You are about to pay €40 for a bottle of CBD oil. The label promises 10% cannabidiol and under 0.3% THC. On the side of the box sits a QR code; you scan it, a PDF opens, and what loads is a six-page laboratory report thick with acronyms, percentages, and pass-or-fail columns. Most buyers glance at it, see the lab's logo, and close the tab. That document is what the entire legal CBD market rests on, and the half-minute it takes to read it properly is what separates a compliant shelf from a decorative sticker.
This is a plain-English walkthrough of a Certificate of Analysis: what it proves, who issues a credible one, the five panels a serious report contains, and the red flags that say walk away. For the legal context behind the THC threshold, see Is CBD Legal in Estonia in 2026; this post stays on the laboratory side.
What a Certificate of Analysis actually is
A Certificate of Analysis, almost always abbreviated COA, is a document issued by a laboratory after it has measured a specific batch of material against a defined set of parameters. For a CBD product the batch is a finite quantity of flower, oil, or cosmetic produced in a single manufacturing run; the parameters are cannabinoid content, contaminant levels, and — for extracts — any solvent residues left behind by processing. A COA is not a marketing document. Its job is to confirm, under signature, that on a given date a representative sample of a given batch measured at the values printed on the page. When regulators — Ravimiamet, the Põllumajandus- ja Toiduamet, a customs officer anywhere in the EU — decide whether a product is compliant, this is the first piece of paper they reach for.
Who issues a credible COA: ISO 17025 and the third-party rule
Two questions decide whether the certificate is worth the paper it is printed on.
First: is the lab accredited to ISO/IEC 17025? This is the international standard for testing and calibration laboratories, administered in Estonia by the Estonian Accreditation Centre (EAK) and across Europe by member-state bodies under the European co-operation for Accreditation (EA). It covers method validation, measurement uncertainty, proficiency testing, staff competence, and record integrity. A lab without it may still produce accurate numbers, but its work has not been independently audited.
Second: is the lab independent of the producer? An in-house lab at a hemp farm may be well-equipped, but the producer has a commercial interest in the outcome; a third-party lab does not. Compliant Estonian and EU CBD retailers publish third-party COAs, not in-house reports. Familiar names on legitimate European CBD certificates include Eurofins, SGS, and Phytovista. If the lab on the page is unsearchable, the certificate is effectively unsigned.
The five panels of a real COA
A complete CBD COA contains five test panels. A report that skips one is not incomplete by accident — each panel catches a different category of problem.
1. Cannabinoid profile
The cannabinoid panel reports the percentage by weight of each measured cannabinoid. A well-structured profile includes at minimum:
- CBD — the active target compound. Should match the label to within roughly ±10%.
- CBDa — the raw-plant precursor to CBD. High CBDa with low CBD suggests the material has not been decarboxylated.
- Δ9-THC — the regulated cannabinoid. The 0.3% figure is a cultivation rule — a statement about the hemp variety, not a ceiling on the bottle. Under Regulation (EU) 2021/2115 Article 4 a CBD product stays in the legal industrial-hemp category only if its source plant came from an EU-catalogue variety at or below 0.3% Δ9-THC on dry weight. A batch sample reading above that line on the COA is the clearest signal the source did not meet the threshold — and in Estonia pulls the finished extract into the narcotic-substances category by association.
- THCa — the precursor to THC. Serious labs report "total THC" as Δ9-THC + (THCa × 0.877), the conversion factor accounting for decarboxylation on heating.
- CBG, CBN, CBC — minor cannabinoids. Their distribution signals the chemotype of the source plant and distinguishes a full-spectrum extract from an isolate.
Values below the limit of quantification are marked <LOQ. A flat "zero" with no reference to sensitivity is a sign of a sloppy report.
