How to Read a Cannabis Certificate of Analysis

First: make sure the COA belongs to what is in your hand

The loudest number on a cannabis report is usually THC. Ignore it for a minute. Start with the boring stuff, because the boring stuff is what makes the rest of the page mean anything. A certificate of analysis—usually shortened to COA—is a laboratory report about a submitted sample. If you cannot connect that sample to your package, you are reading somebody else’s homework.

Compare the producer or licensee, product name, product type, batch or lot identifier, and any Metrc or sample identifier on the report with the label or other batch record. Check the sample-received date, test date, and report date. A QR code that opens a generic report, an undated PDF, or a COA for last season’s harvest is not batch transparency.

The product matrix matters too. Flower, concentrate, vape material, and infused food are prepared and analyzed differently. A report describing “usable cannabis” should not be presented as the certificate for a finished edible. When the identity fields do not line up, stop there and ask for the correct report.

• Producer or licensee name matches
• Product and matrix match
• Batch, lot, or inventory identifier matches
• Report is final and has not been superseded
• Dates make sense for the package in front of you

Evidence trail: [1]

Then identify the laboratory and the kind of test

Find the testing facility’s name, address, certification or accreditation details, and report status. In Maine’s adult-use system, mandatory testing is performed through certified cannabis testing facilities and reported to the licensee and OCP. A polished logo is not the same thing as certification, and a research-and-development test is not automatically a mandatory compliance test.

Look for language such as final report, amended report, compliance, mandatory, voluntary, or research and development. If a report was amended, identify what changed and keep the newest version. If the document only contains a cannabinoid panel, it does not become a full safety panel because the word “passed” appears somewhere near the top.

Maine’s rules and guidance also make sample collection part of the compliance system. That matters because the lab analyzes the material it receives—not every flower in a room or every package in a batch. A trustworthy report preserves the trail from batch to collected sample to laboratory result.

Evidence trail: [1], [2], [3]

Read the cannabinoid table without falling for the scoreboard

Cannabinoid results may list THCA, delta-9 THC, CBDA, CBD, CBG, and other measured compounds. Flower is commonly reported as percent by weight or milligrams per gram. One percent by weight is equivalent to 10 milligrams per gram, so a flower result of 20% corresponds to about 200 mg/g before any real-world losses or differences in use are considered.

Raw flower often contains more THCA than neutral delta-9 THC. Labs commonly calculate total THC as delta-9 THC plus THCA multiplied by 0.877. That factor adjusts for the molecular mass lost during decarboxylation. It is an estimate of potential total THC under the report’s formula—not a promise that every milligram will be converted, delivered, or absorbed.

Do not compare unlike units. Milligrams per serving, milligrams per package, milligrams per gram, and percent by weight answer different questions. For edibles, check both the serving and package totals and compare them with the number of servings. For concentrates, confirm whether a value is percent, mg/g, or a total amount in the container.

And remember what potency does not grade: it does not tell you whether flower was grown well, dried carefully, stored properly, free of every possible contaminant, enjoyable to smell, or appropriate for a particular person. THC belongs in the record. It does not get to become the whole record.

Evidence trail: [1], [4], [6]

ND, LOD and LOQ do not all mean zero

Laboratory shorthand can make a precise-looking table surprisingly easy to misread. ND usually means “not detected” under the method and reporting rules used by that laboratory. It does not necessarily mean the compound is absent from the universe. It means the result did not meet the lab’s stated threshold for detection or reporting.

LOD is the limit of detection: the level at which the method can distinguish a signal from background with defined confidence. LOQ is the limit of quantitation: the level at which the laboratory can report a numerical amount with acceptable performance. Some reports use an action limit or threshold as well—the regulatory line used for a pass/fail decision.

When a contaminant result is below the reporting limit, read it alongside that limit and the method. “Less than 0.01” carries more information than a blank cell. A result near an action level should also be read with the laboratory’s measurement uncertainty and Maine’s applicable decision rules, not treated as a magically exact dividing line.

Evidence trail: [4], [6]

Read every contaminant panel as its own question

A COA is not one test. It is a bundle of named analyses. Maine’s adult-use testing framework covers required categories that include filth and foreign material, molds and mildews, harmful microbes, water activity or moisture-related measures, metals, residual solvents when applicable, pesticides, and cannabinoid potency or homogeneity requirements. The exact tests depend on product type and current rules.

