26Apr
CBD lab testing means sending a finished batch to an independent, accredited laboratory to measure what is actually in it. The laboratory returns a certificate of analysis, or COA, listing cannabinoid content and screening results for pesticides, heavy metals, mycotoxins, solvents and microbes.
This guide explains what each panel on a COA means, how to read one field by field, how to tell a real report from a decorative one, and what a UK buyer needs to check that no certificate covers. It is written for anyone comparing CBD brands and trying to work out which claims are backed by anything.
What is third-party lab testing?
Third-party lab testing means sending a product to a laboratory entirely independent of the company that made it. The laboratory has no commercial stake in the result. It receives a sample, runs its own analysis and reports what it finds.
That independence is the point. A manufacturer testing its own products is doing quality control, which is necessary but is not verification. An accredited outside laboratory has no incentive to find a good number.
The word to look for is accreditation. ISO/IEC 17025 is the international standard for the competence of testing laboratories, and a laboratory holding it has been formally assessed on its methods, its equipment calibration and its staff. A COA from an accredited laboratory means something, and one from an unnamed laboratory means very little. CBD is sold here as a food supplement rather than a medicine, so nobody checks each individual bottle before it reaches a shelf. Independent testing fills that gap.
What a COA actually tests for
Most articles stop at “it shows how much CBD is in there”. A full certificate of analysis covers six panels, and each one exists because of a specific risk.
Cannabinoid profile
This is the potency panel. It reports how much CBD, CBDa, THC, THCa, CBG, CBN and other cannabinoids are present, usually as a percentage by weight and as milligrams per unit. It matters because label accuracy across the CBD market is genuinely inconsistent, and this panel is the only way to confirm that a 1500mg bottle holds 1500mg.
Pesticides
Hemp is an agricultural crop, and conventional farming uses pesticides. Extraction concentrates the plant, so it also concentrates anything sprayed on it. A residue that would be trivial in raw plant material becomes significant in a concentrated extract, which is why the size of the panel matters as much as the pass or fail result.
Heavy metals
Hemp is a hyperaccumulator, drawing metals out of the soil and storing them in its tissue. That makes it useful for cleaning contaminated land and risky as a crop grown on unknown ground. Standard panels test for lead, arsenic, cadmium and mercury.
Mycotoxins
Mycotoxins are toxic compounds produced by moulds that grow on plant material during cultivation, drying or storage. Aflatoxins and ochratoxin A are the ones usually screened for. They survive processing, so a mycotoxin problem cannot be extracted out later. Many CBD brands do not test for these at all.
Residual solvents
If an extract was made using a chemical solvent such as butane, ethanol or hexane, traces can remain in the finished product, and this panel checks for them. It is one of the reasons the extraction method matters. Supercritical CO2 extraction uses carbon dioxide, which returns to gas and leaves nothing behind, so there is no solvent to remove.
Microbials
This panel screens for bacteria, yeast and mould, typically including total aerobic count, E. coli and Salmonella. It is a direct read on how hygienic the manufacturing environment was.
How to read a certificate of analysis
A COA looks intimidating and is not. Work through the fields in this order.
| Field | What it means | What to check |
|---|---|---|
| Batch or lot number | Identifies the specific production run tested | That it matches the number printed on your bottle |
| Sample and report date | When the batch was sampled and analysed | Recent enough to describe the product you are buying |
| Testing laboratory | Who ran the analysis | Name, address and accreditation are all printed |
| LOQ and LOD | The smallest amount the method can measure, and the smallest it can notice | Low figures, because they set the limit of what the test can say |
| ND | Not detected, meaning not present above the detection limit | Read it alongside the LOD, not as a guaranteed zero |
| CBD, CBDa and total CBD | The neutral cannabinoid, its raw acid form, and the combined figure | Whether the product is raw or heated, and that the total matches the label |
| Delta-9 THC | The intoxicating cannabinoid, reported as a percentage by weight | Alongside the container size, so you can see what the container holds |
| Method | The analytical technique used, usually HPLC or GC | HPLC for any raw or CBDa product |
Two of those fields deserve more explanation, because they are where most of the confusion starts.
Total CBD versus CBD and CBDa. Raw hemp contains mostly CBDa, the acidic precursor of CBD, which converts to CBD when heated. A COA lists them separately, then gives a total CBD figure calculated as CBD plus CBDa multiplied by 0.877. That factor accounts for the carbon dioxide molecule lost during conversion, and it is why the numbers rarely add up the way you expect. It matters most if you use an unheated RAW CBDa oil, where the acid form is the whole point of the product.
HPLC versus GC. Gas chromatography applies heat, which converts CBDa to CBD during the test itself, so it reports a combined total rather than the split. HPLC works at lower temperatures and preserves the acid forms, so it can report CBD and CBDa separately. For a raw product, HPLC is the appropriate method, and a GC-only report cannot tell you what you need to know.
What a UK buyer should check beyond the COA
A certificate of analysis tells you what is in the batch. It does not tell you whether the product is legal to sell to you, and in the UK that is a separate question with a separate public record you can search yourself.
Is it on the FSA public list?
Ingestible CBD products are regulated as novel foods in the UK, and to be sold legally in England and Wales an ingestible product must appear on the Food Standards Agency public list, which names the product and the company behind the application. That list is published, so you can look a product up before you buy rather than taking a website’s word for it. It covers oils, capsules, sprays, gummies and anything else intended to be swallowed. It does not cover creams, balms and other topicals, which are regulated as cosmetics and sit outside the novel foods regime.
