What is COA (certificate of analysis)?
A certificate of analysis is a laboratory report stating a cannabis batch's potency and contaminant results.
Last checked 11 October 2026
Also calledcertificate of analysislab report
The document every spot-the-fake check ends at, the one field on it that actually matters, and the three ways a real-looking COA tells you nothing.
Written and reviewed by Traceleaf research · last reviewed October 12, 2026
Why it matters
A COA is only meaningful if the batch number on the package matches the batch the lab tested, which is the check that gray-market packaging most often fails.
What a certificate of analysis is
A COA is a laboratory's report on a specific sample: cannabinoid potency, and depending on the panel, pesticides, residual solvents, microbial contamination and heavy metals. The important word is specific. A COA is evidence about the material the lab received, identified by a batch or lot number, on a date, for a client who sent it.
Everything that makes a COA useful follows from that, and so does everything that makes one useless. It is not a certification of a brand, a product line or a company. It is a measurement of one batch.
The only check that matters, and how it fails
Compare the batch number on the package in your hand to the batch number on the report. If they do not match, the report is about other material and tells you nothing about what you are holding, however genuine the report itself is.
- The batch does not match. The most common failure, and the one that needs no expertise to spot: a real report for a different lot, reused across a product line.
- The QR code resolves to the seller. A code that lands on a page the seller controls proves the seller built a page. The check only means something when the destination is the laboratory's own result, reachable independently of the brand.
- The panel is narrower than it looks. A potency-only report says nothing about heavy metals or solvents, and a report that omits a panel is not a report that passed it.
For a vape there is a fourth problem that is structural rather than a trick. A COA tests the oil. The cartridge is a separate industrial product from a separate supply chain, and contamination that leaches from hardware into oil is a hardware question, which is why heavy metals testing sits where supply-chain provenance turns into a safety question.
What the records can tell you when the document cannot
When a COA cannot be verified, the fallback is not a better-looking document, it is a different kind of record, one the seller does not control. A licence number appears in a state's published list or it does not. A trademark appears in a public register or it does not. A company stands behind a domain or no register names one.
That is what the spot-the-fake checks run, brand by brand. The aggregate versions are the brands recorded with a copied label and the “official” brand domains with no owner company on file in any register searched, both stated as absences in named registers rather than as conclusions about the companies behind them. The state pages carry the licence lists those checks are run against.
Questions people ask
- How do I know if a COA is real?
- Start with the batch number: it has to match the one on the package, or the report is about different material. Then check that the QR code or link resolves to the laboratory's own result rather than a page the seller controls, and that the panel actually covers what you care about.
- Does a COA tell me the vape hardware is safe?
- No. A COA tests the oil that was sent to the lab. The cartridge comes from a separate supply chain, and contaminants can leach from hardware into oil, which is why heavy-metals results and hardware provenance are tracked separately.
- A product has a COA but no licence. What does that mean?
- They answer different questions. A COA is a lab's measurement of one batch; a licence is a state regulator's authorisation to operate. A product can carry a genuine COA and still be absent from every state licence list.