.product_section .product_form, .product_gallery { opacity: 1; } .multi_select, form .select { display: block !important; } .image-element__wrap { display: none; }

June 26, 2026

CBD Third-Party Testing and COA Guide 2026: How to Read a Lab Report | PureCraft CBD

Why Third-Party Testing Is the Only Verification That Counts

In an unregulated market, a CBD company can print anything on its label. '1000mg CBD.' 'Zero THC.' 'Lab tested.' 'Premium quality.' Without independent verification, every one of these claims is unconfirmable. Third-party testing — having an independent, accredited laboratory analyze the actual product rather than the manufacturer's own testing — is the only mechanism by which these claims can be verified.

The 2017 JAMA study by Bonn-Miller et al. analyzed 84 commercially available CBD products and found that69% were mislabeled — 43% were underlabeled (contained less CBD than claimed) and 26% were overlabeled (contained more). More concerning: 21% of products tested contained detectable THC despite being labeled as containing none. This was in 2017; market standards have improved since, but the fundamental problem — unverified label claims in a low-oversight market — remains.

This guide explains exactly what third-party testing tests for, what makes a lab credible, and how to read a Certificate of Analysis (COA) intelligently — so you can verify any CBD product's claims before purchasing. PureCraft's COAs are available atbatch-tested COA. The standards described here are the same standards our products are held to.

ISO/IEC 17025: The Only Lab Accreditation That Matters

Not all 'third-party labs' are equivalent. A company can send its product to any analytical laboratory and receive results — the critical question is whether that laboratory follows validated, reproducible methodology that produces reliable results.ISO/IEC 17025 accreditation is the international standard for testing laboratory competence. An ISO 17025-accredited lab has:

•Validated analytical methods — their procedures have been proven to produce accurate, reproducible results

•Documented quality management systems— procedures for instrument calibration, method validation, sample chain of custody

•Regular proficiency testing— participation in inter-laboratory comparison programs that verify their results against other accredited labs

•External audit— periodic audits by an accreditation body (A2LA, ACLASS, Perry Johnson Laboratory Accreditation in the US) that verify ongoing compliance

A COA from a non-ISO-accredited lab is not meaningfully independent verification — it is a number produced by an unvalidated process. The ISO accreditation number should appear on the COA header. You can verify accreditation status on the A2LA or ACLASS databases by searching the lab's name.

Potency Testing: Does the Label Match?

Cannabinoid Profile

The cannabinoid potency panel is the core COA section — it shows the concentration of each cannabinoid present in the product. Key cannabinoids to check:

• CBD (cannabidiol):The primary active compound; should match the label claim within ±10%. Expressed as mg/mL or mg/g (and total mg calculated by multiplying by container volume/weight)

•THC (delta-9-THC):Must be 0.000% or below the laboratory's limit of quantification (LOQ) for zero-THC products; must be ≤0.3% by dry weight for federally compliant full-spectrum

• THCA (tetrahydrocannabinolic acid):The acidic precursor to THC — THCA converts to THC when heated (decarboxylation). For zero-THC products: THCA should also be below LOQ. A product with low THC but elevated THCA can produce THC when heated during consumption

•CBG, CBN, CBC:Minor cannabinoids contributing to the entourage effect in broad-spectrum products; presence confirms broad-spectrum extract (rather than isolate)

The Total THC Calculation

Total THC is calculated as:Total THC = delta-9-THC + (0.877 × THCA). The 0.877 factor accounts for the mass loss when THCA decarboxylates to THC. For compliance and drug test safety: both the individual THC and the calculated total THC should be below the relevant threshold. A product showing 0.00% THC but 0.2% THCA has a calculated total THC of 0.175% — potentially relevant for heated consumption methods and potentially relevant for drug testing. For sublingually administered CBD Oil: THCA decarboxylation is minimal at body temperature; for vaporized products: THCA conversion is complete.

