How to read a CBD certificate (COA): what to check before buying hemp oil

A Certificate of Analysis (COA) is the only documentary proof of what's actually in a bottle of CBD oil. The problem is that most buyers either don't know about it or can't read it—and instead trust the label. The label is a declaration from the manufacturer. A COA is the result of testing by an independent laboratory. It's the difference between "merchant's word" and "hard analytical data." In this article, we'll go through each element of the COA step by step: the cannabinoid panel, pesticides, heavy metals, microbiology, laboratory accreditation, and batch number matching.

KEY INFORMATION
• A COA issued by an accredited ISO 17025 laboratory is the basic safety standard when purchasing CBD.
• Check „Total THC” (not just delta-9-THC): Total THC = THC + 0.877 × THCA – should be below 0.3%.
• The batch number (Batch ID) on the bottle must match the number on the COA — otherwise, the certificate does not pertain to your product.
• Desired results: ND (not detected) for pesticides, heavy metals, and solvent residues.

Why is it important to check the COA before purchasing?

The CBD market in Poland and Europe is poorly regulated compared to the pharmaceutical market. Manufacturers must declare the composition, but independent verification is not mandatory for every batch of product. The results of studies from independent organizations (e.g. Project CBD, CannaSafe) are alarming: up to 40% of tested CBD products in the USA and Europe had CBD concentrations deviating from the declared amount by more than 20%, and some contained detectable levels of pesticides or heavy metals not listed on the label.

A COA is not a guarantee of perfection — it is a guarantee of transparency. A manufacturer who provides a COA gives you the opportunity to verify their claims. A manufacturer without a COA asks for your blind faith. In an environment where product quality directly affects your health, this is a fundamental difference.

Cannabinoid panel – the core of every COA

The cannabinoid panel is the most important section of the certificate. It contains a list of all measured cannabinoids with their concentrations — usually expressed in mg/ml or percentages. Here’s what to check and why.

Total CBD (total CBD content): Check the "Total CBD" value—it should be close to what's declared on the label, with a tolerance of ±10%. For 10% oil (1000mg CBD/10ml), the COA should show 900–1100mg Total CBD. If the COA only lists "CBD" and not "CBDA," it may not include the acidic form. Total CBD = CBD + 0.877 × CBDA. A good COA will list both values and calculate them together.

Total THC: This is the most important value from a legal and health perspective. Total THC = delta-9-THC + 0.877 × THCA. Don't just look at "delta-9-THC"—the THCA form (THC-A acid) doesn't produce a psychoactive effect, but converts to THC upon heating (decarboxylation). In legal products, Total THC should be below 0.2–0.31 TP3T. For maximum safety during drug testing, look for products with "ND" (not detected) for both forms.

Other cannabinoids: A good COA also lists the concentrations of CBG (cannabigerol), CBN (cannabinol), CBC (cannabichromene), CBDV, and others. Full-spectrum products naturally contain these cannabinoids in small amounts — this is desirable due to the entourage effect. A CBD isolate should have CBD in the range of 95–99%, with other cannabinoids at ND or trace levels.

Pesticide panel – what the laboratory should test

Hemp is a bioaccumulative plant — it absorbs chemicals from the soil and air, including pesticides, with remarkable efficiency. If the plant grew in soil contaminated with insecticides or fungicides, the finished CBD extract may contain them at concentrations capable of causing health effects.

A good pesticide panel in the COA should cover at least 60–100 substances, tested using LC-MS/MS (liquid chromatography with tandem mass spectrometry) or GC-MS/MS for volatile pesticides. All results should be at ND (Not Detected) or below the EU MRL (Maximum Residue Level) limit for individual substances.

Red flags on the pesticide panel: "Pass/Fail" results without numerical values (you can't assess margin), a panel containing only 10-15 substances (insufficient range), and a missing analytical method (suggesting the lab isn't subject to standard accreditation). If a manufacturer claims that "organic" cultivation eliminates the need for testing, that's flawed. Organic certification reduces risk but doesn't eliminate it entirely, and a COA is an objective verification, not a declaration.

Heavy metals – why is this important for CBD?

Historically, hemp has been used for phytoremediation — removing heavy metals from contaminated soil. This is a good property for environmental cleanup but a bad one for supplement safety. Plants grown in soils with historical industrial contamination (especially in Poland, where heavy industry has affected the soils of central and southern regions) may contain lead, arsenic, cadmium, and mercury.

A proper heavy metals panel in a COA should include the "big four": lead (Pb), arsenic (As), cadmium (Cd), and mercury (Hg). All should be ND or below USP limits (e.g., Pb <0.5 ppm in dietary supplements). The analytical method is ICP-MS (inductively coupled plasma mass spectrometry)—the only one sensitive enough for ppb values. The limit of detection (LOD) should be below 10 ppb (parts per billion) for each metal.

Lead is particularly concerning with prolonged use of supplements — it accumulates in tissues and bones, and its safe concentration in a single dose can become toxic with months of exposure. When purchasing CBD for children or individuals regularly taking the product, verifying heavy metals is an absolute priority.

Solvent residues – extraction matters

CBD is extracted from hemp using various methods: supercritical CO2, ethanol, hexane, or other organic solvents. The extraction method affects the cannabinoid profile and the chemical residues in the final product.

CO2 extraction is considered the "gold standard" for purity—CO2 is chemically inert and leaves no toxic residue. Ethanol extraction typically produces a broad cannabinoid profile (good for full-spectrum), but requires thorough evaporation of the ethanol—ethanol residues above 5,000 ppm are potentially harmful. Extraction with hexane or other petroleum-based solvents leaves much more dangerous potential residues and is increasingly rare among reputable producers.

