A hemp product label tells you what the manufacturer wants you to know. A lab test — done by an accredited third party, summarized on a Certificate of Analysis — tells you what's actually in there. Understanding what the testing covers and what it doesn't is one of the most useful skills in this space.
Why testing exists in the first place
For most consumer products, you trust the label because regulatory infrastructure stands behind it. Food labels are regulated by the FDA. Drug labels are regulated by the FDA differently. Pesticide labels are regulated by the EPA. The label-to-reality match is enforced by government agencies with inspection authority, recall power, and the credibility of a long enforcement history.
Hemp products exist in a different regulatory zone. The 2018 Farm Bill legalized hemp at the federal level but didn't create a comprehensive regulatory framework for hemp-derived products. The FDA has authority over food and supplements but hasn't issued specific hemp-product rules. States have their own requirements that vary widely. The result is a patchwork where the gap between label claims and reality can be wide, and the enforcement to close that gap is uneven.
Independent lab testing fills the gap. A Certificate of Analysis (COA) from an accredited third-party lab is the closest thing to objective truth about what's in a hemp product. Reputable producers test every batch and publish the results. Less reputable producers don't.
What a COA actually measures
A complete COA typically covers four categories:
1. Cannabinoid potency
The lab measures the concentration of major cannabinoids in the product. For hemp products, this almost always includes:
- Delta-9 THC (federally required to be below 0.3% on dry weight basis)
- THCA
- CBD
- CBDA
- Total THC (calculated: Delta-9 THC + 0.877 × THCA)
- Total CBD (calculated similarly)
More detailed COAs also measure CBN, CBG, CBC, THCV, CBDV, and Delta-8 THC. The most comprehensive testing covers 11-15 cannabinoids in a single panel.
The measurement method is typically high-performance liquid chromatography (HPLC) for products tested at room temperature, or gas chromatography (GC) for products where the heating during analysis matters less. HPLC is generally considered the more accurate method for hemp products because it doesn't decarboxylate the sample during testing.
2. Pesticides
Comprehensive testing covers 60-80 specific pesticide compounds, screening for residues that can occur from spraying during cultivation or contamination from neighboring agriculture. Hemp readily accumulates pesticides from soil and surrounding air; this is part of why hemp has been considered for environmental remediation work.
The list typically includes organophosphates, carbamates, pyrethroids, and various fungicides. State regulations specify which pesticides must be tested for; the most common required lists cover the compounds most likely to cause health issues if consumed via inhalation or ingestion.
3. Heavy metals
Hemp also accumulates heavy metals from soil — particularly lead, cadmium, mercury, and arsenic. The accumulation is significant enough that hemp grown in certain agricultural soils can exceed safe consumption levels even with no direct contamination event.
COAs report heavy metal content in parts per million (ppm) or parts per billion (ppb), with action levels set by state regulators. Reputable producers source their hemp from clean soils and verify with testing every batch.
4. Microbial contamination and other safety markers
Testing screens for harmful bacteria (E. coli, Salmonella), molds (Aspergillus, particularly the toxin-producing species), and other microbial contaminants. For some product types, residual solvents from extraction are also measured — particularly for concentrates, where ethanol, butane, or propane residues from extraction can persist if not properly purged.
For smokable products, additional markers sometimes included: mycotoxins (toxic compounds produced by molds), residual fertilizers, and various plant byproducts that shouldn't be in finished product.
How to read a COA
A typical COA is a multi-page PDF that can be intimidating on first read. The key sections to find:
- Lab identification. Name, address, accreditation status of the testing lab. ISO 17025 accreditation is the standard for analytical labs. If you can't find the lab's accreditation, that's a yellow flag.
- Sample identification. What product was tested, batch/lot number, date of testing. The COA should match the batch number on the product you're buying. A COA from a different batch tells you about a different product.
- Cannabinoid potency table. Compound names down the left, concentrations on the right. Usually in both mg/g and percentage. The Delta-9 THC line is the federal compliance check.
- Pesticide panel. Often shown as "ND" (not detected) for compliant products, with the detection threshold listed. Anything above the threshold should show specific numbers.
- Heavy metals. Similar format — concentrations or "ND."
- Microbial panel. Pass/fail for each tested organism.
