What Is Third-Party Testing for CBD? How to Read a COA

What Is Third-Party Testing?

When a company tests its own products in its own laboratory, there is an obvious conflict of interest. Third-party testing removes that conflict by sending samples to an independent laboratory with no commercial relationship with the brand.

A genuine third-party test is conducted by a laboratory that:

• Has no financial interest in the outcome
• Is accredited by an independent body to test the relevant parameters
• Issues its report directly to the brand (or occasionally direct to consumers)

The resulting document — the Certificate of Analysis (COA) — is the paper trail that proves a product contains what it claims and does not contain what it should not.

Third-party testing is not mandatory under EU regulations for CBD food supplements (no Novel Food authorisation framework is fully operational). It is a voluntary quality standard — which is exactly why it matters so much as a consumer quality signal.

---

What a Good COA Should Show

1. Cannabinoid Profile

This section lists the measured amounts of individual cannabinoids in the product, typically in mg/ml or as a percentage.

What to check:

• CBD content — does it match the label? A 10% oil should contain approximately 1000mg CBD per 10ml. A variance of ±10–15% is generally acceptable for natural extracts; more than that is a quality concern.
• THC content — must be below 0.2% in EU products. Products with no detectable THC (usually reported as <LOQ or <0.01%) are broad-spectrum or isolate.
• Minor cannabinoids (CBG, CBN, CBDa, CBC) — present in full-spectrum products. Their presence confirms the extract is genuinely full-spectrum rather than CBD isolate reformulated with artificial terpenes.

2. Terpene Profile (Full-Spectrum Products)

Terpenes are aromatic compounds in hemp that contribute to the entourage effect. A full-spectrum COA should include a terpene profile showing compounds like myrcene, linalool, limonene, beta-caryophyllene, and others.

The absence of a terpene profile does not mean a product is fake, but it is a missing piece of the quality picture. Some labs charge separately for terpene analysis.

3. Heavy Metals

Hemp is a bioaccumulator — it absorbs compounds from the soil, including heavy metals like lead, cadmium, arsenic, and mercury. This is why hemp source and farming practices matter.

The COA's heavy metals section should show results for these four metals at minimum, with results below EU maximum limits (or below the lab's reference limits). All four should pass.

Reference limits (EU food supplement standards):

• Lead: <0.3 mg/kg
• Cadmium: <0.06 mg/kg
• Arsenic: <0.1 mg/kg
• Mercury: <0.1 mg/kg

4. Pesticides

A comprehensive pesticide panel tests for dozens to hundreds of compounds. The COA should show either a full pesticide screen with pass/fail for each compound, or a summary result (all below detection limits = pass).

Key pesticides to look for in the test panel: organophosphates, organochlorines, pyrethroids, carbamates. Products from EU-certified organic hemp should pass easily; products from poorly sourced hemp sometimes fail.

5. Residual Solvents

If the CBD was extracted using solvents (ethanol, hexane, butane, CO₂), the finished product should contain no or minimal solvent residue. CO₂ extraction is the gold standard because CO₂ is non-toxic and leaves no residue. Solvent extraction can leave trace amounts if the process is not properly controlled.

The COA should show residual solvent levels below detection limits (< LOQ) or explicitly below regulatory limits.

6. Microbiology (Optional but Valuable)

Testing for microbial contamination (total aerobic count, yeast, mould, E. coli, Salmonella) is not always included but indicates higher quality control. Its absence is not a red flag; its presence is a positive signal.

---

How to Find a Product's COA

QR code on packaging — most quality brands include a QR code on the bottle or box that links directly to the COA for that specific batch.

Batch number lookup — some brands have a COA lookup tool on their website. Enter your batch number (printed on the bottle) and retrieve the corresponding test report.

Brand website COA page — look for "Lab Results", "Third-Party Testing", or "COA" in the footer or product pages.

Ask directly — if a brand's COA is not easily findable, email them and ask for the COA for your batch number. A reputable brand will provide it immediately. A brand that hedges, provides a generic document, or ignores the request is a brand to avoid.

---

What Lab Accreditation Means

Not all labs are equal. The international standard for testing laboratory competence is ISO/IEC 17025:2017 — it demonstrates that the lab operates a quality management system, has validated its testing methods, and produces reliable, reproducible results.

