Cannabis COAs: A State-by-State Guide to Testing Requirements

A COA, also called a Certificate of Analysis or lab results, is a document issued by a licensed, third-party testing lab, certifying the potency and purity of a cannabis product. COAs detail the results of tests performed on a cannabis product, from the cannabinoids it contains to information on mold, pesticide, and other potential contaminants, ensuring that all products meet the specific quality and safety standards set by a state’s regulatory agencies.

These documents give consumers security that their products are safe and insight into what’s in the products beyond THC. COAs are essential for both consumer trust and regulatory compliance. They also give cannabis companies a level of protection for product quality and safety.

No matter where in the US a consumer buys a cannabis product, they can rest assured knowing this product has been tested and has a COA. In a siloed and patchwork industry like cannabis, COAs are a rare moment of uniformity. Of course, every state has its own requirements, and in some states, the requirements may even change depending on the testing lab—just another cannabis industry quirk!

While consumers are the main focus and beneficiary of COAs, these lab documents also serve an important purpose for brands: risk management.

Insurance Purposes

COAs provide product liability mitigation for cannabis brands. These documents address crucial customer safety concerns from potential contaminants, including pesticides, mold, and heavy metals, that could cause adverse reactions.

Having a COA for every product demonstrates a culture of safety for brands and gives them security against claims of misleading or mislabeling. When a third-party verifies the absence of contaminants and the exact amount of terpenes and cannabinoids, it’s much harder for consumers to make claims of inaccurate potency or ingredients. Additionally, these documents can provide defense in the case of litigation, providing proof for product quality and adherence to standards.

COAs are important to insurance companies. Underwriters will typically scrutinize COAs from a cannabis brand seeking coverage as part of calculating their risk assessment for policies, including product liability, general liability, and recall policies. Strong COAs, especially those that go beyond basic state requirements, can lead to better coverage and terms.

Regulatory Purposes

Noncompliance with state requirements can be a costly problem for brands. COAs are documents that demonstrate compliance with specific testing mandates, providing a layer of protection and security for cannabis brands. There are no fines, penalties, or risk of losing your license when your compliance is clearly documented.

Supply Chain Purposes

Seed-to-sale tracking means that every company that comes into contact with a raw or finished cannabis plant must document it. Issues detected on a COA may point to potential problems within a supply chain, identifying risk early on.

Reputational Purposes

Transparency in cannabis testing is vital to consumer trust in the regulated industry. Especially in states where cannabis taxes are high, COAs are a major differentiator in the legal industry, giving customers assurance that their products are safe—something the illicit market cannot do.

Exact COA testing requirements vary from state to state, but there are a few key categories that nearly all states include.

Cannabinoid Potency

This may only include THCa, THC, CBDa, and CBD, but more states are expanding their requirements to include minor cannabinoids like CBN and CBG. Documented cannabinoid potency is crucial for product classification and sorting hemp products from regulated cannabis. It also helps consumers understand their dosing and product potency.

Terpene Profile

Not every state has requirements for testing terpenes, but it’s important for two reasons: terpenes affect consumer experience via the entourage effect, and the presence of more aromatic compounds is typically an indicator of quality cannabis flower.

Contaminants (Safety Testing)

Containment testing is required in every state because it’s the biggest indicator of product safety. There are many potential contaminants that cannabis products must be tested for, although these vary by state. Typically, a COA will include results for testing for

• Pesticides: Prohibited or restricted agricultural chemicals that could be sprayed during growing or absorbed through the soil.
• Heavy Metals: Lead, arsenic, cadmium, and mercury, which can be absorbed from the soil or water.
• Microbial Contaminants: these requirements vary greatly, but often include mold, yeast, and bacteria (such as E. coli, Salmonella).
• Residual Solvents: Any remaining solvents from extraction processes, such as butane, propane, and ethanol, which present consumer safety risks.
• Mycotoxins: Toxic compounds produced by fungi, including but not limited to aflatoxins and ochratoxins.
• Foreign Matter: Visual inspection for impurities such as stems, seeds, and insects.

Disclaimer: cannabis regulations are dynamic and subject to change. This overview is meant to provide a snapshot of the current requirements of select states at the time of publication. Always consult your official state regulatory bodies for the most up-to-date information.

