How to Read a CBD Certificate of Analysis—and Its Limits

Rules checked: November 6, 2026. Laws and agency guidance can change. This is general information, not legal or medical advice.

Verified November 6, 2026. Scan a CBD package's QR code and you may find a certificate of analysis, usually called a COA: a laboratory report describing test results for a product sample. The document can help you investigate what was measured. It cannot answer every question about the bottle, gummy or cream in your hand.

Illustration: an AI-generated editorial scene. The report and numbers pictured are fictional, not test results for a real product.

Read it as evidence with a defined scope, not a universal quality seal. The most useful sequence is to establish the sample's identity, understand the numbers, inspect the testing coverage, and then recognize what the report leaves unresolved.

First, connect the report to the product

Before looking at CBD content, check the identifying information. New York's Office of Cannabis Management (OCM) publishes a COA reading guide explaining fields such as lot identifier, batch/sample ID, sample type, collection date, received date, reported date and report status.

Use those fields to ask:

• Does the product name and form match what you have, rather than a different strength or an ingredient used to make it?
• Can the package's lot or batch identifier be connected to the report? A laboratory sample ID may be different; ask for the connection if it is unclear.
• Is this a completed, final report, rather than testing still in progress?
• Do the collection and reporting dates make sense for this product?

A recent date alone does not establish a match. Neither does a QR code leading to a general folder of reports. If you cannot identify the relevant report, the connection remains unverified—not necessarily fraudulent, but unresolved.

OCM's guide concerns New York's regulated cannabis market. Its explanations of report fields are useful here; its dispensary-specific rules should not be mistaken for nationwide CBD requirements.

Read the cannabinoid name and the unit together

A cannabinoid panel can list CBD, CBDA, delta-9 THC, THCA and other compounds separately, alongside calculated totals. Do not substitute one row for another or assume that a delta-9 THC result answers every question about total THC. Ask the laboratory what a reported total includes if the report does not explain it.

Next, identify the measurement basis. A percentage, milligrams per gram, milligrams per serving and milligrams per package are not interchangeable readings. Comparing a package claim with a laboratory result requires matching the cannabinoid, unit and quantity of product being described.

For illustration only, a hypothetical package containing ten pieces with a stated five milligrams of CBD per piece claims fifty milligrams for the package. That arithmetic does not establish that each piece contains that amount; it simply makes the label's basis clear. A concentration result needs the corresponding product quantity before it can be compared with a package total.

These are document-reading checks, not dosing instructions. A higher CBD number is not evidence of a better or more suitable product.

“Below quantitation” is not a claim of absolute zero

OCM defines the limit of quantitation (LOQ) as the smallest amount or concentration that can be determined accurately using the laboratory's testing methods. A result written as “<LOQ” therefore should not be read as proof that none of the substance exists.

Keep the reported result, its unit and the LOQ together. Do not replace a qualified result with an invented precise number. If another abbreviation is unexplained, ask the laboratory for its definition rather than assuming that every report uses identical notation.

This distinction matters when marketing says “THC-free.” The report supports only what its actual measurements and reporting limits establish, not an unlimited absence claim.

Look beyond the potency page

A detailed cannabinoid profile is not the same as a complete contaminant assessment. OCM's reading guide discusses separate testing categories including heavy metals, pesticides, microbial impurities and residual solvents. Look for the actual sections and named substances, rather than assuming they were checked because a cannabinoid panel appears professional.

For each section, identify the analytes tested, results, units and applicable limits. A “pass” describes a result assessed against a specified criterion. It does not necessarily mean no amount was detected, and it cannot speak for substances that were not tested.

The FDA's CBD consumer update reports concerns about inaccurate CBD amounts and potentially unsafe contaminants. That makes testing useful—but does not turn an incomplete report into comprehensive assurance.

Laboratory credentials and legal scope are separate checks

New York provides a concrete state example. Its cannabinoid hemp licensee guidance, revised October 2024, says covered products must pass third-party testing before sale by licensed cannabinoid hemp retailers. It describes qualifying laboratory routes, including OCM-approved laboratories or laboratories meeting specified accreditation, validation and sampling requirements.

The guidance also says tested cannabinoid hemp products sold in New York include a QR code or link to their COA. Those are New York program statements, not a single national testing rule. A laboratory logo alone does not demonstrate that every applicable requirement has been met. Our New York retail license guide addresses the separate question of business authorization.

What even a matching, passing COA cannot prove

A COA does not establish medical effectiveness, personal suitability or FDA approval. FDA warns that CBD can cause liver injury and interact with medicines; a contaminant result does not evaluate those individual health risks. Nor can a report establish that a product's claims, legal category and sale comply with every applicable law.

For that distinction, see our FDA approval and CBD label explainer. Use the COA to ask better, narrower questions—not to replace all the others.

Sources and scope

The three linked official sources were freshly consulted November 6, 2026. This guide evaluates no specific product and supplies no numerical regulatory limits. It is general information, not medical or legal advice. Find further reporting in our US edition and our verification approach in the editorial standards.