How to Read a CBD Certificate of Analysis: Section by Section

The Certificate of Analysis (COA) is the single most important document in the CBD industry. It is the third-party laboratory report that transforms a brand's claims about its product from marketing statements into verified facts — or exposes them as fiction. A COA from an accredited laboratory is the difference between knowing what is in your CBD product and merely hoping the label is accurate. Given the documented prevalence of label inaccuracy in the unregulated CBD market — a 2017 Penn Medicine study found that 69% of CBD products tested were mislabelled, with either more or less CBD than claimed — the COA is not optional; it is mandatory for any responsible purchasing decision.

Understanding how to read a COA turns you from a passive consumer into an informed one. You do not need a chemistry degree to interpret the key sections; you need to know what to look for and what questions to ask. This guide walks through every section of a professional CBD COA, explains what the numbers mean, identifies the red flags that should cause you to reject a product, and describes how to verify that the laboratory conducting the analysis is genuinely accredited — and not a fictitious or unaccredited operation producing fraudulent documents.

The first thing to assess on any COA is the identity and accreditation of the laboratory that produced it. A COA is only as reliable as the laboratory that generated it. Self-testing — where a brand uses its own in-house lab — does not constitute independent third-party analysis regardless of how professional the report looks. The laboratory must be genuinely independent (no ownership or financial relationship with the CBD brand) and must hold recognised accreditation for analytical testing.

In the UK and Europe, the relevant accreditation is ISO/IEC 17025, the international standard for testing and calibration laboratory competence. ISO/IEC 17025-accredited laboratories have demonstrated to an independent accreditation body (UKAS in the UK) that their testing methods, equipment, personnel, and quality management systems meet defined standards for accuracy and reliability. The accreditation scope specifies exactly which test methods the accreditation covers — an important detail, because a laboratory may be ISO/IEC 17025-accredited for microbiological testing but not for cannabinoid analysis, meaning the cannabinoid results on a COA from that lab may not be within the accredited scope.

In the United States, the equivalent accreditation is typically ISO/IEC 17025 combined with state cannabis testing laboratory licensing. The DEA maintains a list of Schedule I analytical laboratories authorised to test cannabis-derived compounds — but this is separate from accreditation and does not certify analytical quality. For UK consumers, checking the UKAS accredited laboratory database at ukas.com and entering the laboratory's name is a 30-second verification step that provides genuine assurance. If the laboratory is not on the UKAS register, treat the COA with scepticism.

The COA must clearly identify the specific sample tested and link it to the product you hold. The critical data points to verify are:

• Batch/lot number: This must match the batch or lot number printed on your product packaging. If the numbers do not match, the COA was not produced for your specific batch — it may relate to an earlier or different production run with potentially different characteristics. This is the most commonly exploited COA shortcut: brands generate a COA for one batch and apply it to all subsequent batches indefinitely.
• Sample description: Should accurately describe the product type (e.g., "CBD oil, 10ml, 5% concentration, hemp seed oil carrier").
• Date of analysis: The COA should be dated within the last 12–18 months. A COA dated more than two years ago provides no assurance about the product you hold today, as formulations and suppliers can change.
• Client information: Should identify the brand/company that submitted the sample. A COA with no client information or with a generic placeholder name is a significant red flag.

Some laboratories now include a QR code or unique sample identifier on the COA that links to a verifiable online record in the laboratory's database. If this is present, scan or enter it to confirm the COA is genuine and was produced by that laboratory — this simple step rules out COA forgery, which does occur in the less reputable segments of the market.

The cannabinoid panel is the heart of the COA — it quantifies the actual cannabinoid content of the product, both in percentage terms and (critically) in milligrams per gram or milligrams per millilitre. For most consumer CBD products, the key cannabinoids that should be reported include:

• CBD (cannabidiol): Should align closely with the labelled claim. For a product claiming 1000 mg CBD in a 10ml bottle (10% w/v), the COA should show approximately 100 mg/ml. An acceptable variance is ±10–15%; larger discrepancies indicate quality control issues. Underdosing (less CBD than claimed) is unfortunately very common and represents consumer fraud.
• THCA and Δ9-THC: Both must be reported. THCA is the acidic precursor of THC — when heated (smoked, vaped, or vaporised), THCA converts to THC. The combined "total THC" figure must stay below the legal threshold: 1 mg per container in the UK. Total THC is calculated as: Δ9-THC + (THCA × 0.877).
• CBG, CBC, CBN, CBDV: Present in full-spectrum products; should be absent or at non-detectable levels in isolate. Their presence and quantities validate full-spectrum or broad-spectrum claims.
• CBDA: The acidic precursor of CBD; may be present in raw or minimally processed full-spectrum extracts. Not a legal concern but informative about processing.

