Cannabis Lab Testing & Certificate of Analysis Requirements
Last reviewed · By Chad Griffith
Every state cannabis program requires lab testing of cannabis batches before sale. Required test panels, action limits, lab accreditation, and Certificate of Analysis (COA) format vary by state. Failure to maintain compliant testing records or distributing untested or failed batches is among the most serious violations enforceable by state Cannabis Regulatory Authorities.
Required Test Panels
Common state-required test panels: cannabinoid potency (THC, CBD, total cannabinoids — universal); terpene profile (some states); microbial contamination (E. coli, salmonella, total yeast/mold — universal for finished products); pesticide residue (panel of 60+ pesticides with action limits in parts per billion); heavy metals (lead, arsenic, cadmium, mercury); residual solvents (for extracts only — butane, propane, ethanol, hexane); water activity / moisture (for flower/dry); foreign material (visual or sieve test); homogeneity (for edibles — confirms even cannabinoid distribution).
ISO 17025 Lab Accreditation
State Cannabis Regulatory Authorities license cannabis testing labs separately from cultivators and dispensaries. Most states require labs to maintain ISO/IEC 17025 accreditation through a recognized accreditation body (A2LA, ANAB, PJLA in the US). The accreditation must specifically cover the test methods used. Lab licenses must be renewed annually or biennially. Use of an unaccredited lab or a lab without state authorization invalidates COA results.
COA Retention
COA retention requirements: California (CCR Title 4 Section 15049) — 7 years; Colorado (1 CCR 212-3) — 3 years; Michigan (R 420.501) — 5 years minimum; Massachusetts — 3 years for most records, longer for adverse event documentation. Records must be retrievable to state CRA inspectors on demand, typically within 24-72 hours of request.
Failed Test Procedures
Pesticide failures generally cannot be remediated — the batch must be destroyed. Microbial failures may be remediated through extraction in some states (the extraction process kills microbial contaminants). Heavy metal failures require destruction. Failed batches must be reported to METRC with the failure code and a destruction record. State CRAs receive failed-test reports automatically through state-level lab reporting integrations.
Frequently Asked Questions
What pesticides are tested for in cannabis?
States typically test for 60-70 pesticides with action limits in parts per billion. Common targets: abamectin, bifenazate, captan, chlorpyrifos, daminozide, imidacloprid, malathion, myclobutanil, paclobutrazol, permethrin, piperonyl butoxide. California's panel includes 66 pesticides with separate action limits for inhalable (flower, vape) versus non-inhalable (edibles) products.
How much does a full panel cost?
Full-panel testing costs typically run $250-$700 per batch depending on state requirements and lab. Costs are absorbed by the licensee submitting the sample (cultivator or distributor depending on state model).
Can a failed batch be re-tested?
Re-testing is allowed in most states for batches that fail microbial or potency tests after appropriate corrective action. Re-tests must be from a fresh sample of the same batch using a state-approved methodology. Pesticide failures generally cannot be remediated. Re-test results must be documented and retained alongside the original failure.
What information must appear on a COA?
Required COA elements typically include: lab name and license number, ISO 17025 accreditation reference, sample collection date and method, batch/lot ID matching METRC, all required test panels with pass/fail status, exact analyte values with units and action limits, lab director or qualified individual signature, and report date.
Authoritative sources