How to Read a Hemp COA Like a Pro (in 60 Seconds)

A Certificate of Analysis is a lab report — proof, on paper, of what a product contains. A sample from a production batch is sent to a testing laboratory, the lab runs it through a series of analyses, and the COA is the document that comes back. It states the cannabinoid potency (how much delta-9 THC, CBD, CBN, and so on) and the results of a contaminant screen (pesticides, heavy metals, residual solvents, microbials).

The reason it exists is simple: you cannot tell any of this by looking at a gummy. A package can claim "10mg per piece" and be wildly off — or claim "hemp-derived and compliant" while testing over the legal THC limit. The COA exists so a neutral third party, not the brand's marketing department, puts a number on it. The key word is third-party. A report a brand generates about itself isn't worth much; a report from an independent, accredited lab is the entire point. This is why "show me the COA" is the first thing we ask of any brand, and why no product makes a Kind Buds list without one — see how we research every brand.

You'll also see two abbreviations show up constantly, and they're worth knowing cold: ND ("non-detect") means the lab looked and found nothing above its detection limit, and LOQ ("limit of quantitation") is the lowest amount the lab can measure as a precise number. A result below the LOQ usually gets reported as ND or "<LOQ" — not because the test failed, but because the instrument can't put an exact figure on something that small. Both are good things to see on a contaminant line.

Before you read a single number, you have to find the right report — the one for the product in your hand. The best brands print a QR code on the package that scans straight to the COA, or host a batch-lookup tool on the product page. The worst brands bury a single generic PDF somewhere, or have nothing at all.

This is the check almost everyone skips, and it's the one that separates a real safety document from a decorative one. If the report on the website was run on a different batch than the one you bought, it's telling you about someone else's gummies, not yours. No batch match means the document can't actually vouch for what you're holding — and that's a walk-away, no matter how good the numbers look.

A COA has a shelf life. Once you've confirmed the batch matches, check the test date printed on the report. Lab reports should be reasonably recent — from the same general production run as your product, not a single report from two years ago being reused across every batch since.

Why it matters: ingredients change, suppliers change, and formulations get reworked. An old report can't speak for a product made last month, even if the label looks identical. As a rule of thumb, a COA should be no older than the product's own production date, and for most edibles that means within roughly the last year. A report that's stale — or undated entirely — is a quiet red flag, because it suggests the brand isn't testing every batch and is hoping you won't notice.

Find the cannabinoid table — usually the first results section — and compare it to the package. This is the table that lists each cannabinoid (Delta-9 THC, CBD, CBG, CBN, and others) with an amount, typically in milligrams per serving, milligrams per package, or a percentage by weight. Your job is one quick comparison: does the number on the COA match the number on the label?

If the package says 10mg of delta-9 per gummy, the COA should confirm roughly that. A small variance is normal and expected — labs and manufacturing aren't perfect to the milligram. What you're watching for is a big discrepancy: a gummy labeled 10mg that tests at 2mg (you're overpaying for something weak) or at 25mg (a genuinely different, stronger product than advertised). Either direction is a problem, because it means the brand either can't or won't make what it says it makes.

• Close to label: good — the brand makes what it claims.
• Way under: you're paying for potency that isn't there.
• Way over: the serving is stronger than advertised, which matters for dosing.

One more thing to glance at on a hemp product: the delta-9 THC should read under 0.3% by dry weight, the federal threshold for legal hemp. A compliant brand will be comfortably under it. If you're still sorting out the difference between cannabinoids, our delta-8 vs. delta-9 explainer covers what each one actually is.

Potency tells you if the product works as advertised; the contaminant panel tells you if it's safe to consume. Hemp is a bioaccumulator — it readily pulls heavy metals and chemicals out of the soil it's grown in — so this section matters as much as the cannabinoid table. Scan down the panel and you want to see PASS or ND (non-detect) across the board. Here's what each line is checking, and why it's there:

• Pesticides: chemical residues left over from how the hemp was farmed. These can carry through extraction into the finished product, so you want ND or PASS.
• Heavy metals: lead, arsenic, cadmium, and mercury drawn up from contaminated soil — exactly the metals hemp is prone to absorbing. ND or within safe limits.
• Residual solvents: leftover chemicals (like ethanol, butane, or hexane) used to extract the cannabinoids and meant to be purged afterward. Anything still present should test ND or PASS.
• Microbials: mold, yeast, E. coli, salmonella, and similar biological contamination from growing, handling, or storage. PASS is what you're after.

A lab report is only as trustworthy as the lab that produced it. Two things make a lab credible. First, accreditation: look for ISO 17025, the international standard for testing-laboratory competence. An ISO 17025-accredited lab has been independently audited to prove its methods and equipment actually produce reliable results. The lab's name and accreditation are usually printed in the COA's header or footer.

Second — and this is the one people forget — the lab should be a separate company from the brand. If "Acme Hemp Co." sends its product to "Acme Testing Labs," that's not third-party testing; that's a brand grading its own homework. You want to see an independent lab name you can look up, with a real address and accreditation, that has no obvious ownership tie to the brand selling the product. Independence is the whole reason a COA is worth anything — and, as we'll cover next, it's also your best defense against a report that's been doctored.

Once you've run the checks a few times, the bad ones start to look obvious. Any single item below is enough to put the product back on the shelf — you don't need to finish every check if you hit one of these:

• No COA at all. The single biggest red flag. If a brand won't show you a lab report, assume there's a reason. This alone is a walk-away.
• The QR code goes nowhere — it 404s, lands on a generic homepage, or opens a marketing page instead of an actual report for your batch.
• The batch number doesn't match the one on your package, or the COA has no batch number at all.
• The contaminant section is missing — only potency is shown, with no pesticide, heavy-metal, solvent, or microbial results.
• The report is old (a year or more) and reused across every product, or it's undated entirely.
• The lab and the brand look like the same company, or there's no accreditation listed anywhere.
• The PDF looks edited — mismatched fonts, numbers that don't line up with the columns, a header from one lab and a footer from another, or a logo that's been pasted over. A genuine COA is a clean, consistent document straight from the lab's system.

None of these require you to be a chemist. They're document checks — and the brands worth buying from pass them without you having to ask twice.

Once you've done it a few times, the whole thing takes about a minute. Here's the routine to run every single time, in order:

• 1. Find the COA (10 sec). Scan the QR code or pull it up on the product page. No COA? Stop here — you're done.
• 2. Match the batch (15 sec). Confirm the batch/lot code on your package matches the COA.
• 3. Check the date (5 sec). Recent, not a years-old report reused across every batch.
• 4. Check potency (15 sec). Does the cannabinoid table roughly match the label? Is delta-9 under 0.3%?
• 5. Scan the contaminant panel (15 sec). Pesticides, heavy metals, solvents, microbials — all reading PASS or ND.
• 6. Glance at the lab (5 sec). Independent, ISO 17025-accredited, and not owned by the brand.

Pass all six and you're holding something legitimate. Fail any one and you've just saved yourself the money — and the gamble. This is exactly the gauntlet every product runs before it makes a Kind Buds list, including our roundups of the best delta-9 gummies, the best delta-8 gummies, and the best CBD gummies. If you're curious how a clean COA relates to passing or failing a workplace screen, that's a separate question we cover in do THC gummies show up on drug tests. You can browse every explainer in one place over on our learn hub. None of this is medical or legal advice — it's just how to read a document the right way. Hemp products are for adults 21 and over, and state laws vary, so check yours.