The COA should include a solvent residue panel using the GC-Headspace method. All results: ND or below the USP Class 1/2/3 limit. The absence of a solvent panel in the COA is a significant deficiency — especially if the extraction method is not provided or the manufacturer is new/unknown.

ISO 17025 accreditation – how to verify a laboratory

ISO 17025 is an international standard for testing and calibration laboratories. It includes requirements for personnel competence, calibration of measuring equipment, validation of analytical methods, quality control of results, and management of the quality system. A laboratory with ISO 17025 must regularly participate in external proficiency testing schemes and be subject to audits by the accrediting body.

How to verify? Every COA should provide the laboratory's accreditation number. In Poland, accreditations are granted by the Polish Centre for Accreditation (PCA) — verification is possible on the website pca.gov.pl. For foreign laboratories: A2LA (USA), UKAS (UK), DAkkS (Germany), COFRAC (France) — all have public search databases. Enter the accreditation number from the COA and check if the laboratory is active and accredited for the appropriate range of tests.

Our observations: We check the COAs for the products we review—one of the most common issues is a certificate that lacks an expiration date or lacks a clear link to the current batch. An 18-month-old certificate for a product currently on sale doesn't guarantee the quality of the current batch. Manufacturers who take quality seriously issue new COAs for every production batch—not just once a year "for a generic product.".

Matching the batch number – how to do it in practice

The batch number (Batch ID, Lot Number, LOT) is a unique identifier for a specific production series. Each bottle produced in the same series has the same LOT number — different batches may vary, as each new production starts with new raw materials and may have a slightly different chemical profile.

Practical: Find the LOT number on the bottle (usually on the label or bottom of the packaging). Then, open the COA provided by the manufacturer and compare the LOT/Batch ID number in the certificate header with the number on the bottle. If there's no clear Batch ID on the COA, the certificate is "generic" and may apply to a different batch. Some manufacturers create QR code websites where scanning the code on the bottle reveals the exact COA for that batch—this is the most convenient and reliable system.

What should you do if the Batch ID doesn't match? Contact the manufacturer and request a COA for the exact LOT number on the bottle. A reputable manufacturer should provide this document without issue. If they refuse or claim "no such number exists," it's a sign to look for another supplier. When choosing CBD oil, it's also worth checking the product selection guide: How to choose CBD oil.

Microbiology – often overlooked section of the COA

The microbiological panel is a section of the COA that many users ignore — yet it is important, especially for products consumed orally. It checks for the presence of microbiological pathogens: Salmonella, E.coli, Staphylococcus aureus, fungi and molds, and the total aerobic count.

Why are hemp plants susceptible to microbiological contamination? Plants grown outdoors come into contact with soil, rain, and insects — which increases the risk of colonization by pathogens. Ethanol extraction may not eliminate all microbiological contaminants. CBD products without a microbiological panel — especially those produced by small, unverified manufacturers — pose potential risks, particularly for individuals with compromised immunity.

Standard limits: Salmonella – absent in 1g, E. coli – <10 CFU/g, total microbial count – <1000 CFU/g (depending on regulations). The certificate should report quantitative results or "absent," not just "pass." Information on CBD's safety for people with medical conditions and boosting immunity can be found in this article. CBD and immunity.

Frequently Asked Questions

What is a COA certificate for CBD oil?

A COA (Certificate of Analysis) is a laboratory document confirming the chemical composition of a CBD product. A reliable COA includes a panel of cannabinoids, pesticides, heavy metals, solvent residues, and microbiology — issued by an accredited external laboratory with ISO 17025 and a Batch ID number matching the product.

How to check if THC in CBD oil is within the norm?

Check "Total THC" in your cannabinoid panel: Total THC = delta-9-THC + 0.877 × THCA. For EU-legal products, the value should be below 0.2–0.31 TP3T. For maximum safety when drug testing, look for "ND" for both forms of THC. Learn more about CBD and drug testing in this article. CBD and drug tests.

What is ISO 17025 accreditation for a CBD laboratory?

ISO 17025 is a standard for the competence of testing laboratories, covering quality management, equipment calibration, and method validation. You can verify the accreditation number in the PCA database (Poland) or A2LA, UKAS, DAkkS (abroad). A laboratory without accreditation does not guarantee the reliability of results.

What does "ND" mean on a CBD certificate?

ND (Not Detected) — concentration below the limit of detection (LOD) of the method used. For pesticides and heavy metals, ND is a desired result. LOD should be stated in the COA — a good method has an LOD below 10 ppb for metals and 0.01% for THC.

How to match the COA to a specific bottle of CBD oil?

Find the batch number (Batch ID, Lot Number) on the bottle label and compare it with the number in the header of the COA certificate. If the numbers do not match, the certificate does not pertain to your product. Ask the manufacturer for the COA for the exact LOT number.

How much CBD should the oil contain according to the label?

A good product has a CBD content in the COA within ±10% of the declared value. A 1000 mg CBD oil should have 900–1100 mg in the COA. Deviations above 20% suggest production issues or manufacturer dishonesty. Total CBD = CBD + 0.877 × CBDA.

This article is for informational and educational purposes. It contains internal links to products available in the u Bucha store. Prices and specifications may change — check the current data on the product page before purchasing.

Author: Michał Waluk · Published: 2026-05-04 · Updated: 2026-05-04