Label Accuracy Tolerance

The FDA permits ±20% variation from labeled amounts for supplements — a 1000mg product can contain anywhere from 800–1200mg and still be technically compliant. Industry best practice for CBD is ±10%. When evaluating a COA: confirm the measured CBD is within 10% of the labeled amount. Consistent underlabeling (measured significantly below label) suggests economizing on ingredient cost; consistent overlabeling (measured significantly above) is unusual and may reflect inconsistent formulation.

THC Testing: Why 'Non-Detect' Isn't Always Zero

The THC result is the most consequential COA number for drug-tested users — and the most frequently misunderstood. Two laboratory reporting conventions that are not the same:

'ND' (Non-Detect): Below the laboratory's limit of detection (LOD) for the testing method. If the LOD is 0.1%, then ND means 'we detected no THC above 0.1%' — a product containing 0.09% THC would report ND

'< LOQ' (Below Limit of Quantification):Below the minimum concentration the method can quantify accurately. LOQ is typically 3–10x the LOD. More specific than ND — states the concentration is below a defined minimum

'0.00%' (Quantified at zero):The method detected and quantified THC at or below the lowest calibration standard, confirming near-zero presence. This is the most specific and drug-test-relevant result

PureCraft's COAs report0.00% THC using LC-MS/MS quantitation — the gold standard analytical method for cannabis potency testing. LC-MS/MS (liquid chromatography-tandem mass spectrometry) provides both cannabinoid identity and quantitative measurement at low-ppm levels, far below the sensitivity of typical ELISA or HPLC screening methods.

Safety Testing: Beyond Potency

Heavy Metals

Hemp (Cannabis sativa) is a documented bioaccumulator — it draws heavy metals from contaminated soil into its biomass more readily than most crops. This phytoremediation property is useful for environmental cleanup but produces food safety concerns: hemp grown on contaminated agricultural land can concentrate lead, arsenic, cadmium, and mercury above safe consumption limits. Heavy metal testing is therefore required for any responsible CBD product.

Acceptable limits follow USP <232> oral pharmaceutical guidelines: Lead ≤0.5 ppm, Arsenic ≤1.5 ppm, Cadmium ≤0.5 ppm, Mercury ≤0.1 ppm. Hemp grown on USDA-certified organic land or on land with documented soil metal testing is lower risk, but COA verification remains essential.

Pesticides

Hemp cultivation may use pesticides despite the 'natural' perception of the crop. Pesticide residues in the finished CBD extract are a direct consumer exposure concern. A comprehensive pesticide panel covers 50–200+ compounds including organophosphates, pyrethroids, carbamates, and neonicotinoids. Action limits vary by state regulation and product type — most accredited labs follow the most stringent state standards (California Prop 65 or Colorado state limits) as the benchmark.

USDA-certified organic hemp provides the strongest pesticide assurance (organic certification prohibits synthetic pesticide use); third-party pesticide COA provides the verification. Products using hemp from countries with lower agricultural regulatory oversight should receive particular scrutiny on the pesticide panel.

Residual Solvents

Solvent extraction methods (ethanol, hydrocarbon) leave residual solvent traces in the extract that must be removed through post-extraction processing and verified by testing.USP <467> solvent classification: Class 1 solvents (benzene, hexane) are highest risk — must be below 2 ppm; Class 2 solvents (methanol, ethanol) — below 3000 ppm for ethanol; Class 3 solvents (acetone, ethyl acetate) — below 5000 ppm. CO2-extracted products are naturally solvent-free and residual solvent testing may show 'Not Applicable.'

Microbials

Microbial contamination (bacteria, yeast, mold, pathogens) is possible in any botanical product. USP <2023> limits for oral botanical supplements: Total Aerobic Count ≤10^5 cfu/g, Total Yeast/Mold ≤10^3 cfu/g, Salmonella negative in 10g, E. coli negative in 10g, Aspergillus species negative in 10g. Products showing any pathogen positive result should not be consumed.

