How to Read a CBD COA, Line by Line

Start with the header

Before any chemistry, four things at the top of the report tell you whether it's worth reading at all.

• Lab name and address. A COA should come from a named third-party laboratory with a real letterhead — not the brand itself. If you can't tell who tested the product, you can't verify anything else on the page.
• Accreditation (look for “ISO/IEC 17025”). This is the international standard that specifies general requirements for the competence, impartiality, and consistent operation of testing and calibration laboratories. A lab doesn't self-declare it: an independent accreditation body — in the U.S., commonly A2LA or ANAB — audits the lab's methods, equipment, and recordkeeping against the standard and issues a certificate, usually scoped to specific test methods rather than blanket coverage of everything the lab does. Accredited labs typically print that certificate number near their name. No mention of accreditation at all is worth noticing.
• Sample ID versus batch number. These are two different numbers for two different systems. The Sample ID is the lab's own internal tracking number for that test — it identifies the sample inside the lab's records. The batch (or lot) number is the number the brand assigns to that production run and prints on the bottle. The one you need to match to your bottle is the batch number, not the Sample ID — don't confuse the two.
• Dates. Date sampled, date tested, date reported. A COA with no date anywhere is not usable — you can't tell if it describes current stock or a batch from years ago tested under a method the lab has since changed.

The single most important check: does the batch number match the bottle?

This is where most people stop reading a COA correctly, if they read one at all. A brand can have a real, accredited, contaminant-free lab report — for a completely different production run than the one sitting on your counter. Cannabinoid content, and sometimes contaminant results, shift batch to batch because hemp is an agricultural crop, not a machined part. A gorgeous PDF proves nothing about your bottle unless the batch number matches.

The batch or lot number on a bottle is usually small: molded into the base, stamped near the fill line, or printed on a sticker on the neck or back label. It is not the strength (500mg) and it is not the flavor. Turn the bottle over and look for a short alphanumeric code — that string is the join key between the product in your kitchen and one specific lab report.

The habit worth building: (1) find the batch number on your bottle, (2) find the batch number in the COA's header, (3) confirm the characters are identical — not “close,” identical. Per-batch testing is the standard a real testing program follows; a brand that only ever shows one “representative” report, recycled across every batch it sells, is not meeting that standard, whatever the report itself says.

For botanCBD specifically: every batch we sell is tested, and we're digitizing those reports for instant viewing at /coas. We only publish batch chemistry once it has been transcribed from a real, signed lab PDF — that list stays empty rather than filling it with invented or “representative” numbers, because a made-up table would be worse than no table. Until a given batch is posted there, email the batch number on your bottle to sales@botancbd.com or call 513-696-9255, and we'll send the matching PDF the same day — not a general one, the one for your batch.

The cannabinoid panel: CBD, CBDA, and total CBD

A typical panel lists CBD, CBDA, delta-9 THC, and usually a handful of minor cannabinoids too — CBG, CBN, CBC, sometimes THCA. The three that matter most for checking a label and a legal claim are CBD, CBDA, and delta-9 THC.

The hemp plant doesn't actually produce CBD. It produces CBDA — the same molecule with an extra carboxyl group attached — and heat plus time (decarboxylation) converts CBDA into CBD. A finished oil made from decarboxylated extract should show most of its cannabinoid content on the CBD line, with CBDA as a small remainder, because a lab reports the two as separate line items rather than folding one into the other.

That's why a complete panel also computes a third figure, Total CBD:

The 0.877 isn't a policy number, it's molecular weight. CBD has a molecular weight of about 314.5 g/mol; CBDA, still carrying that extra carboxyl group, weighs about 358.5 g/mol. Losing the carboxyl group as CO₂ during decarboxylation means a gram of CBDA can only ever become about 0.877 gram of CBD — the same ratio federal hemp testing uses on the THC side (below). On a fully decarboxylated tincture, the CBD and Total CBD lines sit almost on top of each other. On a raw or minimally processed product, they can be far apart, and the gap is telling you how much of what you paid for hasn't finished becoming CBD yet.

