Why cannabis testing matters
Cannabis testing matters for the same reason food testing, pharmaceutical testing, and air-quality testing matter: people are exposed to whatever is actually in the product, not whatever the label says is in it. That sounds obvious, but the cannabis sector still treats lab reports as marketing shorthand when they should be treated as evidence with limits.
This is not a niche public-health issue. The UNODC World Drug Report 2024 estimated that 228 million people used cannabis in 2022. SAMHSA reported 61.8 million past-year marijuana users in the United States in 2023. The EMCDDA estimated 22.8 million adults in Europe used cannabis in the last year. At that scale, small failure rates are not small.
Cannabis is an agricultural product, an inhaled product, and often a processed extract
Each of those categories creates a different risk profile.
As an agricultural crop, cannabis can pick up pesticides from cultivation and heavy metals from soil, water, fertilizers, or equipment. That matters more than many consumers realize because cannabis is a known bioaccumulator. Lead, cadmium, arsenic, and mercury are not theoretical hazards. They are analytes laboratories are expected to measure because the plant can concentrate them.
As an inhaled product, cannabis changes the toxicology math. Limits that might be tolerable in an oral product do not translate neatly to smoke or vapor exposure. Combustion and aerosolization can move contaminants into the lungs, where the route of exposure is faster and often less forgiving. A contaminant panel tied only to generic “pass/fail” language can hide that distinction.
And as a processed extract, cannabis inherits all the risks of manufacturing. Solvent-based extraction can leave behind butane, propane, ethanol, isopropanol, hexane, benzene, or other residuals if the process is poorly controlled. Concentration steps can also concentrate contaminants that were present at lower levels in the raw plant. A vape oil, edible, tincture, or concentrate is not just “cannabis in another form.” It is a different analytical matrix, and matrices affect how well tests work.
That is why regulators now require broad testing panels rather than potency alone. California’s Department of Cannabis Control requires testing for cannabinoids, residual solvents and processing chemicals, pesticides, microbials, mycotoxins, foreign material, moisture content, water activity, and heavy metals. Colorado requires potency and multiple contaminant categories as well. Canada and Germany use different regulatory architectures, but both treat contaminant control and product identity as central quality functions, not optional extras.
What testing is supposed to prevent: contamination, mislabeling, and avoidable exposure
The first job of cannabis testing is to catch unsafe contamination before human exposure happens. That includes pesticides, toxic elements, harmful microbes, mycotoxins, and leftover solvents. Some of these hazards are acute; others are cumulative. Heavy metals are the clearest example of the second category. Repeated low-level exposure can still matter.
Microbial testing has a similar logic. Flower and low-moisture products can support yeast and mold growth if handling and storage are poor. Moisture content helps describe how much water is present, but water activity is often more predictive of whether microbes can actually grow. Those are not interchangeable numbers.
The second job is to prevent mislabeling. Potency errors are common, and they are not harmless bookkeeping problems. A mislabeled product can distort dose expectations, impair medical use, and undermine any attempt to compare effects across batches. Johnson et al., writing in JAMA Network Open in 2022, studied 23 hemp-derived topical CBD products purchased online. Of the 21 tested for CBD content, 18 were inaccurately labeled. Eight were over-labeled by more than 10%, and 10 were under-labeled by more than 10%. That is not statistical noise. It is a warning.
Potency numbers also depend on method choice. HPLC is commonly used for cannabinoids because it can measure THCA and CBDA without heating them into THC and CBD. Gas chromatography can do useful work too, but heat changes acidic cannabinoids unless derivatization or careful interpretation is used. Even “total THC” is partly a calculation, usually THCA × 0.877 + delta-9-THC. So the number on a COA is measured data shaped by chemistry, assumptions, and math.
Why a passing COA is not the same thing as trustworthy quality
A certificate of analysis is only as reliable as the sample, the method, and the laboratory culture behind it.
Start with sampling. If the tested material was hand-picked, unusually dry, unusually resinous, or otherwise unrepresentative, the COA may describe a favorable sub-sample rather than the batch people actually encounter. No instrument can fix bad sampling.
Then method validation. Cannabis matrices are messy: flower, chocolate, gummies, vape oils, and concentrates all interfere with analysis in different ways. A laboratory can be accredited under ISO/IEC 17025, which sets requirements for competence, impartiality, and consistent operation, and still produce weak data if its methods are poorly validated for the specific matrix or analyte range at issue. Accreditation is necessary. It is not magical.
Then integrity. The cannabis sector has already seen potency inflation, selective retesting until a batch passes, and lab shopping. Those are governance failures wearing a lab coat. Programs such as NIST’s Cannabis Quality Assurance Program and stronger proficiency testing help, but they do not eliminate the incentive problem.
So the public-health case for testing is strong, but the article’s larger point starts here: compliant paperwork is not the same thing as trustworthy evidence. A passing COA can be informative, decorative, or misleading. The difference lies in how the numbers were produced.
The chemistry behind the report: how cannabis laboratories generate results
A number on a COA looks clean: 18.7% total THC, 0.04 ppm lead, non-detect for benzene. The chemistry that produced those numbers is not clean at all. It starts with plant material, oils, gummies, capsules, or vape liquids that are chemically messy and physically uneven. A lab result is therefore not a direct reading of truth. It is the end point of sampling, preparation, extraction, separation, detection, calibration, calculation, and judgment.
That is why a compliant certificate can still be misleading. If the sample was hand-picked, poorly mixed, degraded in transit, or analyzed with a method that was never validated for that matrix, the decimal places are decoration.
Sampling, homogenization, and chain of custody
The first measurement problem is not the instrument. It is the sample.
Cannabis is heterogeneous. Flower from the same lot can vary by cannabinoid content depending on bud size, position on the plant, stem content, and drying history. Edibles have their own version of the problem: cannabinoids may not be evenly dispersed through a gummy slurry or chocolate mass. Concentrates can stratify. Vape liquids can separate. If the portion sent to the lab does not represent the batch, the report describes only that portion.
Good labs and sound regulatory systems try to control this with documented sampling plans and chain-of-custody records. Chain of custody is simply the paper trail showing who collected the sample, when it was collected, how it was sealed, how it was transported, and who handled it in the lab. This matters because cannabis testing has a governance problem as much as a chemistry problem. Potency inflation and selective retesting do not begin in the detector; they often begin with sample selection.
Once the sample arrives, it usually has to be homogenized. Flower may be ground to reduce particle-size differences. Edibles may be blended. Oils are mixed thoroughly. Homogenization is not glamorous, but without it the aliquot weighed into a vial may contain more resin, more sugar, more plant dust, or more solvent residue than the rest of the batch.
Then comes extraction. Analysts weigh a known mass of sample, add a solvent such as methanol, acetonitrile, or a solvent mixture, sometimes spike in internal standards, shake or sonicate the sample, and separate the extract from solids. That extract is what the instrument actually sees. Every later number depends on that early step being consistent and efficient.
Chromatography in plain language: separation before detection
Most cannabis testing relies on chromatography because cannabis products contain many compounds at once. If everything reached the detector together, the instrument would see a chemical traffic jam.
