How to Verify Your THCa Product is Legally Compliant

The hemp market operates without the standardized safety oversight that applies to licensed cannabis dispensaries in states with regulated adult-use programs. There is no federal agency conducting routine inspections of hemp retailers, no mandatory recall system, and no guaranteed quality floor for products sold online or in unregulated retail. A 2025 JAMA study found that 70% of hemp-derived CBD products misrepresented potency and over 20% contained THC levels not disclosed on the label — an industry-wide quality problem that applies equally to THCa products.

This means that verifying your THCa product's legal compliance is not optional caution — it's the primary mechanism that protects you legally, keeps you from unknowingly purchasing non-compliant products, and ensures you know what you're actually consuming. This article covers exactly what to check and how to check it.

Legal disclaimer: This article is for general educational and informational purposes only and does not constitute legal advice. Product compliance verification protects consumers but does not guarantee legal protection in all circumstances. Consult a licensed attorney for questions about your specific legal situation.

The Certificate of Analysis: Your Primary Compliance Document

A Certificate of Analysis (COA) is a report issued by an independent third-party laboratory documenting the results of analytical testing performed on a specific batch of hemp product. For THCa flower products, a COA is the foundational compliance document — it is what demonstrates that a product meets the federal hemp definition under current law.

Every legitimate THCa hemp vendor should provide COAs for all products without hesitation. If a vendor cannot produce a COA, does not have batch-specific COAs, or makes it difficult to access them, this is a serious red flag regardless of what their product label claims.

What a Compliant THCa COA Must Show

1. Delta-9 THC at or below 0.3%

This is the single most important number for federal hemp compliance under current law. The delta-9 THC percentage reported as a percentage of dry weight must be 0.3% or lower for the product to meet the 2018 Farm Bill's hemp definition. This number should be clearly visible in the cannabinoid panel. If it is missing, obscured, or reported in a way that makes it difficult to identify, that is a red flag.

Watch out for COAs that report delta-9 THC as "ND" (not detected) without specifying the Limit of Quantification (LOQ). If the LOQ is 0.5% — well above the 0.3% legal limit — a "not detected" result provides no compliance assurance. A legitimate COA should have an LOQ below the legal threshold, typically at 0.05% or lower.

2. THCa percentage

The THCa percentage confirms the potency of the product as described. For compliance verification purposes, the key calculation is: Total THC (post-decarboxylation) = delta-9 THC + (0.877 × THCa). For example, a product with 22% THCa and 0.2% delta-9 THC has a potential total THC of approximately 19.5% post-decarboxylation. This doesn't affect current federal compliance (which measures only delta-9 THC), but some state standards count total THC — so understanding this calculation matters if you're in or traveling to a total THC state.

3. Third-party lab name and accreditation

The testing laboratory must be an independent third party — not a lab owned or operated by the product manufacturer. The lab should be ISO/IEC 17025 accredited, which is the international standard for laboratory competence. DEA-registered labs are required for testing hemp used in federally regulated programs (like USDA hemp production programs), though not all state-licensed retail hemp testing requires DEA registration. The key question: is this an accredited, independent laboratory that has no financial interest in the outcome of the test?

4. Test date and batch number

The COA must be batch-specific — each harvested lot or production run should have its own COA. A single COA covering an entire product line or an undated COA is not adequate compliance documentation. The batch number on the COA should match the batch number on the product packaging. Old COAs from previous batches don't represent the product in hand.

As a practical guide: COAs older than six months for flower products should be viewed with skepticism, as cannabinoid content can shift with improper storage, and a responsible vendor should maintain current batch documentation.

5. Safety testing results

A comprehensive COA for flower products should include not just cannabinoid potency but also safety testing for:

• Pesticides — Should show PASS or "not detected" for all regulated pesticide categories. Hemp is a bioaccumulator that absorbs soil and environmental compounds efficiently, making pesticide testing particularly important.
• Heavy metals — Lead, arsenic, cadmium, and mercury should each show PASS or ND.
• Microbial contaminants — E. coli, Salmonella, yeast and mold counts should be within acceptable limits.
• Residual solvents — Most relevant for extracts and vape cartridges; should show PASS.
• Mycotoxins — Mold-produced toxins; should show PASS for flower products.

A COA that only shows cannabinoid potency and omits safety testing panels should not give you full confidence that the product is safe, even if it is technically compliant.