This matters for reading the label honestly in both directions. A batch with some unconverted CBDA can show a bare CBD number that looks short of the mg claimed on the bottle, while its Total CBD sits right on target — so compare the label to Total CBD, not the CBD line alone, before concluding a bottle is underdosed. It also cuts the other way: a raw-extract product marketing a large “Total CBD” number is often mostly CBDA that hasn't converted, which is a different, less certain thing to be paying for.

The delta-9 THC line on this same panel tells you the spectrum type you actually bought: a full-spectrum product should show a real, small number here; a broad-spectrum or THC-free product should read ND or <LOQ (see below). If the marketing said THC-free and the THC line instead shows a comfortable percentage just under 0.3%, that is a full-spectrum-shaped number wearing THC-free clothing. None of this is a reason to assume the worst by default — but it is a reason to check rather than assume. A 2024 peer-reviewed analysis of 202 retail CBD products (tinctures, gummies, vapes, and topicals) in the journal Frontiers in Pharmacology found that 74% deviated from their labeled CBD potency by at least 10% — 46% ran over the label claim, 28% ran under it — and 26% didn't match their own claimed spectrum type (full spectrum, broad spectrum, or isolate). Reading the panel yourself isn't paranoia. On the numbers, it's the norm.

Checking the bottle against the panel: the arithmetic

Cannabinoid panels usually report a concentration — milligrams per milliliter or per gram — not a total milligram count for the whole bottle. To compare against the mg claimed on the front label, you have to multiply by the bottle's volume. Here's the arithmetic, using round, illustrative numbers (not a real transcribed batch) so you can run the same math on any bottle:

The reusable version: (CBD mg/mL + [CBDA mg/mL × 0.877]) × bottle volume in mL = Total CBD in the bottle. Compare that to the number on the front label.

There is no single official tolerance every finished CBD product must fall within — that's an honest gap in this industry, not something we can paper over with a made-up number. Researchers studying label accuracy commonly use ±10% as their own bar for “matches the label”, which is a reasonable rule of thumb: a batch landing within roughly 10–15% of label in either direction is ordinary agricultural and manufacturing variance, not a red flag by itself. A batch at half the label claim, or at zero, is a different problem.

Run the same multiplication on the THC line. If delta-9 THC reads 0.06 mg/mL, that's 0.06 × 30 = 1.8 mg of THC in the entire 30 mL bottle. Spread across roughly 600 drops — a full dropper is about 1 mL, or 20 drops — that's about 0.003 mg of THC per drop. Small numbers are easy to wave away in the abstract; multiplying them out against the actual bottle is what makes them concrete.

The 0.3% threshold, and the wrinkle nobody explains

Federal law defines hemp, under 7 CFR § 990.1, as cannabis with “a total delta-9 tetrahydrocannabinol concentration of not more than 0.3 percent on a dry weight basis.” That threshold comes from the 2018 Farm Bill and it's the line separating legal hemp from marijuana.

Here's the wrinkle: that 0.3% dry-weight test is written for the harvested hemp plant material, for USDA crop-compliance testing — not literally for a bottle of finished liquid oil. “Dry weight basis” describes a percentage of a dried plant sample; it doesn't cleanly apply to a liquid. A finished product's COA typically reports THC as a concentration — mg/mL or mg/g — rather than a percentage. In practice, everyone (brands, and often regulators) still talks about a finished product being “under 0.3% THC” as shorthand, converted back from that concentration. What actually sits on your COA is the lab's number or ND/<LOQ, not a percentage — read that line, not the marketing shorthand.

The federal testing regulation also specifies exactly how the crop-compliance number is calculated, and it uses the same 0.877 conversion you saw above, applied to THC instead of CBD:

This exists because raw hemp carries most of its THC as THCA, which isn't intoxicating until heat converts it — so measuring delta-9 THC alone understates what a product could become once heated. USDA has required this post-decarboxylation calculation for hemp crop testing since its final rule took effect March 22, 2021.