States with Comprehensive & Mature Requirements

A mature cannabis market is one with a well-established cannabis market and/or a robust medical market. These states tend to have highly stringent testing mandates and often require testing for potency as well as major contaminants with low, strict action limits. Some states may even take it a step further, requiring certain lab accreditation or specific testing methodologies.

California (Department of Cannabis Control – DCC)

California is a famous (or infamous) cannabis market for many reasons—it is the largest in the world, it is one of the oldest, and the state is known for its plethora of red tape, including its stringent cannabis testing regulations. There is a low action limit here, and it is perhaps easier than some cannabis companies would like it to be to fail testing. Among their many requirements includes testing for:

• Cannabinoids and terpenes
• Residual solvents and processing chemicals
• Residual pesticides (over 60 analytes)
• Heavy metals
• Microbial impurities/ contaminants
• Mycotoxins
• Moisture content and water activity
• Foreign material

If a product fails any of the contaminant testing, it is required to be destroyed or remediated, which requires DCC approval. Additionally, California requires labs to hold and maintain an ISO/IEC 17025 accreditation.

Oregon (Oregon Liquor and Cannabis Commission – OLCC)

The state of Oregon mandates comprehensive cannabis testing for all products, and even breaks down its testing requirements by product type and date produced (notably, kief has its own requirements separate from cannabis flower). The state also requires that labs use specific sampling and reporting protocols, mandating that all failed product is reported to the state within 24 hours.

• Cannabinoids
• Pesticides
• Heavy metals
• Residual solvent
• Microbials
• Mycotoxins
• Water activity
• Moisture content

Testing for terpenes is not required by the state, but is offered by many labs in Oregon. Oregon required labs to be accredited through Oregon’s Environmental Laboratory Accreditation Program (ORELAP) and the OLCC.

Colorado (Marijuana Enforcement Division – MED)

As the oldest recreational cannabis market in the US, Colorado has arguably the most mature testing framework. There are specific sample protocols by product category that labs must follow, and the state requires products to be tested in their final form (so flower and prerolls must be tested separately). Colorado is notable because a lab cannot test both recreational and medical cannabis products—it’s one or the other.

Labs here are required to test for:

• Potency (THC, CBD)
• Residual solvents
• Pesticides (with a specific list of prohibited chemicals)
• Microbials (total yeast and mold, E. coli, Salmonella)
• Heavy metals (arsenic, lead, cadmium, and mercury)
• Mycotoxins
• Water activity
• Foreign materials

Terpene testing is not mandatory, but available for businesses that request it. Colorado requires labs to hold an ISO/IEC 17025 accreditation certificate, a state certification, and potentially a local license as well.

Washington (Washington State Liquor and Cannabis Board – WSLCB)

The second-oldest recreational cannabis market in the nation (by a slight margin) has similarly comprehensive testing requirements as California and Oregon, although specific limits and required analytes vary slightly.

Interestingly, heavy metal testing is optional for “non-DOH-compliant products,” although the limits apply to all products. Labs in Washington must be licensed by the state and hold an accreditation from the Washington State Department of Agriculture as well as an ISO/IEC 17025 accreditation. Labs can only use testing methods approved by the state, although they may submit their own testing methods for approval.

Required product testing in Washington varies by product type and includes:

• Potency (THC, THCa, CBD, and CBDa)
• Moisture content
• Foreign matter
• Heavy metals
• Pesticides (optional for certain product categories)
• Residual solvents
• Water activity

Terpene testing is not required unless a company wishes to list it on the label, in which case it must be included on the COA.

Massachusetts (Cannabis Control Commission – CCC)

Labs here must be licensed through the state, although Massachusetts is notable for having two lab licenses: the Independent Testing Laboratory (ITIL) and the Standard Laboratory. Both types of labs must hold an ISO 17025 accreditation.

Required testing includes:

• Cannabinoids
• Terpenes
• Heavy metals
• Pesticides
• Residual solvents
• Microbials (total aerobic plate count, total yeast and mold, E. coli, Salmonella)
• Mycotoxins
• Foreign matter
• Plant growth regulators (PGRs)

Some products are subject to additional testing in their final forms, like vapes, which must be tested for Vitamin E Acetate. The CCC frequently updates its protocols; a recent update aimed to standardize THC and CBD content.

