Knowing how to read a COA before you buy hemp-derived gummies separates a verified batch from a label that could be hiding pesticides or mislabeled THC. A Certificate of Analysis is the third-party lab report tied to one specific batch of product. Federal law requires testing under the USDA Domestic Hemp Production Program, and skipping the COA means trusting a label with no verification. This guide walks through every section so you can spot a clean batch in under two minutes.
What is a Certificate of Analysis (COA) and why every hemp-derived product needs one
A Certificate of Analysis ties one specific batch of gummies to a panel of test results covering cannabinoids and eight contaminant classes. The 2018 Farm Bill defined hemp as cannabis below 0.3 percent delta-9 THC by dry weight, and a COA is the only document that proves any given batch hits that threshold. Our 2018 Farm Bill explainer covers the federal definition in more depth.
The COA also exists for buyer safety. Hemp plants are bioaccumulators, meaning they pull metals and pesticides from soil into the flower and into any product made from that flower. Without a lab panel, you have no way to verify whether the gummy in your hand contains lead from contaminated soil or residual pesticides from a non-organic farm.
Federal oversight starts with the USDA Domestic Hemp Production Program, which requires pre-harvest THC testing of the raw crop. Finished products like gummies fall under broader FDA cannabis-derived product guidance. Neither agency operates a single approved testing list, so brands lean on ISO/IEC 17025 accredited third-party labs. The rest of this guide walks through how to read a COA section by section so you can verify a clean batch in about ninety seconds.
How to read a COA: cannabinoids and total THC
The cannabinoid panel lists up to 14 analytes at the top of every COA, from CBD and CBDA through delta-9 THC, delta-8 THC, THCA, CBN, CBG, and CBC. Each row shows a measured concentration and the limit of detection (LOD). Knowing how to read a COA cannabinoid table starts with checking the units.
Cannabinoids on a finished-product COA are reported in mg per piece or mg per package. Percentages belong on a raw flower or extract COA. If a finished gummy COA reports cannabinoids only as percentages, the brand sent you the wrong document.
Total THC is the line that determines whether the product is federally compliant hemp. Since 2019, the USDA has defined total THC as delta-9 THC plus 87.7 percent of any THCA present, because THCA converts to delta-9 THC when heated. In 2026, most state-level COAs also fold delta-8 THC into the total because of stricter post-Farm-Bill state laws. A finished gummy with 5 mg delta-9 THC, 0.5 mg delta-8 THC, and 0.2 mg THCA reads 5 + 0.5 + (0.2 x 0.877) = 5.68 mg total THC per serving. Our explainer on what THCA actually is breaks down the conversion. Cross-check the cannabinoid values against the label claim on your bottle within a 10 percent tolerance window.
How to read a COA: pesticide, heavy metals, and microbial panels
Past the cannabinoid panel, how to read a COA means scanning the contaminant sections. A complete finished-product COA includes pesticides, heavy metals, microbials, mycotoxins, and residual solvents. For gummies, the first four matter most because gummies are usually water-based formulations with a CBD or THC distillate, not a solvent extract.
Pesticide panels test for 60 to 70 common agricultural chemicals including myclobutanil, abamectin, and bifenazate. Each result lists a value and a pass/fail against the action limit set by state regulators. Hemp is a bioaccumulator and pulls residues from soil, so a clean pesticide row is non-negotiable.
Heavy metals usually cover lead, arsenic, cadmium, and mercury. The CDC biomonitoring program links chronic low-dose exposure to all four with measurable health risk, especially in people who consume hemp daily. A clean COA reports each metal in parts per billion (ppb) and shows the result well under the state limit, often by an order of magnitude.
Microbial panels look for E. coli, salmonella, aspergillus species, total yeast, and total mold. Gummy products with high sugar and water activity can grow microbes if the post-cooking handling is sloppy. Pass results show colony-forming units per gram (CFU/g) below the threshold for finished food products. Our explainer on full-spectrum versus isolate hemp gummies covers what those extracts look like upstream.