Chromatography solves that by separating compounds before they are measured. Picture a crowded group moving through a course. Some interact strongly with the course and move slowly; others move faster. In a laboratory system, the “course” is the stationary phase inside a column, and the moving liquid or gas is the mobile phase. Different compounds spend different amounts of time sticking and moving, so they emerge at different times. Those times help identify them, and the size of the signal helps quantify them.
This is the plain-language difference between a sample and a result: the lab does not ask the instrument, “How much THC is here?” It asks, “After I extract this material and separate its contents under controlled conditions, what signal appears where THC should appear, how big is it, and does it match my calibration?”
Separation is especially important in cannabis because matrices are dirty. Plant pigments, waxes, sugars, lipids, flavorings, cutting agents, and degradation products can interfere with measurement. A gummy extract behaves differently from a flower extract. A vape oil behaves differently from both. Method validation has to account for that, or the detector may confuse background chemistry for analyte signal.
HPLC for cannabinoids and acidic precursors
Cannabinoid potency is usually measured by high-performance liquid chromatography, often HPLC-UV or HPLC-DAD. The reason is simple: liquid chromatography can measure cannabinoids in the form they actually exist in the sample.
Fresh and properly handled cannabis flower contains major acidic cannabinoids such as THCA and CBDA, not just delta-9-THC and CBD. Heat converts THCA to THC and CBDA to CBD through decarboxylation. Gas chromatography uses a hot injector and hot column, so acidic cannabinoids tend to decarboxylate during analysis unless the lab derivatizes them first. That makes native measurement harder.
HPLC avoids that heat-driven conversion. The sample extract travels through a liquid mobile phase at moderate temperature, and the detector measures THCA, THC, CBDA, CBD, CBG, CBN, and other cannabinoids as separate compounds. That is why LC methods dominate potency testing.
The familiar “total THC” figure is usually not a direct measurement. It is a calculation: total THC=THC + (THCA × 0.877)
The 0.877 factor corrects for molecular-weight loss when THCA loses carbon dioxide during decarboxylation. The same logic applies to total CBD: total CBD=CBD + (CBDA × 0.877)
Those equations are chemically sound, but they can still be misread. A flower sample with high THCA and low delta-9-THC may produce a high total THC number even though the neutral THC present before heating is modest. For inhaled flower, that may be a reasonable estimate of post-decarboxylation exposure. For some other product forms, interpretation gets trickier.
Detection in routine cannabinoid HPLC often uses ultraviolet absorbance. As compounds exit the column, they pass through a detector that measures how strongly they absorb light at selected wavelengths. A diode-array detector adds spectral information across multiple wavelengths, improving identity checks. But UV detection is less selective than mass spectrometry, which is why matrix validation still matters.
GC-MS and GC-FID for terpenes and residual solvents
Gas chromatography is still indispensable in cannabis labs. It is especially useful for volatile compounds: terpenes and residual solvents.
In GC, the sample is vaporized and carried through a column by an inert gas such as helium or hydrogen. Volatile compounds separate efficiently because they can exist in the gas phase and interact differently with the column coating. Monoterpenes such as myrcene, limonene, and alpha-pinene, and sesquiterpenes such as beta-caryophyllene and humulene, are well suited to this approach.
For terpene profiling, labs often use GC-FID or GC-MS. FID stands for flame ionization detector. It burns the column effluent in a hydrogen flame and measures ions produced from organic compounds. FID is sensitive, relatively simple, and good for quantitation, but it gives less structural information than mass spectrometry. GC-MS adds identification power by measuring fragment ions characteristic of each compound.
Residual solvent testing also commonly uses GC, often with headspace sampling. Instead of injecting the sticky extract directly, the lab heats a sealed vial and samples the vapor above it. That vapor contains volatile solvents such as butane, propane, pentane, ethanol, isopropanol, acetone, benzene, toluene, or hexane. Headspace GC reduces contamination of the instrument and targets what matters: the volatile fraction.
This is another place where method choice matters. A solvent panel should reflect the extraction and processing chemistry actually used. A result saying “non-detect” for a narrow set of solvents does not prove the sample is free of every relevant processing chemical.
Mass spectrometry, tandem MS, calibration curves, and limits of quantitation
Mass spectrometry adds specificity by ionizing compounds and sorting the resulting ions by mass-to-charge ratio. In plain terms, it turns molecules into charged fragments or molecular ions, then measures their masses. Because many compounds produce distinctive ion patterns, MS is much better than a simple optical detector at telling similar chemicals apart.
Tandem mass spectrometry, written MS/MS, goes further. One mass filter selects a precursor ion, that ion is fragmented, and a second mass filter measures specific product ions. This greatly improves selectivity in dirty matrices. That is why pesticide screening in cannabis often relies on LC-MS/MS and GC-MS/MS. State pesticide lists can include dozens or more than 100 analytes spanning very different chemistries, often at low action limits. Simple detectors are not enough.
Quantitation still requires calibration. Labs prepare standards at known concentrations, run them through the method, and build a calibration curve relating signal to concentration. The sample’s signal is then compared against that curve. Internal standards strengthen this process. These are compounds, often isotopically labeled analogs, added in known amounts to standards and samples alike. Because they experience the same extraction losses and instrument drift, they help correct variability.
Matrix effects are a constant headache. Compounds co-extracted from the sample can suppress or enhance ionization in the mass spectrometer. The same amount of pesticide may give a different signal in flower, chocolate, and vape oil. That is why method validation has to be matrix-specific. AOAC, USP, ASTM, and NIST’s Cannabis Quality Assurance Program all push labs toward comparability and validated performance for this reason.
Finally, “non-detect” does not mean “zero.” It usually means the analyte was not detected or not reliably quantified above a defined threshold. The limit of detection is the level where the instrument can likely tell something is present. The limit of quantitation, or LOQ, is the higher level where the lab can measure it with acceptable accuracy and precision. Those are not interchangeable. A result below the LOQ may still reflect trace presence; it is just not solid enough to report as a number with confidence.
That distinction matters on COAs. So does validation. ISO/IEC 17025, updated in 2017, sets competence requirements for laboratories, but accreditation alone does not guarantee honest sampling, appropriate methods, or believable uncertainty statements. If the method was never shown to recover analytes from that product type, resist interference, stay linear across the reporting range, and produce repeatable results, the chemistry behind the report is weak no matter how official the PDF looks.
The main cannabis tests and what each one actually tells you
A cannabis certificate of analysis usually stacks very different kinds of information into one document. That can blur the real hierarchy. Potency and terpene results describe the product. Contaminant tests decide whether it may be unsafe. Those are not equivalent categories, and too many discussions treat them as if they carry the same weight.
The chemistry also changes by product type. Flower, concentrates, edibles, tinctures, capsules, vape oils, topicals, and infused pre-rolls all behave differently in the lab. A clean-looking COA can still hide weak sampling, poor matrix validation, or methods that were never stress-tested on the specific product being measured. The JAMA Network Open study by Johnson et al. in 2022, which found 18 of 21 hemp-derived topical CBD products inaccurately labeled for CBD content, is a reminder that the number on a label is often less reliable than people assume.
Cannabinoid potency: total THC, total CBD, minor cannabinoids, and decarboxylation math
Potency testing asks a simple question with messy analytical consequences: how much of each cannabinoid is present? For flower and many extracts, labs typically quantify delta-9-THC, THCA, CBD, CBDA, and a set of minors such as CBG, CBGA, CBC, CBN, THCV, and sometimes delta-8-THC. The preferred instrument is usually HPLC with UV or diode-array detection, because liquid chromatography can measure acidic cannabinoids without heating them into something else.