Look for the ISO/IEC 17025 accreditation number on the COA (it will be something like "DAkkS accredited" in Germany, "RvA accredited" in the Netherlands, "UKAS accredited" in the UK). Accredited labs are assessed by national accreditation bodies — their accreditation is independently verified.

A COA from an unaccredited lab is significantly less reliable. Some brands use in-house labs or non-accredited third-party labs — technically "third-party tested" but without the independent quality assurance that accreditation provides.

---

Red Flags: When a COA Is Not What It Claims

The COA is undated or more than 12–18 months old. Hemp extracts change between batches. A COA from two years ago tells you nothing about the product in your hands today.

The batch number on the COA does not match your product. This is the most important check. If the batch number is different, you are looking at evidence for a different product. Always match batch numbers.

Only CBD and THC are tested — nothing else. A cannabinoid-only test with no safety screening (no heavy metals, no pesticides) is the minimum possible test. It rules out obvious mislabelling but says nothing about contamination. This is not acceptable as a complete quality assurance standard.

CBD content is significantly below label claim. A 10% oil showing 700mg/10ml on the COA (30% below label claim) is a poorly controlled product. Some variance is normal; significant under-delivery suggests quality control problems.

The lab name is not searchable or does not appear in accreditation databases. If you cannot find the lab independently and verify its accreditation, treat the COA with scepticism.

The COA is a marketing image, not a lab document. A genuine COA looks like a formal laboratory report: it has a laboratory header, report number, accreditation details, method references, analyst signature, and raw data tables. A polished infographic showing "✓ Passed" is not a COA.

---

What Good Looks Like: An Example Checklist

Before buying any CBD product, run through this checklist:

• COA is available on the brand website or via QR code
• COA is from an ISO/IEC 17025 accredited laboratory
• COA date is within the last 12 months
• Batch number on COA matches batch number on packaging
• CBD content matches label claim (within ±15%)
• THC content is below 0.2% (or 0.00% if buying for France)
• Heavy metals panel included — all below reference limits
• Pesticides panel included — all below detection limits
• Residual solvents tested — below detection limits

Brands that make this checklist easy to complete are brands investing in genuine quality assurance.

---

Why Some Brands Fail

The most common reasons CBD products fail third-party testing:

Hemp source quality. Poorly sourced hemp from contaminated soil, farms using unapproved pesticides, or non-EU hemp grown under less controlled conditions will fail heavy metals and pesticide screens.

Extraction method. Cheap solvent extraction with inadequate purification leaves residual solvents. CO₂ extraction eliminates this risk.

Post-extraction blending errors. CBD isolate is added to a carrier oil to create a finished product. Blending errors — adding too little or too much CBD — produce products that do not match their label.

Using CBDa-rich hemp and not decarboxylating properly. Raw hemp extract contains CBDa (the acidic precursor to CBD), not CBD itself. Products claiming CBD content must have been properly decarboxylated (heated) to convert CBDa to CBD. A COA showing high CBDa and low CBD indicates incomplete processing.

---

Frequently Asked Questions

Can I trust a COA if it is on the brand's own website?

Yes, as long as the COA is a genuine lab document from an accredited laboratory. The brand hosts it, but the lab issued it independently. The batch number match is the key verification step — it proves the COA corresponds to the actual product being sold.

What does "< LOQ" mean on a COA?

LOQ stands for "Limit of Quantification" — the lowest concentration the lab's method can reliably measure. A result reported as "< LOQ" means the substance was either not detected or present below the method's detection threshold. For THC, this effectively means not detectably present — which is what you want for broad-spectrum and isolate products.

My product does not have a QR code or batch number — should I worry?

It is a yellow flag. Not all quality brands have implemented full batch-level QR traceability yet, particularly smaller European producers. Contact the brand directly and ask for the COA for your specific product. If they cannot provide one, reconsider your purchase.

---

This article is for informational purposes only. For legal compliance, always check the specific regulatory requirements in your country.

See also: 5 Beginner Mistakes with CBD | CBD Legal Status in Europe | Full-Spectrum vs Isolate

Last updated: March 2026