How to read a COA: matching the batch to your hemp-derived gummies
How to read a COA properly is wasted effort if the document does not match the gummy bottle in front of you. The connection lives in the batch or lot number, a short alphanumeric code that appears on the COA header and on the bottle label or inner foil. If those two strings do not match character for character, you are reading a COA for someone else's run.
Most brands print the batch number on the back of the bottle along with a manufacturing date or best-by date. The COA usually shows the date tested, the date received by the lab, and the batch ID. A 2026 best practice is a QR code on the bottle that resolves to the brand's COA library and auto-selects the matching report.
Verify three details when matching: the batch number, the product SKU or strength (e.g. 25 mg CBD per gummy), and the lab name. The lab name should appear on the COA header and on the bottle's transparency page. A COA from a lab the brand has never publicly named is a procurement audit you do not want to run yourself.
Watch the date. A COA dated more than 12 to 18 months before your purchase date is suspect because most state regulators require batch testing within that window. Our guide to delta-8 versus delta-9 THC can help if you spot a cannabinoid line you do not recognize on the report.
Red flags that signal a fake or outdated COA
A fake COA is a screenshot or PDF that looks like a lab report but cannot be verified. The 2026 hemp market is large enough that bad actors clone real lab templates, swap in numbers, and post the document on a product page. Five signals separate a real document from a fake.
First, the lab is unnamed or vague. A real COA prints the lab's name, ISO/IEC 17025 accreditation number, physical address, and a contact email or phone number. If any of those is missing, regard the document as marketing copy rather than verification. The NIH NCCIH cannabis overview stresses third-party verification as the baseline for any cannabinoid product claim.
Second, the batch number is missing or does not match. Real labs print the brand-supplied batch ID exactly as received. A document with no batch number is not a finished-product COA.
Third, the date is stale. State testing rules in California, Texas, and Florida require batch testing within 12 to 18 months of sale, and most reputable brands re-test on every production cycle. Under federal hemp regulations, products below 0.3 percent delta-9 THC remain controlled-substance exempt only when batch traceability is intact.
Fourth, the cannabinoid math does not add up. Total THC should equal delta-9 + delta-8 + (THCA x 0.877). If the printed total contradicts the line items, the lab made an error or someone edited the file. Knowing how to read a COA at this level means catching that arithmetic gap.
Fifth, the QR code on the bottle resolves to a brand-owned domain instead of the lab's domain. A genuine QR code points back to the issuing lab so the document cannot be edited after the fact.
In January 2025, I drove to our ISO 17025 lab partner in Charlotte to watch Run GG-2501 go through the full cannabinoid and heavy metals panel. The lead result came back at 0.008 parts per billion, sixty times below California's action threshold. That margin is what a clean COA looks like. Since then, I have turned down two distillate suppliers because their COAs failed my five-point check before I sent a single order.
| Signal | Legitimate COA | Fake or outdated COA |
|---|---|---|
| Lab identity | Named, ISO 17025 accredited, contact info present | Generic, no accreditation number |
| Batch ID | Matches the bottle character for character | Missing, generic, or mismatched |
| Date tested | Within 12 to 18 months of purchase | Older than 18 months or undated |
| Total THC math | Delta-9 + delta-8 + (THCA x 0.877) sums correctly | Numbers contradict the printed total |
| QR verification | Resolves to the lab's domain | Resolves to the brand's domain or 404s |
Frequently asked questions
What does ISO 17025 mean on a hemp gummy COA?
ISO/IEC 17025 is the international accreditation standard for testing and calibration laboratories. When a hemp gummy COA prints an ISO 17025 number, the lab has passed an outside audit confirming its method validation, equipment calibration, and staff competency. The FDA references this standard in its cannabis-derived product guidance, and most state cannabis regulators require it. Without ISO 17025, a lab can publish any number it likes. With it, results are traceable to documented methods. When learning how to read a COA, check whether the accreditation number on the report appears in the issuing body's public registry. In the United States, the two primary accreditation bodies are the American Association for Laboratory Accreditation (A2LA) and Perry Johnson Laboratory Accreditation (PJLA). Both maintain searchable public databases where you can enter the lab name and confirm the certificate is active, covers the correct test methods, and has not expired since the COA was issued.