That matters. In fresh or minimally processed plant material, much of the THC is not present as delta-9-THC. It is present as THCA. Likewise, much of the CBD may be present as CBDA. If a lab uses gas chromatography without derivatization, the injector heat decarboxylates the acids, and the result can collapse acidic and neutral forms into a less informative number.
The familiar equations are:
- Total THC=THCA × 0.877 + delta-9-THC
- Total CBD=CBDA × 0.877 + CBD
The 0.877 factor is a molecular-weight correction. When THCA loses its carboxyl group during decarboxylation, the resulting THC molecule weighs less. So 1 mg of THCA does not yield 1 mg of THC. Same logic for CBDA to CBD.
This looks straightforward, but interpretation often goes sideways. “Total THC” is an estimate of potential THC after decarboxylation, not a direct measurement of what is already active in the product at room temperature. For inhalable flower, that estimate is useful because heating converts THCA to THC during use. For tinctures, capsules, or topicals, the relevance depends on formulation and intended route. A raw acidic extract rich in THCA is not pharmacologically equivalent to a fully decarboxylated oil, even if the total THC math makes the numbers look closer than they are.
Minor cannabinoids are useful too, though they are often overstated. They can help characterize a cultivar or formulation and may matter for pharmacology research, but in many products the reported values are so low that measurement uncertainty becomes a real issue. If a COA reports 0.03% of a minor cannabinoid in a messy edible matrix, the right response is caution, not certainty. Near the limit of quantitation, small numbers can wobble.
Terpene profiling: useful for characterization, weak as a predictor of effects
Terpene analysis is one of the most overinterpreted parts of cannabis testing. Labs usually measure compounds such as myrcene, limonene, beta-caryophyllene, alpha-pinene, linalool, humulene, and terpinolene, often by GC-FID or GC-MS. For flower, this produces a chemical aroma fingerprint. For extracts, it can indicate whether volatiles were retained, stripped, or reintroduced.
That makes terpene testing descriptive and sometimes helpful. It can distinguish one batch from another, flag oxidation or poor storage, and support consistency work. It can also help identify products with implausibly low or unusually inflated terpene content. A flower sample reporting 8% total terpenes would raise eyebrows because that is far above the range most dried flower actually shows.
What terpene data does not do very well is predict subjective effects on its own. The popular habit of treating terpene percentages as a map to exact experience is much stronger in marketing language than in evidence. Hazekamp and Fischedick both argued, in different ways, that chemical characterization is useful but simplistic effect claims built from a short terpene list are not. Human response depends on dose, route, cannabinoid profile, tolerance, timing, and individual biology. Small terpene differences may matter biologically in some contexts, but a terpene table is not destiny.
So terpene results deserve a lower evidentiary status than safety screens. They tell you what kind of product it resembles. They do not tell you whether it is safe, and they do not reliably forecast how any one person will respond.
Pesticide screening: broad panels, low action limits, and matrix headaches
Pesticide testing is where cannabis labs start earning their keep. State lists can include dozens to more than 100 compounds, spanning insecticides, fungicides, growth regulators, and chemicals that behave very differently during extraction and analysis. Common methods rely on LC-MS/MS and GC-MS/MS because no single platform comfortably covers the whole list.
The challenge is not just instrument sensitivity. It is matrix interference. Cannabis flower is resinous. Concentrates are even worse. Edibles add fats, sugars, emulsifiers, and flavors. Vape oils may contain terpenes and cutting agents that complicate extraction and ionization. A method that works on a clean solvent standard can fail badly in a real sample unless it has been validated for that matrix.
Action limits are often extremely low, sometimes in the part-per-billion range. That is appropriate for certain pesticides and for inhalation exposure, but it creates a difficult environment for consistent measurement. A lot may pass in one state and fail in another because the target list, limit, or extraction method changed. This is not a hypothetical governance problem. It is one reason labs and regulators keep fighting over comparability.
Pesticide tests matter most for flower, pre-rolls, concentrates, and inhalable extracts, though edibles also count. Overinterpretation usually takes two forms: treating “non-detect” as proof of absolute absence, and treating any pass result as equally trustworthy regardless of method validation. Non-detect only means below that lab’s reporting threshold for those analytes in that matrix.
Heavy metals: arsenic, cadmium, lead, mercury, and bioaccumulation risk
Heavy metal testing usually targets arsenic, cadmium, lead, and mercury, measured by ICP-MS or a similar elemental analysis method. These four matter because cannabis is a known bioaccumulator. It can take up metals from soil, water, fertilizers, and environmental deposition, then carry them into harvested biomass.
The risk profile depends on product type. Flower can deliver metals by inhalation. Concentrates can magnify the issue if contaminated biomass is processed into a smaller, more potent form. Vape formulations deserve extra scrutiny because inhalation changes toxicology; the respiratory route is not interchangeable with oral exposure. Lead is especially concerning because there is no physiological need for it and harm can occur at very low levels, especially with repeated exposure.
One common mistake is assuming metals are only an agricultural problem. They can also enter later through equipment, poor-quality hardware, degraded alloys, or glass and ceramic components. A clean plant does not guarantee a clean finished product.
This is a safety-critical test, full stop. Unlike terpene data, there is no harmless romance around arsenic.
Residual solvents and processing chemicals in extracts and vape formulations
Residual solvent testing is mainly for extracts and manufactured formulations. If a product was made using butane, propane, ethanol, isopropanol, acetone, pentane, hexane, or other processing chemicals, the lab needs to check whether meaningful residues remain. Headspace GC-MS or GC-FID is common here because volatile compounds partition well into the gas phase.
The product category matters a lot. Dried flower generally does not need a residual solvent panel unless it has been infused or otherwise processed. Concentrates absolutely do. So do some tinctures, distillates, and vape oils. Certain panels also include compounds that are not extraction solvents in the narrow sense but still matter, such as benzene or toluene, because they are toxic and may appear from contamination or poor process control.
Interpretation can get sloppy. A pass on residual solvents does not establish overall purity. It says only that the targeted volatile chemicals were below the relevant limit. It says nothing about pesticides, metals, or nonvolatile byproducts. In vape products, this section also should not be confused with a full screen for thermal degradation compounds formed during use. Routine COAs rarely answer every aerosol chemistry question people think they do.
Microbial contamination and pathogen screens
Microbial testing sits at the awkward boundary between quality and safety. The exact panel varies by jurisdiction, but common targets include total yeast and mold count, total aerobic count, bile-tolerant gram-negative bacteria, and pathogen-specific screens for Salmonella spp. and shiga toxin-producing E. coli.
Flower is especially exposed because it is an agricultural product that gets dried rather than sterilized. Poor drying, handling, storage, or trimming can increase counts. Edibles and capsules bring a different set of risks, since ingredients and water activity can support growth in ways dried flower does not.
