How to Read a Cannabis Certificate of Analysis (COA) in Massachusetts

Every legal cannabis product sold in Massachusetts has been through a lab first. The report that comes out of that lab is the certificate of analysis, or COA. It tells you what's in the product, measured by an independent lab, and whether the batch cleared the state's contaminant screens.

A COA is dense and full of acronyms. Once you know its layout, though, you can read one in about a minute. This guide covers each section, which tests Massachusetts requires, and the few numbers worth checking. It's written for adults 21 and over.

Key takeaways

• A COA is the independent lab's report on one batch. It covers potency (the cannabinoid profile) and contaminant screens.
• Massachusetts won't let a product be sold until an Independent Testing Laboratory has tested it and found that it meets state standards (935 CMR 500.160).
• The required screens include microbials, mycotoxins, heavy metals, pesticides and plant growth regulators. Residual solvents are tested when solvents were used, and Vitamin E acetate is tested in vapes.
• Results are valid for one year. After that, the product has to be retested before it can be sold.
• Match the batch or package ID on the COA to the product in your hand. A COA only describes the batch it names.

What a certificate of analysis actually is

A COA is a lab report for a single production batch. A batch is product made at the same time, from the same inputs, by the same method. The grower or manufacturer sends samples to a licensed Independent Testing Laboratory (ITL). The ITL runs the required tests and issues the certificate.

In Massachusetts, the lab has to be independent of the business whose product it tests. The Commission's testing protocol also requires it to be accredited, for example to ISO 17025, or otherwise certified as the protocol describes. Since June 2025, Administrative Order No. 5 requires licensees and labs to upload COAs into METRC, the state's seed-to-sale tracking system. The certificate is therefore tied to the product's state record, not just filed away somewhere. (More on that record in our guide to the METRC package tag.)

What a COA is not: a guarantee about how a product will feel, a rating of quality, or a medical document. It measures chemistry and contamination, and that's all.

The anatomy of a COA, section by section

Lab layouts differ, but nearly every Massachusetts COA includes the same building blocks.

1. Header: who, what and when

The top of the report identifies:

• The lab, with its name, license and accreditation details.
• The client, meaning the licensee that submitted the sample.
• The sample, with its product name, product type (flower, concentrate, edible and so on) and batch or lot number. It often also shows the METRC package ID the sample came from.
• Dates, meaning when the sample was collected, received and reported.

Why it matters: this is how you confirm the COA belongs to your product. A COA for a different batch of the same strain tells you nothing about the jar in your hand. Check that the batch number or package ID matches.

2. Cannabinoid profile (potency)

This is the section most people jump to. Massachusetts defines the Cannabinoid Profile as the dry-weight percentages of four compounds:

• Δ9-THC (delta-9-tetrahydrocannabinol)
• THCA (tetrahydrocannabinolic acid)
• CBD (cannabidiol)
• CBDA (cannabidiolic acid)

Labs often report more, such as CBG, CBN and CBC, as extra lines.

You'll usually see results in two units:

• Percent (%), used for flower and concentrates. It means milligrams per 100 milligrams of product.
• Milligrams (mg), used for edibles, tinctures and anything sold in servings. You'll see mg per serving and mg per package.

Many reports also include a calculated Total THC line. Raw flower contains mostly THCA, the acid form. Heat, as in smoking, vaping or baking, converts THCA to Δ9-THC. Massachusetts rules require the profile to report Δ9-THC and THCA separately; they don't prescribe a Total THC formula. Labs that add a Total THC line generally use a common industry convention: Total THC = Δ9-THC + (THCA × 0.877). The 0.877 factor accounts for the weight the molecule loses when it converts.

So if a COA shows Δ9-THC at 0.5% and THCA at 24.0%, Total THC is about 0.5 + 21.0 = 21.5%.

For why a bigger number isn't automatically a better product, see THC percentage explained.

3. Terpene profile (if tested)

Some COAs list terpenes such as myrcene, limonene and caryophyllene as percentages or mg/g. Massachusetts doesn't require terpene testing for flower. Many producers include it anyway because shoppers look for it.

For concentrates and vapes, the regulations do require the label to disclose added terpenes and other additives. Vape labels must say whether the product was made with only cannabis-derived terpenes or with terpenes from other sources. Our terpenes guide covers the common ones and the aromas they're usually described as having.

4. Contaminant screens

This is the contaminant half of the COA, and it's the part people skip most often. Each screen appears as a table of analytes, each with a limit and a result. Results show as Pass/Fail, as a number, or as ND (not detected) or <LOQ (below the limit of quantitation, meaning too little to measure reliably).

The next section covers each screen in detail.

5. Summary, signatures and disclaimers

Most COAs end with an overall PASS or FAIL, the analyst or lab director's sign-off, and notes on methods. Under Administrative Order No. 5, Massachusetts COAs must also identify the analysts responsible for each analytical process and reference the lab's standard operating procedures. They must also disclose any pre-testing sanitization or remediation treatment the licensee reported.

What Massachusetts requires labs to test for

The rules come from two places. The first is 935 CMR 500.160, the testing section of the adult-use regulations. The second is the Commission's Protocol for the Sampling and Analysis of Finished Marijuana Products, which the regulation incorporates. Here's how they break down.

Cannabinoid profile: every product

Every product is tested for its cannabinoid profile. Potency must be recorded in the state's seed-to-sale system and shown on the label.

Microbial contaminants: products sold to consumers

The protocol covers:

• Total viable aerobic bacteria
• Total yeast and mold
• Total coliforms
• Bile-tolerant gram-negative bacteria
• Pathogenic E. coli and Salmonella (detection in a one-gram sample fails the test)

Mycotoxins

Mycotoxins are toxins that some molds produce. Massachusetts screens for aflatoxins B1, B2, G1 and G2 and ochratoxin A.