Pay attention to whether results are reported as "as-is" or "dry basis". As-is results reflect the actual concentration in the product; dry basis results adjust for moisture content (relevant for flower and plant material but not for finished oils). For finished oil products, as-is figures are what matter. Also note the limit of quantification (LOQ) and limit of detection (LOD) for each analyte — results below LOQ are often reported as "

Terpene analysis is present on COAs from quality full-spectrum and broad-spectrum product manufacturers. It is typically absent from isolate COAs (correctly so, since isolates contain no terpenes) and its absence from a claimed full-spectrum product COA is a significant quality concern. A comprehensive terpene panel will list 20–30 individual terpene compounds with their concentrations expressed as percentage by weight (% w/w) or milligrams per gram.

The key terpenes to look for in a quality full-spectrum CBD COA: myrcene (typically the dominant terpene, >0.1% in a quality product), caryophyllene (anti-inflammatory, CB2 active), limonene, linalool, pinene (alpha and beta), terpinolene, ocimene, bisabolol. Total terpene content of 1% or above in the final oil indicates a well-preserved extraction process. Products with total terpenes below 0.1% have lost most of their terpene content through heat processing or age — the entourage effect will be substantially diminished.

Terpene profiles are also useful for verifying strain-specific claims. If a brand claims their oil is derived from a specific high-linalool, high-myrcene strain but the COA shows minimal linalool and myrcene with limonene as the dominant terpene, there is an inconsistency worth investigating. Authentic strain-specific terpene profiles can be cross-referenced against published chemotype data for well-characterised hemp cultivars.

The contaminant screening sections of a COA are as important as the cannabinoid panel, yet are often overlooked by consumers focused solely on CBD content. These screens address the most significant safety risks associated with CBD products.

• Pesticide screen: A comprehensive screen covers 50–200 pesticide and herbicide compounds. All results should read "ND" (not detected) or below action levels defined by the testing laboratory or applicable food safety standards (EU MRLs, or specific cannabis testing standards in the US). Any detected pesticide above LOQ warrants investigation. Hemp is a known phytoremediator that concentrates soil pesticides in plant tissues — organic or pesticide-free cultivation documentation from the grower is the first line of defence; the pesticide screen is the verification.
• Heavy metals: Lead, arsenic, cadmium, and mercury must be below action levels (typically aligned with EU food safety limits or the US EP method 3050B reference values). Hemp grown in contaminated soil can accumulate metals to harmful concentrations. A clean heavy metals screen is essential.
• Residual solvents: For products produced by ethanol or hydrocarbon extraction, Class 1 solvents (benzene, hexane) must be not detected; Class 2 solvents (ethanol, acetone, isopropanol) must be below ICH Q3C limits. CO₂-extracted products should show no solvent residuals.
• Microbial contamination: Total aerobic count, yeast and mould, E. coli, and Salmonella must all pass established food safety limits. Aflatoxin (a hepatotoxic mould metabolite) testing should also be present, particularly for products with extended shelf lives.

After reviewing hundreds of COAs, experienced CBD quality professionals have identified a set of red flags that should cause immediate rejection of a product or demand for clarification. The most important are:

• No batch number or batch number mismatch with the product: The fundamental purpose of a COA is batch-specific verification. Without matching lot numbers, the document is not a COA for your product.
• Unknown or clearly unaccredited laboratory: If you cannot verify the laboratory in the UKAS (UK) or state cannabis testing license database, the COA is not reliable. Laboratories with names designed to sound credible but with no verifiable existence are a red flag.
• CBD content significantly higher than labelled (>+20%): Overlabelling is a quality issue that can lead to unintended high dosing. Underlabelling (>-20% below claim) is more common and constitutes consumer fraud.
• THC above legal threshold: Any product showing total THC above 1 mg per container (UK) is illegal. This should be a hard rejection.
• Missing contaminant screens: A COA showing only cannabinoid results without pesticide, heavy metal, or microbial panels is incomplete. Demanding these sections is reasonable; a brand unable to provide them has not completed appropriate quality testing.
• COA dated more than 18 months ago: Does not assure the quality of current production batches.
• Identical COA used for products of different concentrations or formats: A 5% and a 10% CBD oil from the same brand having the same COA document is physically impossible if the testing is genuine.

COA forgery — while not prevalent among established brands — does exist in the CBD market, particularly among very low-price online sellers. Several steps can verify authenticity. First, contact the laboratory directly: email or call the laboratory shown on the COA, providing the sample ID or batch number, and ask them to confirm the report is genuine and in their system. A legitimate laboratory will be able to confirm this quickly. A laboratory that cannot find the sample or that does not respond to verification requests is a significant concern.

Second, cross-reference the laboratory's accreditation: check UKAS (ukas.com) for UK labs, the A2LA database (a2la.org) for US labs, or the relevant national accreditation body for other countries. Confirm the laboratory's accreditation is current (not expired or suspended) and that the scope covers cannabinoid analysis in food/supplement matrices. Third, look for digital signatures or timestamp verification on PDF documents: many modern laboratory information management systems (LIMS) produce digitally signed PDFs that can be verified using PDF signature tools to confirm the document has not been altered since issue. Finally, compare the COA typography, formatting, and laboratory contact details against other COAs from the same laboratory that you can independently access — gross inconsistencies suggest document manipulation.