How to Read a CBD Certificate of Analysis (COA): A Buyer's Guide
Gold Naturals
A Certificate of Analysis (COA) is the single document that tells you what's actually in the CBD product you're about to buy — exact cannabinoid potency, contaminant testing, and lab credentials. This guide walks through what each section means and what to look for before you spend money.
If a CBD brand can't show you a current COA for the specific batch in the bottle, walk away. Everything else they say about their product is a marketing claim until a third-party lab confirms it.
What a COA actually is
A Certificate of Analysis is a document produced by an independent testing laboratory after they analyze a sample from a specific production batch of a product. It reports, in standardized format:
- The exact percentage and milligram content of each cannabinoid (CBD, CBG, CBN, Δ9-THC, etc.)
- Whether the product passes contaminant testing (heavy metals, pesticides, residual solvents, microbials, mycotoxins)
- The lab's credentials, the batch ID, the test date, and the methodology used
The COA is batch-specific. A brand might show you "a COA," but if it's for a batch that was produced 18 months ago and the bottle in your hand is from a different batch, the document is useless. Always check that the batch number on the COA matches the batch number on the product label.
Section 1: The header — who, when, what
The top of a COA tells you:
- Sample name and batch ID. Match this to the label on the bottle.
- Date of receipt and date of testing. Anything over 12 months old is stale; cannabinoid content can degrade over time.
- Lab name, address, and certifications. Look for ISO/IEC 17025:2017 accreditation — that's the international standard for testing-lab competence. Without it, the lab's results carry much less weight.
- Methodology. Reputable labs disclose the analytical method (typically HPLC for cannabinoids).
If the COA doesn't name the lab or doesn't show ISO/IEC 17025 accreditation, treat it as marketing material, not science.
Section 2: Cannabinoid potency
This is the section most buyers actually want to see. It lists each cannabinoid the lab tested for, the limit of detection (LOD), the measured amount (usually as both mg/g or mg/mL and as a percentage), and whether it passes any regulatory limit.
Things to check:
- The CBD content matches the label. A 30 mL tincture labeled "1000 mg CBD" should test at ~33 mg/mL of CBD. If the COA says 24 mg/mL, the bottle is under-dosed.
- The Δ9-THC content is under 0.3% by dry weight — the federal Farm Bill threshold for hemp. Anything over that is no longer hemp under US law (Pub. L. 115-334, 2018).
- The full cannabinoid profile matches the product claim. A "full-spectrum" product should show measurable CBG, CBN, CBC, and trace THC; a "broad-spectrum" product should show those minor cannabinoids but no THC; a "CBD isolate" should show only CBD.
If you're shopping for the entourage effect, the minor-cannabinoid content (CBG, CBN, CBC, terpenes if reported) is exactly what you're paying for. A "full-spectrum" product whose COA shows only CBD is mislabeled.
Section 3: Contaminant panels
This is where the regulatory bar separates a real product from a cheap one. A complete COA includes panels for:
- Heavy metals — lead, arsenic, cadmium, mercury (hemp is a hyperaccumulator and pulls metals from soil)
- Pesticides — typically a 60+ analyte panel
- Residual solvents — ethanol, butane, hexane, etc., left over from extraction
- Microbials — total yeast and mold, E. coli, Salmonella, bile-tolerant Gram-negative bacteria
- Mycotoxins — fungal toxins (aflatoxins, ochratoxin A)
Each line should show: the analyte, the limit (action level), the measured amount, and a PASS/FAIL flag. If contaminant panels are missing entirely, the COA is incomplete and should not be considered a clean bill of health. The World Health Organization's 2018 Critical Review of CBD specifically called out the importance of contaminant testing for plant-derived cannabinoid products — extraction concentrates whatever was in the source hemp, including the bad stuff.
Section 4: The signature, batch ID, and chain of custody
A real COA has a named analyst or lab director signature, a unique document ID, and a batch ID that's traceable back to the brand's production records. Many reputable labs also publish their COAs in a public database accessible by QR code on the product label — scan the code on the bottle, and you should land directly on the matching COA.
If a brand emails you a PDF with no QR-code link, no analyst signature, and no public verification path, that's a yellow flag.
What to do if there's no COA — or it doesn't match
If a CBD brand can't produce a batch-matched current COA:
- Don't buy. The category is full of brands that mass-market untested house brands.
If the COA exists but doesn't match the label:
- Mismatch on CBD potency: the product is under- or over-dosed. Either way, you can't dose accurately.
- Mismatch on Δ9-THC: legal exposure for you (depending on your state) and the brand.
- Missing contaminant panels: incomplete, treat as un-tested.
For a worked example of using a COA to compare two products in the same category, see our guide on how to pick a CBD gummy.
FAQ
What does ISO/IEC 17025 mean on a CBD COA? ISO/IEC 17025 is the international standard for testing-laboratory competence. A lab with this accreditation has been independently audited for its testing methodology, equipment calibration, and quality systems. COAs from non-accredited labs carry significantly less weight.
How often should a CBD brand re-test? Best practice is to test every production batch — not periodically, not on representative samples, but every batch. Each COA should reference a specific batch ID that matches the product label.
What's a "Pass" on a contaminant panel? "Pass" means the measured amount was below the regulatory action level for that contaminant. The action level varies by analyte and by jurisdiction; reputable COAs publish the action level alongside the measurement so you can see how the result compares.
Why does CBD content differ from the label? Cannabinoid content can drift due to extraction variation, storage degradation, or simple mis-labeling. Reputable brands target the labeled content within ±10% tolerance. A 30%+ deviation from the label is a quality problem.
Can I trust a COA the brand emailed me? A scanned or emailed PDF is fine if it's signed by the lab and includes the batch ID. The strongest signal is a brand that publishes COAs publicly (via QR code on the label, or a public lab database) — that removes any chance of cherry-picked or doctored documents.
The short version: read the header for credentials, match the potency to the label, confirm contaminant panels are complete with PASS results, and check that the batch ID on the document matches the bottle in your hand. Brands willing to make all of that easy to verify are the ones worth your money.
This article is general information about lab testing, not legal or medical advice. For specific questions about a Certificate of Analysis on a Gold Naturals product, our team is happy to walk you through the document — every batch we ship has a current COA from an ISO/IEC 17025-accredited lab, posted publicly on the product page.
Want to see what a complete COA looks like? Browse our CBD gummies collection or tinctures collection — every product page links to the matching current COA.