What these tests actually tell you depends on whether the lab measured broad indicator counts or specific pathogens. A total yeast and mold count can suggest hygiene and spoilage risk, but it does not identify the organism. A pathogen assay is narrower but more clinically meaningful if positive. Some methods rely on culture-based techniques; others use PCR or related molecular tools. Each has tradeoffs. Dead organisms may fail to grow in culture but still leave behind concerns in some contexts, while molecular methods can detect target DNA without proving viability.
For immunocompromised patients, microbial control is not a minor issue. It is one of the reasons medical markets governed under more pharmaceutical-style quality systems often place heavy emphasis on microbial limits.
Mycotoxins: aflatoxins and ochratoxin A
Mycotoxin testing is separate from ordinary microbial counting, and it should stay separate in your mind. Even if live mold is low or absent at the moment of testing, toxic metabolites may still be present. Cannabis programs usually target aflatoxins B1, B2, G1, and G2, plus ochratoxin A. These are potent contaminants associated with certain fungi and serious health risks.
The instrument of choice is often LC-MS/MS because the limits are low and the matrix is dirty. Flower and inhalable products get the most attention, but extracts can carry mycotoxins forward if contaminated biomass is processed.
This is another place where “passed microbial” does not mean “safe from fungal toxins.” The tests answer different questions. One measures organisms or indicators of contamination. The other measures specific toxic compounds those organisms may have produced.
Moisture content, water activity, and shelf-stability logic
Moisture content and water activity are linked but not interchangeable. Moisture content is the percentage of water in the sample. Water activity, usually written as aw, estimates how available that water is for microbial growth and chemical instability. A product can have modest moisture but still enough available water to support microbial problems.
That distinction is why many state rules, including California’s, require both. Educational materials from AOAC and USP repeatedly stress that water activity predicts microbial proliferation better than moisture percentage alone in low-moisture goods. As a rule of thumb, aw below about 0.65 limits growth of most microbes, though not every spoilage or stability question vanishes at that threshold.
For dried flower, these measurements are partly about safety and partly about storage performance. Too wet, and mold risk rises. Too dry, and product quality degrades, with volatile terpene loss and brittle plant material. For gummies, chews, and other infused products, water activity can be even more informative than a simple moisture number because formulation ingredients change how tightly water is bound.
This category is often underrated because it lacks the drama of pesticides or metals. That is a mistake. Shelf stability is chemistry plus microbiology plus packaging. Moisture and aw are where those worlds meet.
How to read a certificate of analysis without being misled
A certificate of analysis, or COA, should be read like a lab report, not treated like a seal of approval. That distinction matters. A clean-looking PDF with a QR code can still describe the wrong batch, omit key test details, or reduce meaningful numbers to a vague “pass.” The document only tells you what a laboratory measured in the sample it received, using the method it chose, under the quality system it follows. If the sample was unrepresentative, the method poorly validated for that matrix, or the panel selectively narrow, the COA can look impressive and still tell you less than you think.
That skepticism is earned. In Johnson et al., published in JAMA Network Open in 2022, 18 of 21 hemp-derived topical CBD products tested for CBD content were inaccurately labeled. Eight were over-labeled by more than 10%, and 10 were under-labeled by more than 10%. A COA is evidence. It is not automatic proof.
Batch identity, sample date, report date, and laboratory accreditation details
Start at the top, not the potency box. The first question is whether the COA matches the exact product batch in front of you. Look for a batch or lot number, product name, product type, and sometimes package size or SKU. If the COA says “CBD tincture” but your item is a gummy, vape oil, or topical with the same brand name, the report is not a match. Same problem if the report identifies a broad “hemp extract” rather than the finished product matrix.
Dates matter more than many people realize. A report date tells you when the lab issued the document. A sample collection or sample received date tells you when the material actually entered the testing workflow. If those dates are missing, you lose the ability to judge freshness and traceability. That matters for microbial risk, moisture behavior, terpene drift, and product stability. A year-old potency report attached to a current package is weak evidence.
Check the laboratory identity too: full lab name, address, and license information where relevant. Then look for ISO/IEC 17025 accreditation details. ISO 17025, revised in 2017, sets general requirements for laboratory competence, impartiality, and consistent operation. A serious COA often lists the accrediting body and sometimes the certificate number or scope. But accreditation is necessary, not magic. It tells you the lab operates within a formal quality framework. It does not prove this exact sample was representative, nor does it prevent potency inflation or selective retesting.
Pass-fail versus quantified values
“Pass” is not the same as “good,” and “fail” is not always self-explanatory. A technical COA should show the measured value, the action limit, and ideally the reporting limit or limit of quantitation. If a pesticide panel simply says “pass,” you cannot tell whether every compound was truly absent, present at trace levels below the reporting threshold, or omitted from the panel altogether.
Quantified values are much more useful. For arsenic, lead, cadmium, mercury, pesticides, residual solvents, mycotoxins, and microbial indicators, you want to see actual numbers or “ND” paired with a defined limit such as “ND < LOQ 0.01 ppm.” That wording means the analyte was not detected above the laboratory’s limit of quantitation. It does not mean the substance is absolutely zero. Every method has a floor below which it cannot reliably measure.
Pay attention to the difference between LOD and LOQ. The limit of detection is the point at which the lab can tell something may be present. The limit of quantitation is the point at which it can measure that thing with acceptable accuracy and precision. For practical reading, LOQ matters more. If one lab reports a pesticide as ND with an LOQ of 0.10 ppm and another reports ND with an LOQ of 0.01 ppm, those statements are not equally informative.
Reading potency tables and total cannabinoid calculations
Potency tables usually list individual cannabinoids such as CBD, CBDA, THC, THCA, CBG, CBGA, CBC, and sometimes CBN. Read the acidic and neutral forms separately first. HPLC methods can do this directly because they do not heat the sample enough to decarboxylate acids into neutrals during analysis.
Then check how “total” values are calculated. The standard formulas are:
- Total THC=THC + (THCA × 0.877)**
- Total CBD=CBD + (CBDA × 0.877)**
That 0.877 factor is the molecular-weight correction applied when THCA or CBDA loses carbon dioxide during decarboxylation. If a report gives “total THC” without showing the underlying THC and THCA values, you cannot verify the math. That is a transparency problem.
Also watch for impossible or suspicious potency claims. A flower sample reporting 38% total cannabinoids deserves scrutiny. So does a distillate showing nearly pure cannabinoids while still claiming a rich, high terpene fraction and no diluent. Some concentrates are extremely potent, of course. The issue is internal consistency. Numbers should make chemical sense together.
For CBD products, compare the table to the labeled serving size or container amount. A tincture might report 50 mg/mL CBD and 30 mL total volume; that implies about 1,500 mg CBD in the bottle. If the label claims 2,000 mg, the gap is real.
Understanding units: percent, mg/g, mg/unit, ppm, ppb, CFU/g, and water activity
Units tell you what kind of question the lab is answering.
Percent (%) is common for flower and concentrates. One percent means 1 gram of compound per 100 grams of product. Since 1% equals 10 mg/g, a flower sample listed as 15% CBD contains about 150 mg CBD per gram.
mg/g is often easier to compare across solids and semi-solids. A balm with 20 mg/g CBD gives 20 milligrams in each gram of product.
mg/unit applies to discrete items such as one gummy, one capsule, or one suppository. This is often the most useful figure for dose consistency.
ppm means parts per million. In many cannabis COAs, 1 ppm is roughly equivalent to 1 mg/kg. It is common for pesticides, residual solvents, and metals.
ppb means parts per billion, or about 1 microgram per kilogram. This unit appears when action limits are very low.