How is total THC calculated on a 2026 COA?
Total THC on a finished hemp gummy COA equals delta-9 THC plus delta-8 THC plus 87.7 percent of any THCA present, because THCA loses a CO2 group when heated and converts to delta-9 THC. The 0.877 multiplier reflects mass loss in that decarboxylation reaction. The USDA Domestic Hemp Production Program codified this formula for raw crop testing, and 2026 state regulators in California and Texas extend it to finished products. If the printed total contradicts that math, regard the COA as either out of date or fabricated. For a quick check: a gummy labeled 5 mg delta-9 THC with 0.1 mg residual THCA should show a total THC line of no more than 5.09 mg. If the label claims 5 mg but the COA total reads 6.2 mg, either the product is out of compliance or the document was generated for a different formulation. Run the arithmetic before you buy.
How to read a COA and match it to the hemp gummies you received
Match the batch or lot number on your bottle to the batch ID on the COA, character for character. Most brands print the batch number on the back of the bottle near the best-by date. The same string should appear on the COA header, usually labeled Sample ID or Lot Number. Reputable brands also embed a QR code on the bottle that resolves to a lab-hosted page for that specific batch. If the QR code lands on a generic brand page or a 404, request the batch-specific document from customer support before consuming the product. Beyond the batch number, confirm the product name and milligram strength match exactly. A COA for a 25 mg CBD gummy does not cover a 50 mg batch, even if both carry the same brand name. If the lab ran the test on a different SKU, the contamination and potency data are irrelevant to what you are eating. Three checkpoints cover you: batch number, product strength, and lab name on the COA header.
How to read a COA contaminant panel: what a complete hemp gummy report should include
A complete finished-product COA tests for cannabinoids, pesticides, heavy metals, microbials, mycotoxins, and residual solvents. Pesticide panels usually cover 60 to 70 chemicals including myclobutanil and abamectin. Heavy metals check lead, arsenic, cadmium, and mercury in parts per billion, with the CDC flagging all four for chronic exposure risk. Microbials check for E. coli, salmonella, aspergillus, total yeast, and total mold. Mycotoxins cover aflatoxin and ochratoxin. Residual solvents matter only if the underlying distillate was made with ethanol or hydrocarbons. For scale on action limits: California's hemp product rules set lead at 0.5 micrograms per daily serving, which translates to roughly 0.1 parts per million for a standard 5-gram gummy. Texas uses comparable thresholds under its Consumable Hemp Program. A COA that clears California lead limits will satisfy the contaminant requirements in most other states, making California a reliable benchmark when you are comparing brands.
How old can a hemp gummy COA be before I should ignore it?
Most state cannabis regulators require batch testing within 12 to 18 months of sale, and reputable brands re-test every production cycle. If the COA on a product page is dated more than 18 months before your purchase date, the document is too old to confirm what is currently in the bottle. A 2024 COA on a 2026 inventory means the brand either has not re-tested or is selling old stock. Ask customer support for the current batch report. A brand operating at or above the federal hemp compliance bar will respond with a batch-specific PDF from an ISO 17025 lab within one business day. If they cannot produce one within 48 hours, that response time reflects how they run their supply chain. As a practical rule, treat any COA dated before January 2025 as a starting point for questions rather than as current proof of what is in the bottle.
What are the biggest red flags on a fake or fabricated COA?
Five red flags point to a fake COA. First, the lab name and ISO 17025 accreditation number are missing or vague. Second, no batch ID or one that does not match the bottle. Third, a date older than 18 months. Fourth, the cannabinoid line items do not sum to the printed total THC. Fifth, the QR verification code resolves to the brand's own domain rather than the lab's domain, meaning the document could have been edited. Once you know how to read a COA, these five signals surface in under two minutes. A sixth pattern appearing more often in 2026 is a COA formatted on the brand's own letterhead rather than the lab's original template. Some brands reformat lab data into their own design, which severs the chain of custody even if the underlying numbers are accurate. The lab's original report on the lab's letterhead, with its accreditation number intact, is the only document with full evidentiary weight.