g. Salmonella and E. coli are tested on a detect/non-detect basis — any detection is an automatic fail.

6. Mycotoxins

Mycotoxins are toxic secondary metabolites produced by certain mold species. Primary targets are aflatoxins B1, B2, G1, and G2 (produced by Aspergillus flavus and A. parasiticus) and ochratoxin A (produced by Aspergillus ochraceus and Penicillium species). Aflatoxins are classified as Group 1 carcinogens by the International Agency for Research on Cancer (IARC). Total aflatoxin limits in most state cannabis programs range from 20 to 100 ppb, while ochratoxin A is typically capped at 20 ppb.

7. Moisture Content

Moisture content measures the percentage of water in a product by weight. For THC gummies, elevated moisture creates an environment conducive to microbial growth and accelerates cannabinoid degradation. Most edible products target moisture content below 10-15%. This test directly relates to shelf life — higher moisture means shorter stability. See our guide on whether THC gummies expire for more.

8. Water Activity

Water activity (Aw) measures available water microorganisms can use for growth, on a scale of 0 to 1. It differs from moisture content because it measures available water rather than total water. The FDA sets a limit of 0.65 Aw for shelf-stable products. Most bacteria cannot grow below 0.91 Aw, most yeasts below 0.88, and most molds below 0.80. Gummies typically have water activity between 0.45 and 0.65.

9. Foreign Matter

Foreign matter inspection is a visual and sometimes microscopic examination for physical contaminants such as hair, insects, glass, metal, sand, and soil. While less technically sophisticated than chemical testing, this panel catches manufacturing hygiene failures that other tests cannot detect.

10. Terpene Profile

Terpene profiling identifies aromatic compounds including myrcene (earthy), limonene (citrus), pinene (pine), linalool (floral), and beta-caryophyllene (peppery). While not a safety test, terpenes contribute to the entourage effect — the theory that cannabinoids and terpenes work synergistically. Full-spectrum products should show a diverse terpene profile; isolate-based products will show minimal or no terpenes.

11. Homogeneity Testing

Homogeneity testing verifies that THC is evenly distributed throughout a batch. This is critical for dosing accuracy — if unevenly mixed, one gummy might contain 15 mg while another contains only 2 mg. Testing involves analyzing multiple samples from different positions within a batch. Acceptable variation is typically within 10-15%. Poor homogeneity is one of the most common manufacturing defects in cannabis edibles.

12. Stability Testing

Stability testing evaluates how a product holds up over time under accelerated aging conditions (elevated temperature, humidity, and light). This validates shelf life claims by projecting how cannabinoid potency, microbial counts, and physical characteristics change. Not all COAs include stability data, but reputable manufacturers conduct these studies.

13. Total THC vs. Delta-9 THC

The most consequential testing category under current law. The 2018 Farm Bill measured only delta-9 THC, allowing products high in THCA, delta-8, or other isomers to remain technically legal. Under P.L. 119-37 (Section 781), effective November 2026, the standard shifts to total THC — the sum of all THC isomers. Combined with the 0.4 mg total THC per container cap, COAs must report total THC to demonstrate compliance. For more on legal implications, see our legality guide.

How to Read a COA: 6-Step Guide

Key Terminology

  • NT (Not Tested) — The compound was not analyzed
  • ND (Non-Detectable) — Tested for but not found at detectable levels
  • LOQ (Limit of Quantitation) — Lowest concentration reliably measured
  • LOD (Limit of Detection) — Smallest amount lab equipment can distinguish from noise
  • Action Level — Maximum allowable concentration; exceeding means product fails
  • CFU/g — Colony-forming units per gram for microbial counts
  • ppm / ppb — Parts per million / billion for contaminant concentrations

Step 1: Check the Header

Verify the report date — COAs older than 12 months should be considered expired. Confirm the laboratory name and accreditation credentials (ISO/IEC 17025, A2LA). Match the product name to your product. Confirm the batch or lot number matches your packaging.

Step 2: Review the Results Summary

Look for the pass/fail summary table. “Pass” means the product met all action levels. Any “Fail” means it exceeded allowable limits. If any category shows a fail, do not consume the product.

Step 3: Examine the Potency Panel

Confirm delta-9 THC mg per serving matches the label claim within 10-15%. Check whether total THC is reported. Full-spectrum products should show 5+ cannabinoids; isolate products will show primarily one. If specific minor cannabinoids are claimed, verify they appear at meaningful concentrations.

Step 4: Assess Safety Results

Review pesticides, heavy metals, residual solvents, microbial, and mycotoxin panels. Compare each result against the action level. “ND” is ideal. Pay particular attention to heavy metals (lead and cadmium) and microbial results (total yeast and mold).

Step 5: Verify Laboratory Accreditation

Look for the lab’s ISO/IEC 17025 accreditation number. Verify on the A2LA or ANAB directory. Check that the lab holds the appropriate state license. Some states maintain public lab directories.

Step 6: Cross-Reference with Product Claims

Compare COA results to every label claim. Does THC per serving match? Does “full-spectrum” show diverse cannabinoids and terpenes? Does “pesticide-free” show all ND results? If the product advertises entourage effect benefits, verify the terpene profile. Any significant discrepancy is a red flag.

Red Flags on a COA

  • Missing batch or lot number — No way to confirm the COA matches your product
  • No laboratory accreditation — May come from an unqualified facility
  • In-house lab results — If the lab name matches the brand, testing is not independent
  • Incomplete panels — Only potency without safety testing is insufficient
  • Expired test dates — COAs older than 12 months may not reflect the current product
  • No QR code or direct link — Reputable companies make COAs easily accessible
  • Unusually perfect results — Every analyte reading “ND” across all panels may indicate fabrication

State-Specific Testing Requirements

Colorado has the most restrictive framework under SB 23-271, requiring full contaminant panels with penalties up to $20,000 per violation per product per day.

California requires full contaminant testing under CDPH regulations and AB 8. COAs must be accessible via QR code on the label.

Florida requires testing through FDACS, with enforcement escalating through 2025-2026 including fines and license suspensions.

Texas mandates COAs for all consumable hemp products under the DSHS Consumable Hemp Program.

The CANNRA 2025 Model Policy recommends standardized testing and labeling. Multiple states are expected to adopt elements through 2026-2027.

Frequently Asked Questions

Where do I find the COA for a THC gummy product?

Most reputable brands provide COAs on their website or via QR code on the packaging. If you cannot find one, contact the manufacturer — consider it a red flag if they cannot provide one.

How often should COAs be updated?

COAs should be produced for every production batch. Look for unique batch numbers matching your product. At minimum, COAs should be no older than 12 months.

Can a product pass a COA and still be unsafe?

Yes, if the COA only covers limited panels. Always look for full-panel COAs covering potency, pesticides, heavy metals, residual solvents, and microbial contamination.

What is the difference between ISO/IEC 17025 and A2LA?

ISO/IEC 17025 is the international standard for laboratory competence. A2LA is an accreditation body that evaluates labs against that standard. Other bodies like ANAB also assess against ISO/IEC 17025.

Will COA requirements change after November 2026?

Yes. Under P.L. 119-37 (Section 781), COAs will need to report total THC to comply with the new 0.4 mg total THC per container cap. Products tested only for delta-9 THC will no longer provide sufficient compliance documentation.

Are COAs required by law?

In most states with hemp programs, yes. California, Colorado, Texas, Florida, New York, Ohio, Michigan, and Tennessee all mandate third-party testing. The CANNRA 2025 Model Policy recommends standardized requirements nationwide.