Does the batch number match the product in front of you?
This is the check people skip. A brand can publish a perfectly genuine report for a batch it produced two years ago and link every product on the site to it. Find the batch or lot number printed on the container, then find that same number on the report. If the report carries no batch number, or one that does not match, you have a document about a different production run.
What does the container hold in controlled substances?
UK rules do not work to a percentage of dry weight. UK guidance caps controlled substances, including delta-9 THC, at a very low level per container, which means the size of the container is part of the calculation. A percentage that looks small on a certificate means a different quantity in a 10ml bottle than in a 30ml one. Read the delta-9 THC figure on the COA alongside the volume or weight of the container, and if a brand cannot tell you what its container holds, that is informative in itself.
How to spot a fake or outdated COA
Not every document labelled “lab tested” is a lab report. These are the patterns worth recognising.
- No batch number. A COA without a batch or lot number cannot be matched to anything. It is a generic document, not a test result.
- No laboratory named. If the report does not say which laboratory produced it, with an address and an accreditation number, treat it as marketing.
- No date, or a date you cannot find. Undated reports are used to make one old test cover years of production.
- A COA for a different product. Check that the product name and strength on the report match the item you are buying. Brands sometimes publish one COA for a whole range.
- Cannabinoid-only testing presented as full testing. This is the most common one. A potency report shows CBD content and nothing else. If a brand says “third party tested” and the linked document has no pesticide, heavy metal or microbial panel, then contaminants were not tested.
- Results with no limits shown. A pass or fail column with no stated action limit gives you no way to judge the result.
What Endoca tests for, and how
Endoca controls the whole chain, which is what makes the testing programme meaningful. The company grows its own hemp, runs its own supercritical CO2 extraction and manufactures under GMP conditions, so a failed screen traces back to a field or a process step rather than to an anonymous supplier.
Every batch is screened for more than 200 pesticides, along with heavy metals and mycotoxins. Cannabinoid content is analysed by HPLC, and NMR spectroscopy is used as an additional structural check on the extract, which is a level of analysis most CBD companies never reach.
The reports are published rather than summarised. Each product carries a batch number, and the corresponding report is available at lab.endoca.com and through the lab testing page. The wider quality system, including the GMP framework and the in-house controls that sit alongside the independent testing, is documented on the quality control page, and the production chain itself is set out on the process page.
It is also why a genuine 99.9% CBD isolate is possible at all. A purity figure at that level is only credible with analytical chemistry behind it.
Questions to ask any CBD brand
Take this list to any brand, including this one. The answers separate companies quickly.
- Can I see the COA for the exact batch number on the bottle I am buying?
- Which laboratory ran it, and is that laboratory accredited?
- Does the report include pesticides, heavy metals, mycotoxins, residual solvents and microbials, or only cannabinoids?
- How many pesticides are on the panel?
- What is the delta-9 THC content, and what is the limit of detection?
- How much does one container hold in controlled substances?
- Was potency measured by HPLC or GC?
- Is every batch tested, or a sample of batches?
- Where was the hemp grown, and who grew it?
- Which extraction method was used, and are residual solvents screened for?
- Is this product on the FSA public list?
A brand that answers all eleven without hesitation is doing the work. One that answers with the phrase “third party tested” and no document is not.
Frequently asked questions about CBD lab testing
What is a certificate of analysis for CBD?
A certificate of analysis is a document from a testing laboratory reporting what was found in a specific batch of product. It lists cannabinoid concentrations and screening results for contaminants, along with the batch number, the sample date, the testing methods and the detection limits used.
How do I find the COA for my CBD product?
Find the batch or lot number printed on the packaging, then look it up on the brand’s lab reports page. For Endoca products, batch reports are published at lab.endoca.com. If a brand cannot produce a report for your specific batch, that is the answer to your question.
What does ND mean on a CBD lab report?
ND stands for not detected. It means the substance was not found above the method’s limit of detection, rather than that it is definitively absent. The lower the detection limit stated on the report, the more informative an ND result is.
Why is the total CBD different from the CBD number?
Hemp produces CBDa, which converts to CBD when heated. Reports list both, then calculate total CBD as CBD plus CBDa multiplied by 0.877, a factor accounting for the mass lost during conversion. Raw, unheated products show a high CBDa figure and a low CBD figure.
Is third party tested CBD actually safer?
Independent testing does not change the product, but it tells you whether the product matches its label and whether contaminants are present. Given that hemp accumulates heavy metals from soil and that extraction concentrates residues, a full contaminant panel is a meaningful check rather than a formality.
How do I check if a CBD product is legal to buy in the UK?
For anything ingestible, check the Food Standards Agency public list, which names the products authorised for sale in England and Wales. Then check the container: UK guidance caps controlled substances at a very low level per container. Topicals are cosmetics and are not on that list.
What should the THC line say on a COA?
It depends on the product type. A full spectrum oil contains trace THC by design and will show a small figure. Broad spectrum and isolate products should read ND. Read the figure alongside the container size rather than on its own, and speak to your GP or pharmacist if you take prescription medication.
Before you buy any CBD product, ask for the batch report and read the panels rather than the headline. You can check the published report for every Endoca batch on the lab testing page, then choose from the CBD oil range knowing what is in the bottle.