Heavy metals

Finished products are tested for four heavy metals, listed in Exhibit 4 of the testing protocol: arsenic (inorganic), cadmium, lead and mercury (total). For every metal, the batch has to come in under the upper limit for its intended use. For all uses, including inhalation, the limits are 200 µg/kg for arsenic and cadmium, 500 µg/kg for lead and 100 µg/kg for mercury. Higher limits apply to products meant only to be eaten. A product that passes only the ingestion limit must carry the label "THIS PRODUCT HAS BEEN EVALUATED FOR IMPURITIES BASED ON ORAL CONSUMPTION ONLY. DO NOT INHALE THIS PRODUCT."

Pesticides and plant growth regulators

Non-organic pesticides aren't allowed in Massachusetts cannabis cultivation. Finished plant material is screened against the protocol's pesticide list. The Commission uses a 10 parts per billion detection threshold, so any listed pesticide above that level is a compliance problem.

Residual solvents: only when solvents were used

Concentrates made with solvents, such as hydrocarbon or ethanol extracts, are tested for residual solvents. The licensee tests for the solvents it actually used. Only solvents on the protocol's approved list (Exhibit 7a) may be used, and the most hazardous "Class 1" solvents, such as benzene, are banned outright. Limits are set in milligrams per kilogram: for example, 5,000 mg/kg for ethanol, and 12 mg/kg each for propane, n-butane and isobutane (Exhibit 7b). Solventless products like rosin and ice-water hash don't need a solvent screen. For more on how extraction methods differ, see live resin vs. live rosin vs. distillate.

Vitamin E acetate: vapes

Finished, ready-to-sell vape products are screened for heavy metals and Vitamin E acetate (VEA). This requirement came out of the Commission's 2019 quarantine order on vaporizer products.

Which screens apply to which product

*"Covered upstream" means the protocol only allows these products to be made from inputs that already passed that screen. The protocol doesn't require the screen to be repeated on the finished product, though producers can choose to. This table follows section 4.2.1 of the Commission's testing protocol, which describes the requirements for each product type.

Reading pass/fail: what the results really mean

• PASS means every result came in under the Commission's limit for that analyte.
• ND / <LOQ means the lab didn't detect it, or found too little to measure reliably. This is the result you want on a contaminant line.
• A number under the limit still passes. Low levels of some things, like total yeast and mold, are normal in plant material.
• FAIL means at least one result was over the limit. Failed batches can't be sold as they are.

Under 935 CMR 500.160(13), a licensee whose batch fails has three options:

1. Reanalyze without remediation. The batch has to pass a retest at the original lab and then a second confirmatory test at a different lab.
2. Remediate. The batch is treated and then goes through a new full-panel test. It can be remediated a maximum of two times.
3. Dispose of it.

If a batch was remediated or sanitized before testing, Administrative Order No. 5 requires the licensee to tell the lab, and the COA must record it.

Dates, expiration and retesting

Look for the date tested or date reported. In Massachusetts, test results are valid for one year. Anything with a testing date more than a year old is considered expired and can't be sold until it's retested (935 CMR 500.160(5)).

Edible and concentrate labels also carry a creation date and a "use by" or expiration date. That's separate from the lab date. For keeping products in good shape after they arrive, see how to store cannabis.

Five things to check in under a minute

1. Does the batch or package ID match your product? If it doesn't, stop there.
2. Is it an independent, licensed Massachusetts lab? The lab name and license appear in the header.
3. Is the test date less than a year ago?
4. Does every contaminant section read PASS or ND?
5. Is the potency close to what the label says? Label potency comes from the COA, so the two should match. Browse flower or concentrates and compare a product page's lab summary to its label.

Red flags

• No batch number or package ID, or one that doesn't match the product.
• A lab you can't identify, or one that isn't licensed in Massachusetts.
• Missing contaminant sections for that product type (for example, a vape COA with no heavy metals or VEA results).
• A test date more than a year old.
• Formatting that looks edited, such as mismatched fonts, cropped headers or no signature.

If something looks wrong on a product you bought, contact the retailer first. You can also raise concerns with the Cannabis Control Commission.

How the label connects to the COA

You don't need the COA in hand to know a product was tested. Massachusetts labels must include a statement and seal certifying the product was tested for contaminants with no adverse findings, plus the date of testing. Flower labels also carry the full cannabinoid profile. Edible, concentrate, tincture and topical labels list THC and other cannabinoids per package and per serving.

The COA is the detailed record behind those label lines.

How we show lab data

This is the reason our site exists. On our product pages, we show the lab summary tied to each package's METRC tag when it's available: potency, contaminant screen results and the testing date. Our lab results page explains every field. You can check a product before it comes to your door in Boston, Cambridge, Somerville or anywhere else we deliver.

Ready to compare? Shop the menu and open any product's lab summary. Adults 21+ only.

More quick answers

Is a COA the same as the product label? No. The label is a required summary: tested with no adverse findings, the test date, and the cannabinoid content. The COA is the lab's full report behind it.

Why doesn't the potency on my edible match the percentage on flower? Edibles are measured in milligrams per serving and per package, not percent. See our edibles guide for first-timers for how Massachusetts limits servings.

Can a product that failed a test ever be sold? Only after it passes the required retesting, either a confirmatory test at a second lab or a full-panel test after remediation. Otherwise it has to be destroyed.

For use only by adults 21 years of age or older. Keep out of the reach of children. This article is general information, not legal or medical advice.