States with Evolving & Moderate Requirements

These states are those with established cannabis markets but evolving testing requirements. Their regulations may offer more flexibility in certain areas for products or require less expensive testing than the states mentioned above. Make no mistake: these states still require potential contaminant testing and core safety tests, but they may allow for different testing methods or fewer analytes.

Michigan (Cannabis Regulatory Agency – CRA)

Labs in Michigan must be certified through the state and hold an ISO/IEC 17025 to test both medical and recreational cannabis products. Labs are required to use an analytical testing method as detailed by the Association of Official Analytical Collaboration.

Requires testing varies by product type, but includes:

• Cannabinoids (THC, THCa, CBD, and CBDa)
• Heavy metals
• Pesticides
• Residual solvents and chemical residues
• Water activity
• Microbial contaminants (total yeast and mold, E. coli, Salmonella)
• Foreign matter

Michigan allows failed products to be retested or remediated instead of destroyed, but remediated products must pass two consecutive retests. Terpene testing is not required but available for brands that request it.

Illinois (Illinois Department of Agriculture/Cannabis Regulation Oversight Officer)

Labs in Illinois must be certified through the state, either through the lab accreditation program or the state Department of Public Health. Additionally, labs must be permitted by the state Department of Agriculture and hold an ISO/IEC 17025 accreditation.

Required tests include:

• Potency
• Residual solvents
• Pesticides (may vary by lab)
• Heavy metals
• Microbials
• Mycotoxins
• Foreign matter

While contaminant testing is required, mold and yeast action limits are notably lower in Illinois than in other states.

Nevada (Cannabis Compliance Board – CCB)

Labs in Nevada must be licensed through the state and hold an ISO/IEC 17025 accreditation. Nevada labs “can test” for up to 18 analyte categories, although which tests are mandated vary by product type.

Required testing includes:

• Potency
• Pesticides
• Heavy metals
• Residual solvents
• Microbials (fungus, mold, yeast, bacteria, plant growth regulators)
• Mycotoxins
• Foreign matter
• Terpenes

These regulations are evolving; when the recreational cannabis program first began, the state did not mandate testing for residual solvents, but now does.

New York (Office of Cannabis Management – OCM)

Labs in New York must be certified through the state and hold the standard ISO accreditation. While New York mandates robust testing for recreational cannabis products, the state falls under this category because it does not require the same disclosures or testing requirements for medical marijuana products. The state also allows variance from the THC information on the label versus the COA.

Required tests include:

• Potency
• Pesticides
• Heavy metals
• Residual solvents
• Microbials
• Mycotoxins
• Water activity
• Foreign materials

The state has, and is expected to continue to increase stringency over time.

Oklahoma (Oklahoma Medical Marijuana Authority – OMMA)

Oklahoma is a medical marijuana state with a robust hemp presence. Labs here must be licensed through the state and hold the standard ISO accreditation. Despite the young age of the program, testing requirements have already undergone several revisions to increase stringency.

Required testing includes:

• Labs here are required to test for:
• Potency
• Microbials
• Residual solvents
• Chemical residue
• Heavy metals
• Pesticides
• Contaminants and filth
• Terpenes
• Water activity

States with Nascent or Limited Requirements

In states with new medical or adult-use cannabis programs, or in areas where only hemp is legal, there are often fewer or less stringent requirements for cannabis labs as well as less oversight. Testing in these states tends to be limited to basic potency disclosures or a subset of potential contaminants, if it’s required at all.

Florida (Office of Medical Marijuana Use – OMMU)

As a medical state, Florida has strict limits for the potency of its products but slighter higher limits of microbials and bacteria than other states. Consumers have shared concerns that they have been able to buy products that fail certain parameters of safety testing, raising concerns about quality control. Labs here must be licensed through the state and hold the standard ISO accreditation.