Batch Number: The Critical Chain of Custody

The batch or lot number is the single element that connects the product in your hand to the specific COA that tested that batch. Without a batch number match, the COA cannot be confirmed to apply to your product. Quality CBD companies include the lot number on the product label (often on the bottom or side of the bottle) and make batch-specific COAs accessible — either via QR code linking directly to that batch's COA, or via a searchable database where the lot number retrieves the COA.

A COA posted on a website without batch number specificity (or with a batch number different from your product) is not verification of your product — it is a general company quality claim.Always match the batch number on your product to the COA you are reviewing

Red Flags: What a Bad COA Looks Like

Beyond the 10-section checklist, several patterns indicate a COA that should not be trusted:

• In-house testing:Manufacturer tests its own product — no independence; any result is possible without external accountability

• Test date over 12 months ago:Products change over time; a COA from a year ago doesn't reflect the current batch's composition

• Cannabinoid panel only:COA showing only CBD and THC without heavy metals, pesticides, and microbials is a partial test — the safety testing is missing

•Unusually high CBD values:A 1000mg/30mL product claiming 50mg/mL (1500mg total) on the COA — an inconsistency that suggests either label error or analytical error

•Unrecognized lab:Lab name not searchable in A2LA, ACLASS, or state regulatory databases — no verifiable accreditation

•COA requires request:Reputable companies post COAs publicly; requiring a request to access a COA is a transparency red flag

The 10-Section COA Reading Checklist

COA Section	What to Look For	Acceptable Result	Concern
Lab accreditation	ISO/IEC 17025 accreditation certificate number and scope	ISO 17025 accredited for cannabis/hemp testing; accreditation visible on COA header	No ISO number; 'certified lab' without specifying ISO 17025; in-house or manufacturer-funded lab
Sample identification	Batch/lot number on COA matches batch/lot number on product label	Exact batch/lot match	No batch number; 'representative sample' without specific lot; dated more than 12 months ago
CBD potency	Total CBD per container and per mL/gram; should match label within ±10%	Label claims 1000mg; COA confirms 950–1100mg	More than 20% deviation from label; 'compliant' listed without mg quantity
Total THC (for broad-spectrum/isolate)	Quantified result, not just ND; should include limit of quantification (LOQ) statement	0.000% or < LOQ at 0.0001% (LC-MS/MS); LOQ clearly stated	'ND' without LOQ; LOQ at 0.1% or higher — insufficient sensitivity for zero-THC verification
THCA + THC (total THC calculation)	Total THC = THC + (0.877 × THCA) — both should be near zero for broad-spectrum	Both THCA and THC <LOQ; total THC calculation shown	THC near zero but THCA elevated — THCA converts to THC when heated
Heavy metals	Lead (Pb), Arsenic (As), Cadmium (Cd), Mercury (Hg) — hemp bioaccumulates	All metals below USP <232> limits: Pb <0.5 ppm, As <1.5 ppm, Cd <0.5 ppm, Hg <0.1 ppm	Any metal above USP limits; heavy metals panel missing entirely
Pesticides	Comprehensive pesticide panel — USDA Organic or state-compliant list	All pesticides below action limits (typically <0.1 ppm); pass stated	Pesticide panel missing; partial panel (<50 compounds)
Residual solvents	If solvent extraction used: USP <467> residual solvent limits	All solvents below USP Class 1/2/3 limits; or 'Not Applicable' for CO2 extraction	Ethanol or hydrocarbon above USP limits; residual solvent section missing for solvent-extracted products
Microbials	Total aerobic count, total yeast/mold, Salmonella, E. coli, Aspergillus	Within USP <2023> limits; Salmonella/E. coli negative; Aspergillus negative	Any pathogen positive; microbial section missing
Test date	Should be within 12 months for the tested batch	Test date within 12 months; dated close to production date	COA dated over 12 months ago; no date visible

The COA checklist's most critical rows:lab accreditation(ISO 17025 — non-negotiable),sample identification(batch number match — non-negotiable), andtotal THC(quantified at 0.00% — for zero-THC claims). The other rows are important quality indicators — a product failing on heavy metals, pesticides, or microbials is a safety issue; a product with potency deviation over 20% is a labeling integrity issue. But a product without ISO accreditation or without batch number verification cannot be trusted at all, regardless of what the COA says.