CFU/g means colony-forming units per gram. It is used for microbial counts such as total yeast and mold. It estimates viable organisms capable of growing under the test conditions.
Water activity, written as a<sub>w</sub>, is not a percentage. It runs from 0 to 1 and estimates how much unbound water is available for microbial growth. This is different from moisture content. A product can have modest moisture but still enough available water to support mold. Many technical references, including AOAC and USP educational materials, treat water activity below about 0.65 as a useful threshold because most microbial proliferation is strongly limited below that point.
Red flags on a COA: missing methods, implausible numbers, or selective panels
A trustworthy COA usually states the method or instrument class: HPLC-UV for cannabinoids, GC-MS or GC-FID for solvents or terpenes, LC-MS/MS or GC-MS/MS for pesticides, ICP-MS for heavy metals. If no methods are listed, that is a red flag. So is a report that gives no LOQ, no action limits, and no uncertainty language.
Selective panels are another problem. A report may highlight cannabinoids and terpenes while skipping pesticides, metals, mycotoxins, microbial testing, or water activity. For inhaled and ingested products, those omitted safety tests often matter more than a detailed terpene chart.
Finally, inspect the logic of the whole document. Do dates line up? Does the batch number match? Are totals mathematically consistent? Are “ND” claims tied to real quantitation limits? Is the sample clearly a finished product rather than a generic extract? If not, the COA is decorative before it is informative. The right habit is simple: read it as chemistry plus chain of custody, not as branding.
Regulatory testing requirements in the United States
The United States does not have one cannabis testing system. It has dozens.
That fragmentation starts with federal law. Marijuana remains federally illegal, so there is no single national rulebook equivalent to the FDA’s standard framework for foods, drugs, or dietary supplements. Instead, each state that allows medical or adult-use cannabis writes its own contaminant panel, action limits, sampling rules, and release procedures. Hemp adds another layer of disorder. It is federally lawful under the 2018 Farm Bill if it stays within the legal delta-9 THC threshold, but the finished products built from hemp-derived cannabinoids often move through channels that do not face the same state cannabis testing rules at all.
The result is a regulatory map where “tested” can mean very different things.
Why state-by-state cannabis testing rules do not align
States built their cannabis programs at different times, under different political pressures, and with different risk models. Early markets often began with narrower panels focused on potency and a handful of contaminants. Later programs, especially after recalls and contamination scares, tended to add more pesticide targets, heavy metals, mycotoxins, water activity, and product-category-specific limits.
There is also no universal agreement on what the main hazard is. One state may emphasize pesticide screening with a list of more than 60 compounds. Another may put more weight on microbial counts for flower and pathogen testing for edibles. A third may set strict residual solvent limits for concentrates but be less demanding on mycotoxins. Those choices are not trivial. They determine which analytical methods labs need, what can be detected reliably in a difficult matrix, and what gets called a pass or fail.
The mismatch extends to definitions. “Total THC” usually uses the molecular-weight correction formula THCA × 0.877 + delta-9-THC, but not every jurisdiction handles labeling and compliance calculations in the same way across all product forms. Inhalable flower, oral gummies, tinctures, concentrates, and topical products may sit under different categories with different contaminant logic. That matters because exposure route matters. A limit appropriate for an edible is not automatically appropriate for a vape cartridge.
California as a broad-panel model
California is often treated as a broad-panel model because its Department of Cannabis Control requires a large pre-sale testing menu. Licensed labs must test for cannabinoids, residual solvents and processing chemicals, pesticides, microbials, mycotoxins, foreign material, moisture content, water activity, and heavy metals before retail sale. That list is wider than many state programs and reflects a public-health view that cannabis is both an agricultural product and a manufactured one.
California’s framework also shows why test menus grew over time. Flower can carry microbial risk. Concentrates can concentrate pesticides. Extracts can retain residual solvents from hydrocarbon or ethanol processing. Cannabis can accumulate cadmium, lead, arsenic, and mercury from soil or water. Moisture content alone does not predict spoilage risk well enough, so California also requires water activity, a better proxy for whether microbes can proliferate.
This does not mean California solved the trust problem. A broad panel is only as good as the sampling plan, method validation, and lab integrity behind it. But a broad panel does reduce one obvious weakness seen in thinner systems: contaminants that are never looked for cannot fail.
Colorado and other adult-use states
Colorado’s Marijuana Enforcement Division requires retail marijuana testing for potency and, where relevant, residual solvents, microbial contamination, mycotoxins, heavy metals, and pesticides. That is a serious framework, but it is not a clone of California’s. Neither are the systems in Oregon, Nevada, Massachusetts, Michigan, or Arizona. Each state specifies its own analyte lists, action limits, and decision rules.
The differences can be sharp. Pesticide action limits vary widely from state to state, and so do the pesticide lists themselves. One lab may be screening for compounds another state does not regulate at all. Heavy metal limits can also be tied to product category, especially inhalation versus ingestion. Inhaled contaminants may justify tighter limits because pulmonary exposure changes toxicological assumptions. A vaporized extract and a swallowed gummy do not present the same exposure profile even if they contain the same number on a COA.
Residual solvent rules are another split point. A hydrocarbon extract will trigger a different testing logic than unextracted flower. States typically target solvents such as butane, propane, pentane, ethanol, isopropanol, acetone, benzene, toluene, and hexane, but the required list and allowable concentrations differ. That is chemistry driving regulation, yet regulation still decides the final pass/fail line.
Hemp-derived cannabinoid products and the regulatory gap
Hemp-derived cannabinoid products sit in the weakest part of the U.S. oversight map. Products made with hemp-derived CBD, delta-8 THC, or other converted cannabinoids may be sold outside licensed state cannabis systems, which means they often do not face the same mandatory testing panels, batch release rules, or chain-of-custody requirements.
That gap has consequences. Johnson et al. reported in JAMA Network Open in 2022 that among 23 hemp-derived topical cannabidiol products purchased online, 18 of 21 tested for CBD content were inaccurately labeled. Eight were over-labeled by more than 10%, and 10 were under-labeled by more than 10%. That was not a contamination study, but it showed a basic point: weak oversight produces weak label reliability.
For hemp-derived intoxicating products, the problem is larger than CBD concentration. Chemical conversion processes can create byproducts. Some products are tested only for potency. Some post a COA that does not match the actual batch. Some show no screening for residual solvents, heavy metals, pesticides, or unknown reaction impurities at all. The paper document may look familiar, but the regulatory discipline behind it is often much thinner than in a licensed state cannabis program.
Why the same product can pass in one state and fail in another
This happens all the time, and not because chemistry changed at the state line.
A product can pass in one state and fail in another for at least five reasons. First, the analyte list differs. If State A does not require testing for a pesticide that State B regulates tightly, the same batch may be compliant in one market and noncompliant in the other. Second, the action limit differs. Both states may test for myclobutanil, lead, or aflatoxin B1, but one may set a lower threshold. Third, the product category differs. An inhalable concentrate may face a stricter heavy-metal or pesticide limit than an oral product because inhalation toxicology is treated differently. Fourth, the method differs. LC-MS/MS and GC-MS/MS workflows do not always perform identically across sticky, terpene-rich, high-fat, or highly pigmented matrices. Fifth, the sampling plan differs. A hand-picked sample can hide contamination that a representative sample would catch.