Testing requirements vary by product type and include:

• Potency
• Residual solvents
• Pesticides
• Heavy metals
• Microbials
• Mycotoxins

Hemp-Derived CBD Products

Many hemp-only states do not require testing for hemp-derived CBD products or merely require potency disclosure. This has led to consumer concern about the safety of hemp products, as typical consumer safety tests for pesticides and heavy metals are not required, highlighting the importance of COAs for building customer trust.

There are a few common challenges that cannabis businesses face when it comes to COAs. 

• Lack of Federal Standardization: Unlike other consumer goods, cannabis lacks overarching federal guidelines for safety, which creates a patchwork of state regulations. Having to navigate the complexity of a maze of red tape that looks different in every state is nothing new for cannabis operators, but is time-consuming nonetheless. 
• Varying Methodologies: Without getting too scientific, the methods that labs use to test for the same things, like contaminants and THC potency, may vary by lab or state, which can create inconsistent results and issues comparing products across state lines. Does your state have a mandated testing protocol, or leave it up to the labs? You don’t need to know the nitty-gritty differences between HPLC versus GC for potency testing, but you should be aware of the different methods. 
• “Lab Shopping”: The practice of seeking out labs that produce favorable results is a blight on the cannabis industry, undermining consumer trust and safety for a few more points of THC potency. 
• Interstate Commerce Issues: Federal illegality means THC-dominant products cannot cross state lines, while hemp products may face conflicting regulations regarding testing requirements.
• Cost of Testing: Labs know they’re a required part of the supply chain, and some take advantage of that with higher prices, especially in markets where there isn’t much competition. This isn’t a big problem for MSOs, but it can pose a significant financial burden for smaller businesses and startups, making it hard to diversify market offerings.

COAs aren’t optional, but they can be beneficial for cannabis businesses. With the right lab partner and a firm system in place for COAs, these lab results can be a canna-business’s best friend.

• Due Diligence in Lab Selection: The right lab partner matters. First, always confirm the status of a lab’s state license to test cannabis. Then, seek out labs with an ISO 17025 accreditation as they must uphold high standards of accuracy, integrity, and timely reporting, if it’s not already required in your state.
• Understand State-Specific Regulations: Regulations are subject to change, by state and by local jurisdiction. It’s your responsibility as a cannabis business owner to stay up to date on all applicable state and local testing requirements by jurisdiction. The right lab partner can make this easier.
• Maintain Meticulous Records: COAs only provide protection if you have them. Regardless of the data-keeping practices of your chosen lab, your businesses should make it a priority to keep comprehensive records of all COAs, along with batch numbers, cultivations and production data, and testing protocols. This information is critical for state audits and in cases of recalls and litigation, and you don’t want to wait until you’re under a deadline to get this information together.
• Ensure Clear & Accurate Labeling: Product labels must comply with all state mandates, which may include the COA results directly on the product packaging. Many brands provide a QR on packages to direct consumers directly to the COAs for a product’s batch result or a master page of all COAs.
• Invest in Quality Control: Establishing robust internal quality control processes throughout your business and supply chain early on helps minimize the risk of failed tests or inconsistent product quality later on.
• Insurance Considerations: Robust COA protocols can help your business potentially qualify for competitive insurance rates and premiums. Share your COA practices with underwriters when seeking new coverage or renewal.
• Proactive Engagement: Cannabis has a complex regulatory landscape, especially across state markets. An important best practice is to be proactive with your partnerships with specialized legal, compliance, and insurance experts familiar with the cannabis industry.

COAs are a vital part of the cannabis industry, ensuring product safety and regulatory compliance while helping businesses manage risk. However, these requirements vary on a state-by-state basis and are subject to change. Should cannabis move from a Schedule I substance to a Schedule III or be descheduled, businesses should expect changes in federal oversight and even interstate commerce, which will change the testing landscape significantly.

Robust testing protocols are a key piece of setting your business up for lasting success, safeguarding your investment, and building consumer trust. A comprehensive COA protocol is not just the cost of doing business—it’s an investment into a stable future of transparency and customer loyalty.

Protecting your cannabis company can seem confusing; however, we’re a full-service insurance brokerage working with carriers worldwide to offer you the best coverage possible. We’re here to help! Please reach out to us today by email [email protected] or calling 646-854-1093 for a customized letter or learning more about your cannabis insurance options.