CBD certificate of analysis: how to read a CoA in France

A CoA ("Certificate of Analysis") is a document issued by an independent third-party laboratory that has tested a specific sample of a CBD product. It is neither a label nor a brand guarantee: it is a one-off, dated measurement tied to a particular batch number. A batch with no CoA, or with a CoA several years old, allows no verification at all.

In France, no regulation obliges sellers to provide a CoA. It is a good professional practice recommended by industry bodies, but it is not policed by any authority. Publishing one is therefore a matter of each brand's voluntary transparency.

The legal 0.30 % THC threshold, set by the Conseil d'État decision of 29 December 2022, applies to the finished product. The CoA is the only documentary proof of that compliance. Anyone holding a product that exceeds it faces criminal penalties.

The ANSM has also placed several synthetic cannabinoids on the narcotics list: HHC, HHC-O, HHC-P, then H4CBD, H2CBD, HHCPO, THCP and THCA, banned since June 2024. The CoA is the only way to verify their absence. Finally, the Cour de cassation confirmed on 21 June 2023 that a legal CBD product does not exonerate a driver who tests positive for THC in a saliva test: knowing your product's real level remains useful for gauging that residual risk.

A reliable CoA generally covers five points. Identification of the batch and the laboratory: name, accreditation ideally ISO 17025, date of analysis, batch number matching the product bought. The cannabinoid profile: percentage of CBD, THC, CBG, CBN, with delta-9-THC at or below 0.30 % of the finished product.

Next come pesticides and herbicides: hemp is a plant that intensively absorbs whatever is in the soil, so a complete CoA analyses several dozen molecules. Heavy metals (lead, mercury, cadmium, arsenic), which can contaminate hemp via the soil or irrigation water. Finally, residual solvents and microbiological contamination, particularly important for flowers and for products not heated before consumption.

A CoA dated more than twelve months before a recently bought product is a warning sign, as is a generic CoA published for an entire range rather than a specific batch. The absence of pesticide and heavy-metal testing is likewise inadequate: a complete CoA must cover cannabinoids, pesticides, heavy metals, solvents and microbiology.

A CoA with no verifiable laboratory letterhead, or published by an unknown manufacturer with no clear legal details, deserves scepticism. The same principle of vigilance applies to products intended for animals: see our article on CBD and the restless dog for the specific precautions, THC being toxic to dogs even at low doses.

Is a CoA mandatory in France?

No, no regulation obliges CBD sellers to publish a certificate of analysis. It is a good professional practice recommended by industry bodies. Without one, a product's traceability remains incomplete.

What do "ND" and "< LOQ" mean on a CoA?

"ND" means not detected: the molecule looked for was not found at the laboratory's detection threshold. "< LOQ" means it may be present in very small quantities, without precise quantification. These entries are normal for contaminants.

My CoA says 0.28 % THC — is that legal?

Yes, as long as the finished product's level stays at or below 0.30 %, the threshold confirmed by the Conseil d'État decision of 2022. See also our article on the differences between hemp and recreational cannabis for the detail of that threshold.

Does an "organic" product make a CoA unnecessary?

No. An organic label attests to the absence of synthetic pesticides in cultivation, but it does not measure the THC level and does not check microbiological contamination. An organic label and a CoA complement each other; one does not replace the other.