2. Heavy metals
Hemp is a phytoremediator — it pulls metals from the soil it grows in. A serious COA screens the four metals regulators track: lead, cadmium, arsenic, mercury. Units are ppm (mg/kg) or ppb (μg/kg). Typical action limits used across EU cannabinoid testing:
- Lead: ≤ 0.5 ppm in finished product
- Cadmium: ≤ 0.2 ppm
- Arsenic: ≤ 0.2 ppm (inorganic arsenic is the relevant species)
- Mercury: ≤ 0.1 ppm
A reading of "ND" or a figure well below the action limit is what the buyer wants to see. A result sitting right at the limit is technically passing but worth a question.
3. Pesticides
The pesticide panel is a multi-residue screen — a single analytical run looking for dozens of agricultural chemicals at once. European cannabinoid labs typically test 50 to 200 compounds covering organochlorines, organophosphates, carbamates, pyrethroids, and systemic fungicides. Many limits sit in the single-digit ppb range. A compliant COA reports each analyte individually with its limit and measured result; a summary "pesticides: pass" with no compound-level detail is not a full report. On well-grown EU-catalogue hemp, an entire column of ND readings is an achievable result, not an exceptional one.
4. Microbials
The microbiological panel checks for bacterial and fungal contamination that can develop during cultivation, drying, or storage:
- Total aerobic bacteria — general bacterial load. Typical limits 10,000 to 100,000 CFU/g.
- Total yeast and mould — often the tightest spec. 1,000 to 10,000 CFU/g on most dried hemp.
- Enterobacteriaceae and bile-tolerant Gram-negatives — indicators of faecal contamination or poor handling.
- E. coli, Salmonella, pathogenic Aspergillus (A. flavus, niger, fumigatus, terreus) — should be absent in the tested sample.
- Aflatoxins (B1, B2, G1, G2) and ochratoxin A — mycotoxins in ppb; often ≤ 2 ppb individual, ≤ 5 ppb total.
5. Residual solvents
This panel matters only for extracts — oils, concentrates, isolates — where cannabinoids have been separated from plant material using a solvent. Raw dried flower has no residual-solvent question and the panel can be absent; for any extract it is mandatory. Common solvents screened: butane, propane, ethanol, methanol, hexane, pentane, isopropyl alcohol, acetone, ethyl acetate. Limits follow ICH Q3C as adopted by the European Pharmacopoeia — Class 1 (avoided, single-digit ppm), Class 2 (limited, low hundreds ppm), Class 3 (safe, up to 5,000 ppm). A supercritical CO₂ extract typically shows ND across the panel; an ethanol extraction will show a trace of ethanol below spec.
Matching the batch number on the COA to the batch on your bottle
A COA that is technically perfect but references a different batch tells you nothing about the product in your hand. This is the check most casual buyers skip, and it is the single most important one. Every CBD product on a compliant shelf carries a batch number (sometimes called a lot number) printed on the packaging — base of the jar, side of the box, under the barcode. The COA for that batch carries the same identifier on its first page, next to the sample name and test date. The two must match character for character. A QR code that opens a generic COA for "the product line" without specifying a batch is a weaker signal; it may be the current batch or a report from six months ago still posted. The correct format is one COA per batch, identifiers matching, report dated within the product's shelf life — twelve months is typical for dried flower, longer for oils and cosmetics.
Red flags: the COA checklist that signals walk away
In rough order of severity. Any single item is grounds to ask a question; two or more and the product does not meet basic due-diligence.
- No COA at all. A seller who cannot produce a certificate for the batch on sale is below the baseline Estonian and EU retail standard.
- Lab not named, or unsearchable. An anonymous "independent third-party laboratory" with no address or accreditation number is effectively unsigned.
- No ISO 17025 reference. Serious labs cite their accreditation number and issuing body on every COA.
- COA older than twelve months on dried flower. Cannabinoid and terpene profiles drift.
- Missing or mismatched batch number. A COA is only valid for the batch it names.
- Incomplete panels. Cannabinoids without heavy-metal, pesticide, microbial, or residual-solvent data is half a document.