That last point is uncomfortable but real. Cannabis testing failures are often governance failures dressed up as technical disputes. ISO/IEC 17025, first issued in its current form in 2017, sets a competence framework for laboratory operation. It matters. So do AOAC methods, ASTM standards, and NIST’s Cannabis Quality Assurance Program. But none of those systems can rescue bad sampling, selective retesting, or state rules that leave major gaps untouched.
A compliant COA tells you a product met one jurisdiction’s rules under one testing regime. It does not prove universal safety, and it does not mean another state would reach the same answer.
International approaches: Canada, Europe, Germany, and medical markets
The biggest mistake people make when comparing cannabis test results across borders is assuming every market is built around the same question. In much of the US retail system, the question is batch release for commercial sale under state rules, with a consumer-facing COA acting as the visible artifact of compliance. In Canada and most European medical channels, the architecture is different. Testing sits inside a broader pharmaceutical or near-pharmaceutical quality system: validated manufacturing controls, deviation management, stability programs, specification setting, and qualified-person release. The lab result still matters. It just does not carry the whole burden.
That distinction matters because a compliant certificate is not the same thing as a trustworthy product, and “internationally compliant” does not describe one harmonized global standard. It describes several systems that prioritize different controls.
Canada's federally regulated model
Canada is often treated as the clean counterexample to the US patchwork, and on structure that is fair. Cannabis is regulated federally under the Cannabis Act and Cannabis Regulations rather than through fifty separate state systems. Licensed producers operate inside a national framework with mandatory testing, recordkeeping, sanitation, preventive controls, and product specifications. That changes how testing functions.
In a typical US adult-use market, independent third-party labs are central gatekeepers. A lot is sampled, sent out, tested against a state panel, and passed or failed before retail transfer. In Canada, producers are federally licensed and expected to maintain quality systems that look more like regulated manufacturing than a retail checkpoint model. Release decisions are tied not only to a single external COA but to in-house controls, environmental programs, trend review, and documented investigations when results drift.
Canada still requires contaminant and composition testing, of course. Potency, microbial contamination, heavy metals, residual solvents where extraction is involved, and other safety parameters are all part of the picture. The difference is governance. Federal oversight reduces some of the incentives that have driven US “lab shopping,” where producers seek friendlier labs or looser methods to obtain stronger potency numbers or easier pass results. It does not erase those risks, but it changes the pressure points.
Another difference is presentation. Canadian products may provide cannabinoid content and other regulated information to patients and consumers, but the market is less centered on the retail-facing dispensary COA culture seen in many US states. The document consumers obsess over in California or Colorado is not the only proof of control in Canada, and often not the main one.
European medical cannabis, EU-GMP, and pharmacopoeial expectations
Europe is not one cannabis market. It is a stack of national medical programs, import rules, narcotics controls, and pharmaceutical manufacturing expectations overlaid with EU-GMP where applicable. That produces a very different testing philosophy from US retail cannabis.
EU-GMP matters because it shifts the focus from “Did this batch pass the state panel?” to “Was this product manufactured and released under a validated quality system fit for medicine?” That includes supplier qualification, process validation, cleaning validation, change control, stability data, out-of-specification investigations, and batch certification by qualified personnel. Testing is one tool inside that system, not the whole system.
Pharmacopoeial expectations matter too. European medical cannabis products are often assessed more like herbal medicinal materials or pharmaceutical preparations than like retail flower with a marketing-friendly potency sticker. Identity testing, assay, microbial limits, foreign matter, loss on drying or water content, and contaminant controls are framed through monographs, validated methods, and predefined specifications. European Pharmacopoeia and national pharmacopoeial standards influence what is expected, even where cannabis-specific monographs are still evolving.
That has practical consequences. A German pharmacy receiving EU-GMP medical cannabis is not relying on the same kind of public-facing, QR-code COA culture common in the US. The trust model is institutional: GMP qualification of the site, release by responsible quality personnel, and batch documentation reviewed within a controlled supply chain. The lab is still doing hard analytical work—HPLC for cannabinoid assay, GC methods for volatile compounds or residual solvents, LC-MS/MS or GC-MS/MS for contaminants—but the result enters a pharmaceutical documentation trail rather than a retail display case.
Germany's post-reform environment and what changed for testing
Germany changed the politics of cannabis in 2024, but not in the simplistic way many outside observers assumed. The country’s reform altered possession, home cultivation, and noncommercial cultivation associations, yet Germany’s medical cannabis channel remained grounded in pharmaceutical regulation. That means testing expectations for medical products did not suddenly become US-style dispensary testing.
For medical cannabis, Germany continues to rely heavily on EU-GMP manufacturing and import requirements, pharmacy handling standards, and pharmacopoeial quality expectations. Identity, cannabinoid assay, microbial quality, pesticides, heavy metals, and residual solvents remain quality issues, but they are managed through medicine-style release systems rather than state-retail pass/fail panels. The center of gravity stays with GMP and pharmacy controls.
What changed is the surrounding ecosystem. Reform expanded public attention, increased policy pressure on supply arrangements, and sharpened the distinction between regulated medical products and nonmedical channels. That distinction matters when reading test documents. A medical cannabis batch entering German pharmacies is backed by a chain of GMP records and controlled release responsibilities. A document claiming “compliance” in another market may only show that one submitted sample passed a regional panel.
So Germany after reform is not converging on the US model. If anything, it highlights how separate these quality cultures still are.
Why international “compliance” does not mean one universal standard
A batch can be fully compliant in one country and fail elsewhere for reasons that have nothing to do with fraud. Action limits differ. Required analytes differ. Sampling rules differ. Product categories differ. Even the analytical method can shift the reported number.
Cannabinoid potency is the obvious example. HPLC can measure THCA and THC separately without decarboxylation, while GC methods require derivatization or careful interpretation because heat converts acidic cannabinoids. Total THC is then calculated using the molecular-weight correction, usually THCA × 0.877 + delta-9-THC. If one jurisdiction emphasizes one reporting format and another emphasizes a different one, labels and COAs can look inconsistent even when the chemistry is sound.
Contaminant controls vary even more sharply. Pesticide lists in US states can run into the dozens or over 100 compounds, often using LC-MS/MS and GC-MS/MS panels. European medical frameworks may emphasize different compounds, different limits, and stronger GMP prevention upstream rather than broad retail-panel screening downstream. Water activity, moisture, mycotoxins, and microbial criteria can also be framed differently depending on whether the product is inhaled flower, an oral extract, or a pharmacy-prepared formulation.
ISO/IEC 17025 helps, but it does not unify all of this. Accreditation means a lab has a competence framework for calibration, validation, uncertainty, and quality management. It does not force Canada, Germany, and a US state market to use the same analyte list, the same action limits, or the same sampling logic.
That is why international cannabis testing is not a ladder with one country “ahead” and another “behind.” It is a map of different regulatory philosophies. The US retail model asks labs to police a fragmented market at the batch level. Canada embeds testing in federal producer oversight. Europe, especially in medical channels, treats cannabis more like a controlled medicinal material governed by GMP and pharmacopoeial discipline. Those systems can all produce useful data. They do not produce interchangeable meaning.
