What does it really mean when a hemp brand says 'third-party tested'? Your proof lives inside the hemp gummy COA, the lab certificate that lists what is in the jar and what is not. Reading one used to feel like decoding a tax form. Once you know which sections to scan and which numbers to verify, the check takes about ninety seconds and protects you from mislabeled, contaminated, or simply overhyped hemp-derived product.
What a hemp gummy COA is and why it matters for safety
A hemp gummy COA, or certificate of analysis, is a lab document that lists every cannabinoid, contaminant, and quality test performed on one specific batch of product. It exists because the federal government does not require pre-market testing for hemp-derived edibles, leaving voluntary third-party labs as the main quality check between maker and buyer.
The U.S. Food and Drug Administration regulatory overview on cannabis-derived products confirms that the agency does not pre-approve most hemp-derived gummies outside of formal drug-approval pathways. That gap is why this document carries so much weight: it is one of the few records a buyer can check against an independent source. Without it, you are taking the brand's word for the dose, purity, and shelf stability of what you bought.
Think of the certificate as the receipt for safety. It should be free, easy to find, and tied by batch number to the specific jar in your hand. If the brand cannot show one, or shows a generic document that does not match the batch printed on your label, that is not a paperwork hiccup. It is the answer to your question. Every GummyGurl batch is sent to an ISO/IEC 17025-accredited facility before it ships, with the certificate for that specific lot posted to the product page the same week results arrive. Treating each new production run as a fresh opportunity to produce a passing hemp gummy COA is the baseline we apply to ourselves and the same one worth asking of any brand you buy from.
How to verify a certificate of analysis comes from an accredited lab
Verifying a hemp gummy COA means confirming three things: the lab is independent of the brand, the lab holds ISO/IEC 17025 accreditation, and the batch number on the certificate matches the batch number on your jar. Self-tests done in a brand's own facility are not third-party and do not count toward that safeguard.
ISO/IEC 17025 is the international benchmark for testing laboratory competence, published by the International Organization for Standardization. The FDA uses the same standard to evaluate laboratory quality for food and pharmaceutical work. A lab listed without an accreditation number, or with one that does not appear on the accrediting body's public registry, is a yellow flag at minimum.
Cross-check the lab on its own website. A real lab posts a list of services, equipment, and accreditation paperwork. A short, recently registered domain with stock photos and no client list is the warning shape of a paper mill. The CDC cannabis and public health page notes that contamination risk in unregulated cannabis-derived products is documented, which is the gap a real third-party lab is meant to close.
What the potency panel on a hemp lab report tells you about dose
The potency panel on a hemp gummy COA reports the actual cannabinoid content of the batch in milligrams per serving and as a percentage by weight. Compare that number to the label claim on the package; the two should match within ten percent. Larger gaps mean the dose you take is not the dose you read.
A 2020 Penn State University study published in JAMA, indexed by the National Library of Medicine PubMed catalog, tested 84 CBD products and found that only 31% were accurately labeled within 10% of stated potency. Roughly 26% were over-labeled (less product than the label promised) and 43% were under-labeled (more product than the label promised, which is its own dosing problem). The certificate is what lets you check whether your specific jar is in that 31% or the other 69%.
Beyond CBD totals, the potency panel should break out THC isomers (delta-9, delta-8, delta-10 if present), CBN, CBG, and any other cannabinoids the product claims. A jar marketed as full-spectrum should show measurable minor cannabinoids in the panel; if it shows only CBD, the label and the lab do not agree. For dosing newcomers, our hemp gummy dosage guide for beginners walks through how to convert certificate milligram numbers into a personal serving size.
Which contaminant panels every hemp gummy COA should include
Every reputable certificate should clear four contaminant categories: heavy metals such as lead and arsenic, pesticide residues, microbial counts including yeast and mold, and residual solvents left over from extraction. Missing panels are not neutral; they are unanswered questions about what is sitting in your gummy.