- THC at or above 0.3%. For a product sold as industrial hemp, this is a legal failure.
- CBD percentage wildly off-label. A 10% oil testing at 6% or 14% is outside reasonable tolerance.
- In-house testing only. Useful to the producer; not independent verification.
- No analyst signature or report ID. A serious report names the analyst and carries a unique identifier.
Why "ND" across the board is the gold standard
"ND" stands for not detected — the target compound was below the method's limit of detection. It is the strongest result a contaminant panel can return. ND across heavy metals, pesticides, microbial pathogens, and (for extracts) residual solvents describes a genuinely clean product from a competently run grow and a careful process. ND does not mean absolute zero; methods have finite sensitivity, and every lab operates down to a limit of detection (LOD) or limit of quantification (LOQ). A good COA prints the LOD and LOQ alongside each ND result — their absence is itself a small flag. A COA with ND contaminants and a cannabinoid profile matching the label is what a compliant Estonian retailer expects to receive from an ISO 17025 lab for a well-grown batch. Not rare. Baseline.
What we carry, and the certificates attached
EcoCBD stocks CBD products that come with batch-level Certificates of Analysis on file, available on request. A few examples from the current catalogue:
- Amnesia Indoor CBD Flower 2.84% 3g — EU-catalogue hemp variety grown indoors, sold as aroma flower, with a third-party cannabinoid and contaminant report per batch.
- White Widow 1g 100% CBD Flower — compact single-gram format, full lab panel covering cannabinoid profile, heavy metals, pesticides, and microbials.
For the wider range, browse the CBD flowers and CBD cosmetics categories. For context on what hemp flower is in the first place, the companion piece What Is CBD Flower? A Buyer's Primer covers the botanical and category basics.
This article is for informational purposes only and does not replace legal or medical consultation. Regulations may change; verify current rules with the relevant authorities. If more than six months have passed since publication, check the primary source.
Frequently asked questions
What is a COA for CBD?
A Certificate of Analysis is a laboratory report that confirms the contents and purity of a specific batch of CBD product. A complete COA documents the cannabinoid profile (CBD, THC, minor cannabinoids), heavy metals, pesticides, microbials, and — for extracts — residual solvents. It is issued by a third-party laboratory and references the batch number printed on the packaging.
Who should sign the lab report?
A credible COA names the analyst or quality manager who approved the report, carries a unique report identifier, and is issued on the lab's own letterhead. Ideally the lab is accredited to ISO/IEC 17025 and the accreditation number is cited on the document. An anonymous or unsigned report does not meet the standard expected by Estonian and EU regulators.
How old can a COA be before it stops being useful?
Twelve months from the test date is the common cut-off for raw hemp flower, which has a relatively short shelf life and whose terpene and cannabinoid profile drifts over time. For oils and cosmetics with longer shelf lives, a COA is usually valid through the stated expiry or best-before date of the product. A report older than twelve months on a dried flower batch is a red flag.
What does "ND" mean on a lab report?
ND stands for not detected — the compound being tested for was below the analytical method's limit of detection. It is the cleanest possible result for a contaminant. A good COA prints the limit of detection alongside the ND result so the reader can judge how sensitive the method is. ND across heavy metals, pesticides, and microbial pathogens is the baseline expectation for a quality CBD product.
Should the COA mention a batch number?
Yes. A COA is valid only for the batch it names, and that batch number must match the one printed on the product's packaging — base of the jar, side of the box, under the barcode. A generic report with no batch reference, or one whose batch number does not match the bottle, does not provide verification for the product being sold.
Does a third-party COA beat an in-house one?
Yes. An in-house laboratory can be technically competent, but the producer has a commercial interest in the outcome. A third-party lab has none. Compliant Estonian and EU CBD retailers publish third-party COAs, not in-house reports. In-house testing is useful for the producer's own quality control; it is not a substitute for independent verification on a product sold to the public.