ISO/IEC 17025, proficiency testing, and what laboratory competence really means
A cannabis COA only means something if the lab behind it can produce accurate results, repeatedly, on messy real-world matrices. Flower is not vape oil. Gummies are not tinctures. A lab that can measure ethanol in a clean standard may still struggle with myclobutanil in sticky concentrate or cadmium in dried flower. That gap between paper compliance and actual analytical performance is where ISO/IEC 17025 enters the picture.
What ISO/IEC 17025 covers
ISO/IEC 17025:2017 is the international standard for laboratory competence, impartiality, and consistent operation. In practice, it asks a lab to prove that it has qualified staff, controlled methods, calibrated equipment, traceable records, document control, corrective-action procedures, and a quality system that can withstand outside scrutiny.
For cannabis labs, that translates into very concrete questions. Is the HPLC method appropriate for acidic and neutral cannabinoids without heat-driven decarboxylation? Is the LC-MS/MS pesticide method validated in the actual matrix being tested, not just in solvent? Are balances, pipettes, and thermometers calibrated on schedule? Can the lab show who performed the test, which instrument was used, what version of the method applied, and what happened when quality-control checks failed?
Accreditation bodies audit those systems and review the lab’s scope, meaning the specific tests and matrices for which competence has been assessed. That scope matters. A lab accredited for cannabinoid potency in plant material is not automatically demonstrated competent for residual solvents in concentrates or aflatoxins in edibles.
Method validation, uncertainty, and traceability
Competence is not a certificate on the wall. It is method performance backed by evidence. Validation asks whether a method is fit for purpose: accuracy, precision, selectivity, linearity, limit of detection, limit of quantitation, range, recovery, and matrix effects. Cannabis matrices are difficult because pigments, lipids, sugars, terpenes, and acidic cannabinoids can interfere with measurement.
Measurement uncertainty is the lab’s estimate of how much doubt surrounds a reported number. A potency result of 20.0% THC is not a physical constant; it is an estimate with error around it. Weak labs often hide that reality. Strong labs quantify it and understand how uncertainty affects pass/fail calls near regulatory limits.
Traceability is the chain linking a result back to recognized references through calibration. If a lab reports lead at 0.4 µg/g, that number should rest on calibrated instruments, documented standards, and reference materials with known values. Certified reference materials from recognized producers, along with internal quality controls, are part of that chain. So are system suitability checks, continuing calibration verification, blanks, spikes, and duplicate analyses.
Without traceability, a result may be precise but wrong.
Proficiency testing, interlaboratory comparison, and blind samples
Proficiency testing is a reality check. Multiple labs receive the same sample, analyze it independently, and compare results. Interlaboratory comparison programs expose whether one lab consistently reads high, low, or erratically. NIST’s Cannabis Quality Assurance Program, or CannaQAP, exists for exactly this reason: to assess comparability for cannabinoids, toxic elements, and other analytes across cannabis and hemp matrices.
Blind samples are even harder to game. When a lab does not know that a sample is a performance check, it cannot give special treatment to the prep, instrument, or reviewer. That makes blind proficiency samples one of the strongest tools against selective excellence during scheduled audits.
This matters because cannabis has already seen potency inflation and suspiciously favorable contaminant outcomes. If one lab routinely reports higher THC than peer labs on matched material, that is not just a statistical curiosity. It is a warning.
Why accreditation is necessary but not sufficient
ISO/IEC 17025 accreditation is necessary because unaccredited testing is often worse: less documentation, weaker validation, poorer calibration discipline, and fewer external checks. But accreditation does not eliminate bias, corner-cutting, or bad incentives.
A lab can be accredited and still accept nonrepresentative samples, retest until a result passes, understate uncertainty, or drift away from its validated method without openly documenting the change. Audits are periodic. Misconduct can be continuous. Governance failures often masquerade as chemistry failures.
The broader market evidence supports skepticism. In Johnson et al., published in JAMA Network Open in 2022, 18 of 21 hemp-derived topical CBD products tested for cannabinoid content were inaccurately labeled; 8 were over-labeled by more than 10% and 10 were under-labeled by more than 10%. That study was not a direct audit of ISO-accredited cannabis labs, but it showed the practical consequence of weak measurement systems and weak oversight: numbers that look authoritative and are not.
So accreditation is the floor, not the ceiling. Real competence shows up when validated methods, traceable calibration, uncertainty estimates, proficiency testing, and institutional integrity all point in the same direction.
Lab fraud, potency inflation, and the cannabis industry's measurement problem
Cannabis testing has a chemistry problem, but the deeper problem is governance. When results determine whether a batch passes, how strong it appears, and whether it can move through a regulated system, the certificate becomes an economic instrument. That changes behavior. A surprising number of testing failures are not random mistakes made at the bench; they are predictable outputs of a market that rewards favorable numbers, weak sampling controls, and selective enforcement.
The industry often talks about bad actors as if they were isolated exceptions. That is too charitable. In many jurisdictions, the structure itself invites manipulation: producers choose the lab, labs compete for repeat clients, methods differ, action limits differ, and failed lots may be retested under rules loose enough to encourage trying again until the answer changes. ISO/IEC 17025 accreditation matters, but it does not stop a lab from issuing polished paperwork on a nonrepresentative sample or from drifting toward client-pleasing potency data.
Potency inflation and lab shopping
Potency inflation is the easiest form of gaming to understand because the incentive is direct. Higher THC or CBD numbers carry social and regulatory weight even when the underlying uncertainty is significant. In flower, a few percentage points can change how a product is categorized or perceived. In hemp-derived material, the arithmetic around total THC and total CBD can determine legal status as well as label claims. Those totals are not raw measurements; they are calculated values that usually apply the 0.877 molecular-weight correction to acidic precursors such as THCA or CBDA after assumed decarboxylation. Small method differences can move the final number.
That alone would not be fatal if labs were insulated from commercial pressure. Often they are not. “Lab shopping” describes the practice of steering samples to laboratories known for generous potency results or permissive interpretations. State investigations have repeatedly circled this pattern, especially in markets where one lab’s potency averages run conspicuously above peers. This is not always outright fabrication. It can arise from softer forms of bias: calibration choices, integration settings, poor matrix validation, selective exclusion of chromatographic interferences, or reporting conventions that consistently lean high.
HPLC methods can quantify THCA and CBDA without heat-driven decarboxylation, while GC-based methods require derivatization or careful interpretation because acidic cannabinoids convert during analysis. That means method choice is not a technical footnote. It shapes the number itself. Add weak interlaboratory harmonization and limited blind proficiency testing, and the result is a market where the same material may receive meaningfully different potency values depending on where it is tested. NIST’s Cannabis Quality Assurance Program exists for a reason: comparability across laboratories is still a live problem.
Nonrepresentative sampling and selective retesting
A COA can be analytically sound and still misleading if the sample is not representative. This is where many discussions become unrealistically polite. Hand-selected samples are a major integrity failure. If a batch contains variable flower size, uneven drying, localized mold, or inconsistent extract mixing, pulling material from the most attractive portion can produce a clean report for a dirty lot.
