CBD certificate of analysis: 6 lines to read on a COA

A certificate of analysis records a measurement. A laboratory received a sample, prepared it, ran it through an instrument and reported the numbers. The document describes that sample alone, taken from one batch on one date. It is neither a label nor a brand guarantee.

This has three consequences for you. A certificate issued for another batch tells you nothing about the pouch you are holding. An old one tells you nothing about a flower that has aged since, because THCA slowly becomes THC and then CBN in storage. A "range" certificate without a batch number is not linked to any product.

French rules do not require sellers to publish a certificate, but the limit itself is fixed. The order of 30 December 2021 caps the Δ⁹-THC content of authorised hemp varieties at 0.30% and applies the same cap to "hemp extracts, and the products that contain them". A certificate is the only document that sets a figure against that limit.

Begin with the header, where the batch number must match the one on the pack character for character. Note when the sample was taken or received, then the date of the report. If a flower's report is more than a year old, ask the seller about it.

The laboratory should be named, with an address and a report number. The words "ISO 17025" alone are not enough. That standard sets competence requirements for testing laboratories, and accreditation is what confirms that a laboratory meets them for specific tests. In France, Cofrac is the only body allowed to grant these accreditations. Its directory publishes each laboratory's scope, the exact list of tests covered. Our guide to checking the scope of an accreditation takes you through it in five steps.

Then check the method. Liquid chromatography (HPLC) separates the acidic and neutral forms of cannabinoids and quantifies each of them. Gas chromatography (GC) heats the sample, and a 2022 study shows that the injector temperature decarboxylates acidic cannabinoids. A GC result therefore mixes THCA and THC. If the certificate does not name its method, you cannot know what it measured.

Hemp produces THC as an acid, THCA, which turns into THC with heat. That is why an HPLC certificate has two lines, Δ⁹-THC and THCA. Before they are added, THCA is corrected for the mass it loses on becoming THC. The 0.877 factor is the ratio of the molar masses: 314.5 g/mol for THC, 358.5 g/mol for THCA.

Take a fictional flower showing 0.12% Δ⁹-THC and 0.25% THCA. Its total THC is 0.12 + 0.877 × 0.25, or 0.34%, so the Δ⁹-THC line sits below the limit while the total exceeds it. The annex to the 2021 order also prescribes a gas chromatography test for varieties, and its heat converts most of the THCA into THC during the measurement. This reading is explained in our article on THCA, and the official method in the one on the 0.3% limit.

CBD follows the same arithmetic. With 1.1% CBD and 9.8% CBDA, a flower holds 1.1 + 0.877 × 9.8, or 9.7% total CBD. See which convention the certificate uses on its "total" line, since a plain sum of 10.9% would overstate the content.

Which molecules were tested matters as much as the results. A certificate limited to CBD and THC is silent on semi-synthetic cannabinoids. ANSM, the French medicines agency, listed HHC, HHCO and HHCP as narcotics from 13 June 2023, then H4CBD, THCP and other derivatives from 3 June 2024. The same page excludes THCA when the THC content complies with the 0.3% limit, so THCA in compliant hemp is not banned.

For a product sold as CBD, look for these molecules on the list. If they are absent from it, nobody tested for them, and they may still be in the product. Our article on synthetic cannabinoids explains why the check matters.

A complete certificate also includes contaminant panels. The main ones are:

For pesticides, a default limit of 0.01 mg/kg applies to any substance not named in the tables, the European Commission notes. Solvent residues only concern extracts made with a solvent; a sieved or ice-water resin has none by design.

Then come the small results. "ND" (not detected) means the instrument saw nothing above its limit of detection. "< LOQ" means the molecule may be present below the limit of quantification, which is the smallest amount the method measures with validated accuracy. The ICH Q2(R2) guideline lists both limits among the characteristics a method must establish. Without a numeric limit, an "ND" does not tell you from what amount the instrument would have seen anything.

A certificate describes a sample. To find out whether it also describes the bag in your hand, go through these steps in order. Apart from accreditation and the QR code, each one rests on an item that the ISO/IEC 17025:2017 standard requires, in clause 7.8.2.1, in every report from a laboratory that applies it.

1. The batch number. Compare the one on the report with the one printed on the bag, character by character. A single different character is enough: the certificate then covers another batch.
2. The laboratory. The report gives the laboratory's name and address, and a unique report number. A document headed only with the seller's name identifies no laboratory.
3. Accreditation. Enter the laboratory's name or accreditation number in Cofrac's search tool for accredited bodies. For a laboratory abroad, ask the accreditation body of its country. Then read the scope: it has to cover the test shown on the certificate.
4. The dates. Note the date the sample was received (or taken), the date of the test and the date the report was issued. For a flower, a report more than a year old calls for a question to the seller.
5. The matrix. The report describes the sample tested: flower, resin, oil or extract. It has to be the product on sale, because a test on an extract says nothing about the flower or resin made from the same hemp.
6. Signature and online check. The standard requires the report to identify the person who authorised it. If the document carries a QR code or a verification link, it should open a page hosted by the laboratory, showing the same report number. A link to the seller's site proves no more than the PDF does.

If a single step fails, the certificate proves nothing for your batch. The remedy stays the same: write to the laboratory with the report number, as described below.

When in doubt, contact the laboratory and quote the report number, since only the laboratory can confirm it issued the document. The points to check are set out on our page about what a reference profile does and does not prove, and the CBD laboratory page lists the catalogue products.

A compliant THC level gives you no protection at the wheel. On 21 June 2023 (no. 22-85.530), France's Court of Cassation ruled that the authorisation to sell products at 0.30% THC does not prevent prosecution: driving after using a narcotic is an offence whatever the dose. Since the law of 9 July 2025, the penalty is up to 3 years in prison and a €9,000 fine. A certificate states how much THC the product contains. What a saliva test will detect is a separate question, covered in our drug testing guide.