One more thing worth knowing about, honestly, because it's unresolved: a law signed in November 2025 rewrites the federal hemp definition itself, shifting from a delta-9-only threshold to a Total THC standard — 0.3% dry weight including THCA — and adding a new cap of 0.4 milligrams of total THC per container in a finished consumer product. It takes effect November 12, 2026. What that will mean in practice for any specific bottle on a shelf a year from now genuinely isn't settled yet, and we'd rather say that plainly than guess.

ND, <LOQ — the shorthand that trips up almost everyone

• ND (not detected) means the result is below the lab's limit of detection (LOD) — the lowest amount that produces a signal the instrument can distinguish from background noise, typically defined at roughly a 3-to-1 signal-to-noise ratio. Below that, the instrument sees nothing it can call a detection.
• <LOQ (below the limit of quantitation) means the lab detected something — a signal above LOD, present at most in a trace it won't put a number on — but at a level too low to measure with the accuracy and precision needed to report an actual figure. LOQ is always a higher bar than LOD: detecting a trace and trusting a specific number enough to print it are two different things.
• “<0.3%” is neither of the above. It's the legal hemp ceiling, and it can describe a real, intentional, non-zero amount of THC in a full-spectrum product. Don't read a percentage under the legal limit as a synonym for “basically none.”

The practical read: a THC-free, broad-spectrum product should show ND or <LOQ on the delta-9 THC line. A full-spectrum product will show an actual number.

Contaminant panels: potency is half the report

A COA that stops at cannabinoid potency has answered “how much” and never asked “how clean.” A complete report also runs a finished product through five categories:

• Heavy metals — the “big four”: lead, arsenic, cadmium, and mercury, all of which can be taken up from soil by the hemp plant.
• Pesticides — a panel that can run from dozens to 200-plus individual compounds depending on the lab and state list, screened down to ND.
• Residual solvents — leftover extraction chemicals (ethanol, butane, propane, hexane, and others depending on the extraction method), which should test clean if the extraction and purification steps were done properly.
• Microbials — total yeast and mold counts, plus pathogen screens for organisms like E. coli and Salmonella.
• Mycotoxins — toxins produced by certain molds during growing or storage, most commonly tested as aflatoxins and ochratoxin A. These can persist even when the microbial panel comes back clean, since the mold that produced them may no longer be alive to detect.

This isn't a hypothetical box to check. That same 2024 Frontiers in Pharmacology analysis of 202 retail CBD products found heavy metals in 44 of them (lead was the most common, turning up in 42 products, 5 of which exceeded a regulatory threshold), residual solvents in 181 of the 202 products tested (4 over USP limits, 19 over a state limit), and pesticides in 30 products. A potency-only PDF would have missed every one of those findings, because it never ran the test.

A potency-only COA is not a shorter COA. It's half of one — and given what shows up when the other half actually gets tested, that gap is not a formality.

Red flags: when to stop reading and just say no

• No batch number anywhere on the report — or a placeholder like “Sample” or “Rep-1” instead of a real production-run identifier.
• No test date, or a date that's years old for a product still being sold today.
• No named, identifiable lab — no letterhead, no address, no accreditation mark, just a table of numbers with nothing to verify it against.
• Potency only, with no safety panels — no heavy metals, pesticides, residual solvents, microbials, or mycotoxins.
• A COA that doesn't match the product in your hand — wrong product name, wrong strength, or a “broad-spectrum / THC-free” bottle whose delta-9 THC line shows a real percentage instead of ND or <LOQ. That spectrum mismatch matters even more on a pet product, where the target is zero THC, not a legal trace.
• One “representative” report reused for every batch a brand sells, rather than a fresh test per production run.

Any one of these is worth a follow-up question to the brand. More than one, and the honest move is to walk away.

FAQ