- Final disposition. Many COAs include a "PASS" or "FAIL" stamp indicating overall compliance with applicable regulations.
What a COA doesn't tell you
This is the underdiscussed part. A clean COA is necessary for product confidence, but it's not sufficient. Several important things lie outside what testing covers:
Time since testing
A COA dated six months ago tells you what the product was at that point in time. Cannabinoid profiles drift over time — THCA slowly decarboxylates to THC even in storage, terpenes evaporate, oxidation produces CBN. A six-month-old COA on a recently purchased product might not accurately represent what you're actually getting.
Batch consistency
Testing samples a representative portion of a batch, not every individual unit. Variations within a batch — from sampling location in a bag of flower, from individual gummies in a manufacturing run — are not captured. Most reputable producers manage batch variation well, but the COA doesn't directly measure it.
Long-term safety
Testing measures contaminants at thresholds determined to be acceptable by regulators. It doesn't speak to long-term health effects of regular hemp product use, which haven't been well-studied for most cannabinoid products. Absence of detected contaminants is good; presence of any cannabinoid product still represents an exposure with limited long-term data.
Terpene profiles
Many COAs don't include terpene testing at all. The ones that do typically cover 10-25 major terpenes. The full terpene profile — and the way it actually affects the experience of using the product — isn't reliably captured in standard testing.
The "feel" of the product
Two flowers with identical COAs can produce different experiences. The cannabinoid concentration measured matches; the cured quality, the breakdown of cannabinoid ratios, the trichome integrity, the terpene preservation — none of these are fully reflected in a COA.
Red flags when reading COAs
A few patterns that suggest you should question what you're seeing:
- No COA available. Reputable producers provide COAs for every batch. If you can't find one, ask. If they can't produce it, walk away.
- COA dated long before the product purchase. A COA from a year ago on a product that supposedly tested then but is being sold now is a problem — either the product is very old, or the COA doesn't represent it.
- Mismatched batch numbers. If the COA's batch number doesn't match what's on the product, you're looking at a COA for something else.
- Unaccredited lab. Real labs have ISO 17025 or equivalent accreditation. If the lab name doesn't appear in any accreditation registry, the test results are unverified.
- Suspiciously clean results. "ND" across every contaminant category for every product over a long period is unusual. Even good production has occasional flags. Universal cleanness suggests the testing might not be detecting what it should.
- Total THC at exactly 0.299%. Numbers that are suspiciously close to the legal threshold, particularly when reported across multiple products, can indicate creative laboratory practices.
What testing costs and who pays for it
Lab testing is meaningful overhead for hemp producers. A full panel — cannabinoid potency, pesticides, heavy metals, microbials, residual solvents, mycotoxins — typically costs $200-500 per batch tested. For a small producer running multiple batches per month, testing costs can run into thousands of dollars per month.
This cost gets passed through to consumers in product pricing. Part of the price differential between budget hemp products and premium ones reflects different levels of testing rigor. The cheapest products on the market have often skipped or skimped on testing; premium products have typically done more comprehensive testing than is legally required.
State regulations set minimum testing requirements, and these vary substantially. Some states require comprehensive testing of every batch; others require only basic cannabinoid potency testing. Some states require testing by state-licensed labs only; others accept any ISO-accredited lab. The patchwork means a product compliant in one state's testing regime may not meet another state's standards even when the underlying chemistry is identical.
For the conscientious producer, the testing economics are challenging. More testing increases costs and reduces margins. Less testing creates legal and reputational risk. The producers who land on the right balance — meaningful testing without unnecessary cost — are often the ones who build durable brands.
The bigger picture
Lab testing is the consumer protection backbone of the hemp industry. Without it, there's no objective way to know what's in any product, and the gap between marketing claims and reality could be — has been, historically — enormous.
The system isn't perfect. Different state requirements, different lab methodologies, different sampling practices, and varying enforcement create a market where good actors test thoroughly and bad actors don't. The COA is your tool for distinguishing between them. Learning to read one well, knowing what it covers and what it doesn't, and demanding access to current COAs for every product you buy — those are the practical skills that make the lab-testing infrastructure actually protective.
A clean COA isn't a guarantee. But a missing COA, or a COA you can't verify, tells you everything you need to know.