Frequently Asked Questions

What is a CBD COA?

A Certificate of Analysis (COA) is a document from an independent third-party laboratory reporting the results of analytical testing on a specific CBD product sample. A comprehensive COA covers cannabinoid potency (CBD, THC, minor cannabinoids), safety testing (heavy metals, pesticides, residual solvents, microbials), and identifies the specific batch tested. The COA is the only mechanism by which a CBD product's label claims can be independently verified.

How do I verify a CBD COA is legitimate?

Four steps: (1)Check ISO 17025 accreditation — look for the ISO number on the COA header and verify it in the A2LA or ACLASS database; (2)Match the batch/lot number — confirm the COA batch number matches the lot number printed on your product; (3)Verify the test date — should be within 12 months; (4)Check the scope— a complete COA includes potency AND safety testing (heavy metals, pesticides, microbials). A cannabinoid-only COA is incomplete.

What THC level is safe for a drug test?

The only THC level that is safe for drug-tested users is0.00% confirmed on a batch-specific COA from an ISO-accredited lab. 'ND' (Non-Detect) without a stated detection limit is insufficient — if the LOD is 0.1%, an ND result could mean up to 0.09% THC, which may accumulate to detectable levels with daily use. Products at 0.3% THC (the federal limit for full-spectrum) carry real drug test risk for daily users. SeeCBD Label Reading Guide 2026 for the complete drug testing framework.

How often should CBD products be tested?

Industry best practice: third-party COA for every production batch, tested at an ISO-accredited laboratory. A single annual COA is insufficient — batch-to-batch variation in agricultural products means each batch can produce different results. PureCraft tests every production batch individually. When you verify a COA, confirm the batch number on your specific bottle — not a general company COA from a different batch.

What is the difference between CBD isolate, broad-spectrum, and full-spectrum on a COA?

A CBD isolate COA shows CBD as the only cannabinoid present; all others are either absent or trace. A broad-spectrum COA shows CBD plus minor cannabinoids (CBG, CBN, CBC) with THC at 0.00% or below LOQ. A full-spectrum COA shows CBD, minor cannabinoids, and THC up to 0.3%. The cannabinoid profile on the COA is the definitive way to confirm which spectrum type a product actually is — not just what the label claims. A label claiming broad-spectrum but showing 0.1% THC on the COA is a full-spectrum product regardless of the label.

Does PureCraft test for heavy metals and pesticides?

Yes — PureCraft's batch-specific COAs include comprehensive heavy metals (lead, arsenic, cadmium, mercury), pesticide residue panels, residual solvents, and microbials in addition to full cannabinoid potency panels. Every batch of every product —CBD Oil,CBD+CBN Sleep Gummies,CBD Topicals — is tested at an ISO 17025-accredited laboratory. Results are published atbatch-tested COA. Batch numbers on products match the searchable COA database.

The Bottom Line: A COA Is Only as Good as Its Lab and Its Batch Number

Third-party testing is the foundation of CBD product trust — but third-party testing from a non-accredited lab, without a batch number match, without safety panels, or without accessible verification is not meaningful third-party testing. The standards are simple: ISO 17025 accreditation, batch-matched COA, quantified 0.00% THC (not just ND), and comprehensive safety panels including heavy metals, pesticides, and microbials.

Every PureCraft product meets these standards on every production batch. Verify atbatch-tested COA.browse all PureCraft CBD products.

Transparency Note | PureCraft CBD is committed to full COA transparency. Batch-specific COAs are publicly available for every product lot at purecraftcbd.com/pages/faq. We publish these standards and hold ourselves to them.