How to Verify a COA's Authenticity

The hemp industry's lack of standardized oversight creates a risk of falsified or manipulated COAs. Fraudulent COAs exist, and some vendors have submitted products from one batch for testing while selling product from a different batch. Here are the practical verification steps:

Check the lab's website or database

Many accredited cannabis testing laboratories maintain online portals where consumers can verify COA results by entering a batch number or scanning a QR code. If the COA links to a verifiable record in the lab's own database, that's a strong authenticity signal. If there's no way to verify the COA independently, that's a yellow flag.

Verify the lab's accreditation

The ISO/IEC 17025 accreditation of the testing laboratory can be verified through the accreditation body's public registry. The two primary accreditation bodies in the US are ACLASS and A2LA (American Association for Laboratory Accreditation). Both maintain public searchable databases of accredited labs. Look up the lab named on the COA to confirm its accreditation status.

Look for COA red flags

The following characteristics should raise concern about a COA's legitimacy or adequacy:

• No laboratory name, address, or contact information
• No ISO accreditation number or certification reference
• LOQ for delta-9 THC above 0.3% (the legal limit)
• Missing batch number or undated document
• No safety testing panels (pesticides, heavy metals, microbials) for flower or vape products
• Suspicious variance between the COA's cannabinoid results and the product label — particularly if the label claims a much higher THCa % than the COA supports
• QR code that links to a generic product page rather than a specific batch COA
• COA from a lab that cannot be independently verified as accredited
• Only a single COA for the entire product line rather than batch-specific documents

How Canapuff Handles Compliance

Every Canapuff product is tested by accredited third-party laboratories before sale. COAs are maintained for each product batch and are available to customers. Our COAs document:

• Delta-9 THC content at or below the 0.3% federal compliance threshold
• Full cannabinoid panel including THCa percentage
• Safety testing for pesticides, heavy metals, microbials, and residual solvents where applicable
• Batch-specific documentation with traceable batch numbers

If you want to verify the COA for any specific Canapuff product, the COA is linked on the product page. The batch number on your product packaging should correspond to the documented batch in the COA.

Verifying State Compliance Beyond Federal Standards

Federal compliance (delta-9 THC below 0.3%) is necessary but may not be sufficient for compliance in your specific state. Some states use total THC calculations that include THCa. To verify state compliance where applicable, calculate the total THC from your COA:

Total THC (post-decarboxylation) = Delta-9 THC% + (0.877 × THCa%)

Example: A product with 0.2% delta-9 THC and 22% THCa = 0.2 + (0.877 × 22) = 0.2 + 19.3 = 19.5% total THC. This exceeds 0.3% total THC and would not be compliant in states using total THC standards like the new federal definition taking effect November 2026.

For states using total THC standards, Canapuff's product range — which features high-THCa flower — may not be compliant under those state standards. This is why our shipping is restricted to states where current law accommodates the federal hemp delta-9 standard.

A Note on Products Without COAs

Any THCa hemp product sold without an accessible, batch-specific COA from an accredited independent laboratory should not be purchased. The absence of a COA means there is no verified evidence that the product is federally compliant (delta-9 THC under 0.3%), safe (free from pesticides, heavy metals, and contaminants), or accurately labeled for potency. In the unregulated hemp market, the COA is the only consumer protection that exists.

Frequently Asked Questions

How do I know the COA matches the product I actually received?

Match the batch number on your product packaging to the batch number on the COA. If the numbers don't match, the COA does not document the specific batch you received. Contact the vendor to request the correct batch documentation. A vendor who cannot provide batch-matched COAs for the specific product you received is not demonstrating adequate compliance practices.

What does "total THC" mean on a COA vs. "delta-9 THC"?

"Delta-9 THC" on a COA refers to the measured concentration of delta-9 tetrahydrocannabinol specifically — the compound that determines federal hemp compliance under current law. "Total THC" on a COA typically refers to the post-decarboxylation calculation: delta-9 THC + (0.877 × THCa). Both numbers may appear on the same COA. For federal hemp compliance under the 2018 Farm Bill (current through November 2026), the delta-9 THC figure is the compliance-relevant number. For state compliance in states using total THC standards, the total THC calculation is what matters.

Are Canapuff's COAs publicly available?

Yes. COAs for all Canapuff products are linked on the product pages on our website. You can access them at any time before or after purchase to verify the compliance and safety testing results for the specific batch of the product you ordered.

This article is for general educational and informational purposes only and does not constitute legal advice. All Canapuff hemp products are third-party tested by accredited laboratories and comply with applicable federal law as of the date of sale. Compliance documentation is available for all products. Must be 21+. Not available in HI, ID, MN, OR, RI, UT, or VT.