Every number on a CBD label is a claim, and the certificate of analysis (COA) is supposed to be the proof. State laws increasingly require a batch-specific COA behind a scannable QR code. The FTC treats "lab tested" and "THC-free" as objective claims requiring substantiation. And the federal hemp redefinition taking effect in November 2026 makes one COA line item — total THC per container — the difference between a legal product and a controlled substance.

The uncomfortable backdrop: independent testing keeps finding that label numbers and actual contents disagree. Brands that treat the COA as a marketing checkbox are carrying measurable, documented risk.

What a Complete COA Must Show

A COA that can actually support your label does more than report a CBD number. The elements that matter:

• Full cannabinoid potency panel — CBD, delta-9 THC, THCA, and any marketed minor cannabinoids (CBG, CBN), reported per unit and per container, with the lab's limit of quantification stated

• Total THC — delta-9 plus THCA on a converted basis (delta-9 + 0.877 × THCA), the number the new federal definition and most state programs actually regulate

• Contaminant panels — pesticides, heavy metals, residual solvents, microbials, and mycotoxins, with pass/fail against a stated standard

• Batch identity — the lot/batch number matching the physical unit, sample date, and test date

• Lab identity and accreditation — the testing lab's name, address, and accreditation status

A potency-only COA from an unaccredited lab, generated once for a formulation two years ago, satisfies almost none of the legal purposes a COA now serves.

The Mislabeling Problem Is Measured, Not Anecdotal

Can you trust the average CBD label? The published testing says no. FDA's marketplace sampling study, reported to Congress, tested products including tinctures, edibles, and pet products: of 102 products that listed a specific CBD amount, 18% contained significantly less than labeled and 37% contained significantly more. Barely half were within tolerance of their own label.

Academic testing is worse. A Johns Hopkins study of hemp-derived CBD products found roughly 76% mislabeled for potency at a ±10% margin. A follow-up study published in 2024 found 74% of products deviated at least 10% from labeled CBD potency, and about a quarter didn't even qualify as the product type — full-spectrum, broad-spectrum, or isolate — claimed on the package.

Over-formulation is as common as under-formulation, and it isn't safer: too-high potency means unlabeled dosing, potential total-THC violations, and a label that's false in the direction plaintiffs' lawyers prefer.

QR Codes Are Now a Legal Requirement, Not a Flourish

Multiple states have converted the COA from a back-office document into a mandatory consumer-facing disclosure:

The operational trap is drift: the QR code is printed once, but batches change continuously. A code that resolves to a dead link, a different batch's COA, or a generic lab summary fails the statute just as surely as no code at all. Treat the QR destination as a living system with an owner, not artwork.

"Lab Tested" and "THC-Free" Are Substantiation Claims

Under the FTC Act, an objective product claim needs a reasonable basis before you make it, and testing claims are as objective as claims get.

"Lab tested" means this product, tested for what you imply

The claim implies that the product on the shelf — this batch, this formulation — was tested, and tested for the things a consumer would reasonably assume: potency and safety, not potency alone. "Third-party lab tested" adds an independence representation; testing at your own bench doesn't support it.

"THC-free" is the most dangerous two words on a hemp label

"THC-free" reads as zero, and consumers act on it — including employees subject to drug testing. If your COA shows "non-detect" at a stated quantification limit, that's the defensible claim: "non-detectable THC" with the LOQ disclosed. Products labeled THC-free that turned out to contain THC have generated exactly the class-action and failed-drug-test fact patterns you'd expect. Broad-spectrum brands should also remember the 2024 finding that a quarter of products failed their spectrum-type claim outright.

ISO 17025 and Batch Matching — the Two Disciplines That Hold It Together

Use an ISO/IEC 17025-accredited lab. It's the international standard for testing-lab competence, it's explicitly required in states like Florida, and it's the credential that makes your COA persuasive to a regulator, a retailer, or a jury. Cannabinoid results vary meaningfully across labs; accreditation plus a consistent methodology is your defense.

Then match batches ruthlessly. Every unit in commerce should trace to a COA for its own production batch — not a representative sample from last year. Batch matching is what converts a stack of PDFs into substantiation: when a state inspector scans your QR code, the lot number on the can and the lot number on the certificate have to agree.

With the 0.4 mg total THC per container federal cap arriving in November 2026, that same batch-level total-THC line becomes a legality determination. Products near the threshold need tighter testing cadence and documented uncertainty margins, because "our old COA said 0.3 mg" won't cover a batch that drifted.

Make every tested claim provable

Truli's AI agents scan labels, packaging, websites, and social content against FDA and FTC regulations — flagging unsupported "lab tested" and "THC-free" claims, missing disclosures, and label numbers your documentation doesn't back, with the specific rule cited for every finding. Book a demo to put your COAs and your claims on the same page.

A note from Truli: Truli is not a law firm, and this article does not constitute or contain legal advice or create an attorney-client relationship. When determining your obligations and compliance with respect to relevant laws and regulations, you should consult a licensed attorney.