Cannabis Lab Testing: What Gets Tested and Why It Matters

For most consumer goods, we take safety testing for granted. Cannabis is different: it exists in a fragmented regulatory environment where federal scheduling as a Schedule I substance prevents the FDA from regulating it, and each state has built its own testing framework from scratch. The result is significant variation in what gets tested, how rigorously, and what happens when products fail. Understanding this landscape is not academic — it directly determines whether the product you consume is safe.

The fundamental safety gap between legal and illicit market cannabis is documented and significant. Legal cannabis sold through licensed dispensaries in regulated states has undergone mandatory testing across multiple safety panels. Black market cannabis has undergone no third-party testing of any kind — multiple independent analyses of illicit market samples have found pesticide residues, mold contamination, and heavy metal concentrations that would fail any state’s legal testing requirements by wide margins.

Testing is not a bureaucratic formality. Pesticide failures protect consumers from inhaling compounds that become toxic at combustion temperatures. Mold testing protects immunocompromised patients from potentially life-threatening aspergillosis. Heavy metals testing identifies cannabis grown in contaminated soil — a real risk because cannabis is a documented phytoremediator that pulls cadmium, lead, and arsenic from contaminated ground. Each panel serves a specific, evidence-based safety function.

Testing failure rates vary by state and category but are not negligible. California reported that roughly 20% of cannabis products failed testing at some point during the early years of its program. Pesticides and microbials are the two most common failure categories. Products that fail cannot be legally sold and must be remediated or destroyed — when the system works as intended.

A Certificate of Analysis (COA) is a document issued by an independent laboratory summarizing the results of all required tests for a specific product batch. Every legal dispensary product has an associated COA identified by a batch or lot number that matches the product label. Here is what each section means.

The batch or lot number on the COA must exactly match the number on your product label. When a dispensary hands you a product, look for a sticker or print on the packaging showing a batch number. Any legitimate COA will have this number in its header. If the numbers don’t match, you may be looking at a COA for a different batch.

The method a lab uses to test cannabinoid potency affects the accuracy of THC% numbers on your product. Two primary analytical methods are used in cannabis testing: high-performance liquid chromatography (HPLC) and gas chromatography-mass spectrometry (GC-MS). They produce different results for the same sample because of how heat interacts with THCA.

HPLC analyzes samples without heating, so it measures THCA and THC separately. Most flower contains far more THCA (the non-psychoactive acid form) than THC — and the conversion formula used to calculate “total potential THC” (THCA × 0.877 + THC) is an approximation that slightly overestimates actual deliverable THC, because not all THCA converts in real-world smoking or vaporization.

GC-MS heats the sample during preparation, which decarboxylates THCA into THC before measurement — providing a result closer to what the consumer actually receives through combustion. For smoked or vaporized flower, GC-MS is more accurate. For edibles (where controlled decarboxylation occurs during production), HPLC is more relevant.

The potency inflation problem in the industry relates in part to HPLC overestimation compounded by labs that use favorable sampling protocols or face commercial pressure from producers who want high THC numbers for marketing. ISO/IEC 17025 accreditation includes proficiency testing requirements that are the primary safeguard against systematic inflation. Always check whether the lab on your COA is ISO 17025 accredited — this information is public and searchable.

The pesticide panel is the safety test with the most direct and serious consequence if failed. Myclobutanil, marketed as Eagle 20EW, is a systemic fungicide widely used in conventional agriculture. It is registered for food crops under EPA regulations. However, it is definitively not safe for cannabis because when it combusts at smoking temperatures, it undergoes thermal degradation to hydrogen cyanide (HCN) — a documented acute respiratory toxin. There is no safe inhalation level for HCN.

Myclobutanil is the most frequently cited pesticide failure in cannabis testing programs nationally. It was used extensively in the illicit market and early legal market before its risks at combustion were widely understood. Many cultivators were applying it legitimately to protect crops from powdery mildew without being aware of the combustion chemistry. Testing programs specifically targeting myclobutanil represent a direct public health protection.

Other common pesticide failures include bifenazate (a miticide), etoxazole (mite eggs), abamectin (broad-spectrum insecticide), spinosad (organic-approved insecticide that can still fail at high concentrations), and spiromesifen. Each state maintains an action level list — the parts-per-billion threshold below which detection is considered acceptable rather than a failure.

Microbial testing measures the total population of fungi (yeast and mold) and bacteria in a cannabis sample, and separately screens for four specific Aspergillus species that are known human pathogens. The regulatory limits are set by borrowing from pharmaceutical and food safety standards and adapting them for the inhalation route.

TYMC (Total Yeast and Mold Count) must not exceed 10,000 CFU (colony-forming units) per gram for most product types in most states. TAMC (Total Aerobic Microbial Count, i.e., bacteria) must not exceed 100,000 CFU per gram. These thresholds are based on risk models for the target consumer population consuming the product by the intended route.

The Aspergillus panel tests for four specific species: A. fumigatus, A. flavus, A. niger, and A. terreus. These four species account for the overwhelming majority of human aspergillosis infections. A. fumigatus is the most pathogenic and is commonly found in cannabis — it grows at human body temperature and causes serious invasive infections in immunocompromised individuals (HIV/AIDS, chemotherapy patients, organ transplant recipients). For these patient populations, microbial testing is not a precaution; it is a clinical necessity.

Mold that you can see on cannabis is Botrytis cinerea (gray mold or “bud rot”) in most cases — a common post-harvest pathogen not always tested on the Aspergillus panel. If you see any white, gray, or black fuzz on cannabis, discard it regardless of COA results, as visible mold growth occurred after testing.

COA counterfeiting — creating fraudulent lab documents to attach to untested or failed products — is a documented problem in some markets. The ability to verify a COA from the issuing lab directly is the consumer’s primary protection against this.

Step 1: Find the batch number. The batch or lot number on the product packaging must match the batch number on the COA header. Mismatch = not the right document for this product.

Step 2: Check lab accreditation. ISO/IEC 17025 should appear on the COA, typically with the lab’s certificate number. This is independently verifiable through the accreditation body (A2LA or Perry Johnson Laboratory Accreditation are the two primary bodies for cannabis labs in the US).

Step 3: Use the QR code or batch lookup. Most accredited labs provide batch-specific COA lookup on their website. Scan the QR code on the COA or go to the lab’s website and enter the batch number. The COA that loads should match the document in front of you identically.

Signs of a fraudulent or questionable COA: No QR code or batch lookup available; lab name not searchable or has no web presence; test dates that don’t align with product packaging dates; potency results that round suspiciously (exactly 25.00% THC rather than a realistic decimal); all pesticide results listed as exactly 0.00 rather than as ND (below detection limit) with a listed LOD (limit of detection). Real testing produces real variance — suspiciously clean uniform numbers warrant scrutiny.

Understanding lab testing connects directly to smart purchasing: how to read a cannabis menu, consumption methods and safety, medical marijuana card guide, full explainer library, strain database, and cannabis effects guide.