Hemp is a bioaccumulator, meaning it pulls up whatever is in the soil it grows in. The USDA hemp production program page covers cultivation rules but does not test finished consumer products. That is the lab's job. A clean heavy-metals panel reports lead, arsenic, cadmium, and mercury below the action limits used in most state cannabis programs. Heavy metals accumulate in the plant during cultivation and concentrate further when biomass is processed into extract; lead in particular tends to partition into the resin fractions used to make hemp concentrates. Pesticide residues follow a similar path: chemicals applied during growing can survive solvent-based extraction and appear in a finished gummy at multiples of the concentration found in raw hemp. Residual solvents come from the extraction process itself, and their presence in a finished product depends on how thoroughly the purge step was carried out. Knowing which four panels appear on a complete certificate, and what a failure in any one of them means for someone eating the product daily, is the foundation of reading any hemp gummy COA well.
| Panel | What it checks | Why it matters |
|---|---|---|
| Cannabinoid potency | mg per serving and % by weight | Tells you the actual dose |
| Heavy metals | Lead, arsenic, cadmium, mercury | Hemp absorbs metals from soil |
| Pesticides | Common agricultural chemicals | Residue can survive extraction |
| Microbials | Yeast, mold, E. coli, salmonella | Edibles support microbial growth |
| Residual solvents | Ethanol, butane, hexane | Extraction leftovers can be toxic |
Microbial limits matter most for gummies because sugar and gelatin support bacterial and mold growth. A certificate that omits a microbial panel on a sugary edible is leaving the most likely contamination route untested. If you want a deeper walkthrough of every column on a typical document, our buyer's lab transparency guide covers the layout cell by cell.
Red flags on a batch test document that should make you walk away
Red flags on a hemp gummy COA cluster into three buckets: missing information, mismatched batch data, and out-of-spec results that the brand has not flagged. Any single red flag is reason enough to ask a follow-up question. Two together, and you should buy from someone else.
When I was sourcing my first hemp extract for GummyGurl, a supplier delivered a batch test document showing every panel marked PASS. I noticed the heavy-metals action limits on that certificate were set three times higher than the California thresholds I had written into the purchase order. The batch was within the lab's own tolerances but would have failed state requirements the moment a California retailer requested documentation. That experience made batch-number verification and action-limit sourcing two separate checklist items for every order we have placed since.
The biggest immediate flag is a document that does not display a batch or lot number, an issue date, the lab's name and address, and a signature or seal. Without those identifiers, the certificate could belong to any product the brand has ever sold. The FDA has issued warning letters for unsupported potency claims for years, which is one reason this paper trail matters.
The second flag is a date mismatch. A certificate dated more than twelve months before your purchase, with no fresh batch results published, suggests the brand is reusing an old test for new production. Cannabinoids degrade over shelf life, and microbial counts can rise; old data does not describe a current jar. For products that contain THC isomers, our full-spectrum, broad-spectrum, and isolate comparison explains why fresh testing matters even more when minor cannabinoids are part of the formula.
The third flag is a result inside the certificate that fails its own action limit but is presented as a pass. Some certificates use color-coded PASS/FAIL columns; others list a numeric value next to an action limit. If a heavy-metal reading equals or exceeds the limit and the column still says PASS, that is the lab or the brand fudging the report. A clean document presents passes and fails honestly, and a credible brand publishes the failing batches it pulls.
Frequently asked questions
Why does a hemp gummy COA matter if the product is legal?
Legal status describes whether a hemp-derived product can be sold under the 2018 Farm Bill, not whether the contents match the label or are free of contaminants. The FDA confirms that hemp gummies are not pre-approved by the agency, so legality and quality are separate questions. The certificate closes that gap by reporting the actual cannabinoid dose, the presence of heavy metals or pesticides, and microbial counts for a specific batch. Without the document, your only quality signal is the brand's own marketing, which is the weakest possible source for a product you put in your body. Since 2015, the FDA has issued more than one hundred warning letters to companies selling hemp and CBD products, citing misrepresented potency, undeclared THC levels, and claims that crossed into drug-promotion territory. Those letters are public record and searchable on the FDA's website. A hemp brand that publishes third-party batch certificates is making its quality claims auditable in a way that no marketing copy can match.