Pesticide screens look for a defined list of compounds. Metals panels commonly address elements such as lead, arsenic, cadmium, and mercury. Microbial and mycotoxin panels address named organisms or toxins. Residual-solvent testing is especially relevant to products made with chemical solvents, but the applicable requirement depends on the material and manufacturing process. Water activity is not the same number as moisture content; it is used as an indicator related to the water available for microbial growth.

Read the analyte, result, unit, reporting limit, action limit, and pass/fail decision across the same row. Then ask what is missing. A cannabinoid-only report answers a cannabinoid question. A terpene add-on describes selected volatile compounds. Neither one establishes that a contaminant panel was performed.

• Which analytes were actually tested?
• What unit and reporting limit apply?
• What action threshold was used?
• Was the result pass, fail, not tested, or not applicable?
• Was remediation or retesting disclosed?

Evidence trail: [1], [2], [3]

Maine has two cannabis programs—and two testing realities

This is the Maine-specific part that generic COA articles routinely flatten. Adult-use and medical cannabis operate under different state programs. Maine requires mandatory testing before adult-use cannabis and cannabis products may be sold to consumers. The state’s medical-use program does not impose the same universal mandatory-testing requirement, although caregivers and dispensaries may choose to test voluntarily.

That does not make every voluntarily tested medical product suspect, and it does not make every adult-use result a complete guarantee. It changes the question you need to ask. For medical cannabis, ask whether this exact batch was tested, which panels were ordered, who collected the sample, which laboratory performed the work, and whether the report is available. Do not let “lab tested” stand by itself.

The distinction has real public-health weight. In OCP’s 2023 audit of 120 medical-program samples, 50 contained at least one contaminant that would have exceeded an adult-use failure threshold. That was a targeted state audit, not a claim that 42% of every medical product in Maine is contaminated today. It is evidence that voluntary testing details matter and that a cannabinoid result alone is not a safety answer.

Evidence trail: [1], [5]

Sampling and uncertainty are not loopholes—they are the science

A laboratory may be excellent and still be unable to make a few grams perfectly represent a large, naturally variable harvest. Cannabis flower is heterogeneous. Position on the plant, phenotype, drying, handling, storage, grinding, and subsampling can all influence the material that reaches an instrument.

That is why representative sampling, chain of custody, method validation, quality controls, proficiency testing, reference materials, and measurement uncertainty matter. NIST’s cannabis laboratory quality program exists to improve measurement comparability and laboratory competence—not because numbers are useless, but because dependable numbers require a system.

Small differences between reports are not automatically evidence of dishonesty. A move from 20.1% to 20.8% may be far less meaningful than the packaging makes it look. Compare methods, units, sample dates, and uncertainty before building a story around decimal places. Bigger disagreements deserve questions, but questions are stronger when they begin with the record.

Evidence trail: [3], [4], [6]

Red flags worth slowing down for

A COA should make the product easier to trace, not harder. Slow down when the report has no batch identifier, the business name does not match, the matrix is wrong, dates are missing, the QR code lands on a generic homepage, the PDF is marked draft, pages appear removed, or a cannabinoid-only screen is presented as comprehensive testing.

Also look for implausible formatting: identical results across many unrelated batches, every contaminant listed as zero without reporting limits, a cropped screenshot instead of the full report, no laboratory contact information, or a report whose certificate number cannot be verified with the issuer. None of these alone proves fraud. Each one is a reason to request the original final COA and ask a direct question.

Mainezilla’s rule is simple: if the report cannot stay attached to the batch, it does not get to carry the batch’s reputation.

Evidence trail: [1], [3]

The Mainezilla five-minute COA routine

You do not need to become an analytical chemist at the counter. You need a repeatable reading order. First match the identity. Second identify the laboratory and report type. Third confirm the panels. Fourth read units, limits, and decisions. Fifth save the report with the product and write down what remains unanswered.

In MyZilla, keep the producer, product, batch, package date, COA date, source link, and your questions together. If you encounter another batch with the same strain name, create a separate record. That is how a cannabis memory becomes useful: not by pretending one PDF tells the whole story, but by keeping the right evidence connected over time.

A good COA narrows uncertainty. It cannot tell you how a product will affect you, whether it is medically appropriate, or whether an untested hazard is absent. Those boundaries do not weaken the report. They tell you what the report is actually for.

• Match
• Verify
• Scan every panel
• Interpret units and limits
• Archive the batch record

Evidence trail: [1], [2]