Every hemp product sold legally in Virginia should come with a Certificate of Analysis. A COA is a lab report. It tells you what's actually in the product, whether it matches the label, and whether it passed safety screening. Reputable brands publish them. If a brand can't or won't show you a COA, that is a flag.
Here's how to read one without getting lost in the chemistry.
What a COA Is
A Certificate of Analysis is a third-party laboratory report on a specific batch of a hemp product. It documents two things:
- The cannabinoid content (how much THC, CBD, and other compounds are in the product).
- The safety screening results (presence or absence of pesticides, heavy metals, microbes, residual solvents, and mycotoxins).
A COA is generated per batch. Different production runs of the same product have different COAs. The batch number on the COA should match the batch on the package.
The Header: Match It to the Product
Top of the COA. Look for:
- Product name and SKU
- Batch or lot number
- Sample collection date and report date
- Lab name, address, and ISO 17025 accreditation status
The batch on the COA must match the batch on your package. If it does not, the COA is not for the product in your hand. ISO 17025 accreditation means the lab has been audited for testing competence by a recognized body. Reliable hemp brands use ISO-accredited labs.
Cannabinoid Profile: The Four Numbers That Matter
This is the section most consumers check first. It lists individual cannabinoids and their concentrations. For Virginia, focus on these four:
1. Total THC. The headline number. Virginia caps retail hemp products at 2 milligrams of total THC per package. The COA should show total THC at or below that limit per package.
2. Delta-9 THC. The federally regulated cannabinoid. The federal definition of hemp currently caps source plants at 0.3% delta-9 by dry weight. New federal rules effective November 12, 2026 narrow this further with a 0.4 mg per container product-level cap. We covered the federal change in our November 2026 hemp ban explainer.
3. THCA. The non-intoxicating precursor to delta-9. THCA converts to delta-9 when heated, which is why total THC is calculated as delta-9 plus (THCA × 0.877). High THCA means a meaningful total THC number once the product is decarboxylated.
4. CBD content. Virginia's 25-to-1 ratio rule allows up to 1 mg of THC for every 25 mg of CBD. Higher CBD content can legally accommodate more THC, up to the 2 mg per package cap.
Other Cannabinoids
Reputable COAs report a broader profile including CBG, CBN, CBC, delta-8 THC, and delta-10 THC. CBG and CBN are non-intoxicating. Delta-8 and delta-10 are intoxicating analogs and count as THC for federal purposes under the November 2026 rule. Significant delta-8 or delta-10 content affects compliance status post-November.
Terpenes
Some COAs include a terpene profile. Terpenes are the aromatic compounds in cannabis that drive smell and flavor. Common ones include myrcene, limonene, pinene, and caryophyllene. A terpene profile is informative but not legally required. Its presence is usually a sign of a thorough lab report.
Safety Testing
The other half of the COA. Look for "PASS" or "ND" (non-detect) on:
- Pesticides: Including chemicals like myclobutanil and bifenthrin.
- Heavy metals: Lead, arsenic, cadmium, mercury.
- Residual solvents: Especially relevant for vapes and concentrates. Ethanol, butane, hexane.
- Microbes: E. coli, salmonella, total yeast and mold.
- Mycotoxins: Aflatoxins and ochratoxin A.
Any "FAIL" in any of these categories means the product should not have made it to retail. Reputable brands do not move failed batches.
Red Flags
Things that should make you walk away:
- COA dated more than 12 months ago.
- Batch on COA does not match package.
- Cannabinoid total exceeds 100% (a math error from the lab — common with sloppy reports).
- No safety panel results listed.
- COA is for a different SKU than the product you are buying.
- Lab is not ISO 17025 accredited and the brand cannot explain why.
How to Find a Product's COA
Most Virginia hemp brands publish COAs in three places:
- A QR code printed on the product label.
- The brand's website (often on the product page itself).
- Available on request from the retailer.
If a brand doesn't publish them in any of those places, ask. A reputable brand will share them.
Bottom Line
A COA is the single best tool a hemp consumer has for checking what's actually in a product. The four numbers to focus on for Virginia: total THC, delta-9 THC, THCA, and CBD. The safety panel needs to read PASS across the board. If the brand can't show you a COA, buy from a brand that can.
For more on how Virginia's product-level THC limits actually work, read our breakdown of Virginia's 2 mg hemp cap.
This article is informational and not legal advice.