How recent should a hemp gummy COA be?
A hemp gummy COA should be dated within twelve months of your purchase and should match the specific batch or lot number printed on your jar. Cannabinoid content shifts with shelf age, and microbial counts can climb in sugary edibles over time. If a brand publishes a single certificate dated two or three years ago and applies it to every product page, that is reuse rather than active testing. The CDC health effects page on cannabis products notes documented contamination risks in unregulated cannabis-derived products, which is why fresh batch-level testing matters more than a single legacy certificate stored once on a brand's website. A practical two-step check: find the lot number printed on your jar, then find the lot number on the certificate. If those numbers match and the certificate date is within twelve months of your purchase, you have batch-level documentation. If the numbers differ, or the certificate predates the jar's manufacture date by more than a year, you are looking at a hemp gummy COA that does not correspond to the batch you received. A brand that tests each production run will always have a recent document because testing is part of their manufacturing process, not an afterthought.
What is ISO/IEC 17025 and why should a hemp lab have it?
ISO/IEC 17025 is the international standard for the competence of testing and calibration laboratories, published by the International Organization for Standardization. It covers method validation, equipment calibration, technician training, and result reporting. A certificate from a lab without 17025 accreditation has no independent attestation that its potency or contaminant numbers are accurate. The FDA references the same standard when evaluating laboratory work. Look for an accreditation number on the certificate, then verify it against the public registry of the accrediting body. Real labs welcome the check; paper-mill operations rely on you not bothering. In the United States, the two main accrediting bodies for cannabis and hemp testing laboratories are A2LA (American Association for Laboratory Accreditation) and Perry Johnson Laboratory Accreditation, Inc. Both maintain searchable public registries on their websites. An accredited lab's certificate will display the accrediting body's name and a certificate number; enter that number into the registry and confirm that the lab's scope of accreditation covers the specific tests on your document. If the accreditation number does not appear in the registry, or if the listed scope excludes cannabinoid testing or contaminant analysis, the accreditation claim on the certificate cannot be independently verified.
Does a COA tell you if a hemp gummy will show up on a drug test?
The certificate reports the cannabinoids the lab measured, which is the right starting point for drug-test risk but not the full answer. Most workplace drug tests look for delta-9 THC metabolites, and any hemp-derived gummy with measurable delta-9 THC on its certificate can return a positive depending on dose, frequency, and your own metabolism. Other hemp cannabinoids, including delta-8 and delta-10, can also metabolize into compounds that screening tests sometimes flag. Our THC gummies and drug tests explainer walks through what the lab numbers actually mean if you have an upcoming test.
What is the difference between a third-party COA and a brand's own internal test?
A third-party COA is issued by an outside laboratory that has no financial relationship with the brand selling the product. An internal test is done by the brand itself, in a facility the brand owns or contracts directly, and is not independent. Internal tests can be useful for in-process quality control during manufacturing, but they do not serve the same verification role. FDA enforcement history against hemp brands for inaccurate potency claims is a reminder that self-reported numbers carry the bias of the person making the sale. The key word in third-party is independent. When a lab shares ownership with the brand, operates as a subsidiary, or holds an exclusive contract with a single client, that independence is compromised even if the testing equipment is legitimate. Some brands label in-house results with official-looking headers and call them certificates of analysis. The fastest check is to search the lab name on its own. A genuine third-party testing laboratory will have its own website, publish a client list that extends beyond one brand, and hold a verifiable accreditation number that maps to a scope covering hemp products.
How many contaminant panels should a complete COA include?
A standard certificate should include at least four contaminant panels: heavy metals, pesticides, microbials, and residual solvents. Some certificates add mycotoxins, which are fungal byproducts that survive in poorly stored hemp biomass, and foreign matter checks for physical debris. Contamination from all four categories is well-documented in unregulated cannabis markets. A certificate that reports potency but skips the contaminant section is incomplete; it tells you the dose without telling you whether the rest of the gummy is safe to eat. Take the four-panel minimum as your floor, not your ceiling.