Sampling error is especially dangerous in safety testing. Pesticides, heavy metals, and microbial contamination are not always uniformly distributed. Neither are mycotoxins. Afoxlatoxin or ochratoxin hotspots do not need to be spread evenly through a batch to create risk. The same logic applies to moisture and water activity. A lot can include sections that are dry enough to pass and pockets wet enough to support fungal growth. If the sampled units are chosen for appearance rather than statistical representativeness, the lab result becomes decorative.
Selective retesting compounds the problem. In principle, retesting can be legitimate when there is documented instrument failure, a sample handling error, or a clear quality-control breach. In practice, some systems have allowed repeated testing after a fail until a passing result appears. That is not quality assurance. It is serial measurement shopping. A failed pesticide screen or microbial test should trigger investigation into the lot, the sample collection process, and the laboratory workflow, not a quiet search for a more convenient answer.
Label-accuracy failures in CBD and other cannabinoid products
CBD labeling data show that cannabinoid measurement problems are not confined to intoxicating products. Johnson et al. in JAMA Network Open (2022) analyzed 23 hemp-derived topical cannabidiol products purchased online. Of the 21 products tested for CBD content, 18 were inaccurately labeled. Eight were over-labeled by more than 10%, and 10 were under-labeled by more than 10%. That is not background noise. It is a market-level quality failure.
The same study found that 81.0% of products made therapeutic claims on the label and 28.6% made cosmetic claims. So the issue was not merely sloppy math on a secondary attribute. Products were making use-related assertions while failing basic content accuracy. FDA warning letters over CBD misbranding have pointed in the same direction for years: labels and actual cannabinoid content do not reliably match.
Under-labeling and over-labeling create different problems, but both matter. Under-labeling can cause a user to ingest more CBD, delta-9-THC, or another cannabinoid than intended. Over-labeling can make a product appear stronger or more concentrated than it is. With minor cannabinoids such as CBN, CBG, or delta-8-THC, the room for confusion gets even wider because methods are less standardized and labels often imply precision that the underlying analytics do not support.
How regulators and markets can reduce gaming
The fix is not “read the COA more carefully.” It is to reduce the opportunities for manipulation before the COA exists. The strongest controls are structural: independent sampling, mandatory chain-of-custody rules, limits on discretionary retesting, and regular blind proficiency samples inserted by regulators rather than announced in advance. If the laboratory never knows which sample is an audit sample, fraud gets harder.
States with broad required panels, such as California, at least recognize that safety testing must cover more than potency. California’s Department of Cannabis Control requires testing for cannabinoids, residual solvents and processing chemicals, pesticides, microbials, mycotoxins, foreign material, moisture content, water activity, and heavy metals before release. That breadth matters. Still, broad panels alone do not solve gaming if enforcement is sporadic or if sample collection remains vulnerable.
Markets with stronger pharmaceutical quality systems offer a useful contrast. Canada’s federally regulated framework and Germany’s EU-GMP medical model place more weight on batch controls, documentation, and manufacturing quality systems than the fragmented state-by-state US pattern. They are not immune to error, but they are less dependent on a single end-point COA as a stand-in for trust.
What works is not mystery chemistry. It is oversight with teeth: standardized methods where possible, transparent measurement uncertainty, public enforcement against inflated results, interlaboratory comparison through programs such as NIST CannaQAP, and rules that treat nonrepresentative sampling as fraud rather than paperwork sloppiness. Until those controls are common, some cannabis certificates will remain records of what was submitted, not what was actually in the batch.
How producers, buyers, patients, and consumers should use test results
Test results matter only when they change a decision. A COA that sits in a folder and never feeds back into cultivation, extraction, release review, or patient choice is paperwork, not quality control. That distinction matters because a passing report can still come from weak sampling, the wrong analytical method for the matrix, or a lab with a history of inflated numbers.
For cultivators and manufacturers: process control, not just compliance
Producers should treat testing as a trend tool first and a release gate second. Potency data across harvests can show whether a cultivar is genetically unstable, whether drying is pushing decarboxylation too far, or whether post-harvest handling is degrading terpenes. Repeated water activity results can reveal packaging failures long before visible mold appears. If one room repeatedly trends higher in cadmium or lead, that points upstream to soil, irrigation water, nutrients, or contact surfaces rather than a one-off lab anomaly.
The most useful approach is batch trending by lot, room, cultivar, extraction line, and operator. Watch total THC or total CBD calculated correctly from acidic precursors using the standard formula: THCA × 0.877 + delta-9-THC, and CBDA × 0.877 + CBD. Watch residual solvents by extraction method. A hydrocarbon line should be reviewed for butane, propane, pentane, benzene, and related solvents; an ethanol line should be reviewed differently. Microbial risk should not be inferred from moisture percentage alone. Water activity is often the better warning signal because microbial growth tracks available water, not just total water.
This is also where lab selection becomes a quality decision. Use laboratories with matrix-validated methods, clear limits of quantitation, measurement uncertainty statements, and proficiency testing. ISO/IEC 17025 is a baseline signal of competence, not proof that every number is sound.
For buyers and distributors: supplier qualification and batch review
Anyone reviewing incoming lots should look past the headline cannabinoid percentage. Start with supplier qualification. Is the report batch-specific, recent, and issued by a laboratory accredited for the relevant methods? Are the contaminant panels aligned with the product type and route of exposure? Inhaled flower and vape oil do not present the same risk profile as an oral oil.
Then review consistency. One spectacularly high potency result surrounded by ordinary lots is a warning, not a bonus. So are repeated “non-detect” pesticide calls from a matrix known to be difficult, terpene totals that look chemically implausible, or a string of results clustered just under action limits. Those patterns can signal selective retesting, hand-picked samples, or weak methods. Ask for historical batch data, not a single COA.
For patients and consumers: what matters most on the report
Most people should care less about marketing-friendly potency and more about identity, safety, and freshness. Check the product name, lot number, sample date, and test date. Old data tell you less, especially for volatile terpenes and unstable formulations. Confirm the cannabinoid table distinguishes acidic and neutral forms instead of presenting a vague “total” number with no calculation.
For safety, look for heavy metals, pesticides, microbial results, mycotoxins, residual solvents where relevant, moisture, and water activity for flower. “ND” does not always mean zero; it means not detected above that lab’s stated limit. The limit matters. So does the matrix. A terpene profile that seems dramatic but appears on a gummy or refined distillate should invite skepticism.
Distrust reports that are missing the laboratory name, method, units, dates, lot identifier, or pass/fail criteria. Johnson et al. in JAMA Network Open (2022) found 18 of 21 hemp-derived topical CBD products tested for content were inaccurately labeled, with 8 over-labeled by more than 10% and 10 under-labeled by more than 10%. Label accuracy is not something to assume.
Legal and practical caution when relying on cannabis test data
Test data do not travel cleanly across jurisdictions. California, Colorado, Canada, and Germany do not all require the same analytes, limits, sampling rules, or release frameworks. A lot that passes in one US state may fail in another because pesticide action limits differ sharply. A German medical standard built around EU-GMP and pharmacopoeial controls is not the same thing as a US dispensary-style COA system.
So use reports as evidence, not as an absolute guarantee. Ask what was tested, how it was tested, who took the sample, and which legal standard applied. Compliance is real. Trust still has to be earned.