Cannabis Lab Testing Requirements: What Must Be Tested, and Why States Differ

Last updated on September 17, 2026 · Originally published February 6, 2017

Cannabis lab testing requirements exist for one reason: nobody can see pesticides, mold, heavy metals, or actual THC content by looking. Testing is the substitute for trust – the mechanism that lets a regulator put a product on a legal shelf without having grown it. Every state program is built on that idea, and every state builds it differently. This article covers what commonly gets tested, who sets the rules, the patterns behind how states diverge, and the federal changes taking effect in November and December 2026 that rewrite part of the math.

What must be tested?

Most regulated markets draw from the same seven testing categories, although not every state requires every category – and different product types do not necessarily receive the same tests.[1]

Potency – the cannabinoid numbers on the label, led by THC and CBD, typically measured by high-performance liquid chromatography. This is the panel consumers read and the one with the most famous problems: two compliant labs can report different numbers for the same flower, for reasons our guide to why two labs give different THC results unpacks.

Pesticides – screened against a state-specific list with state-specific action limits. This is where states differ most (more below).

Heavy metals – many states test at least the “big four”: lead, cadmium, arsenic, and mercury. Cannabis can accumulate metals from contaminated soil and water, which is why this panel exists.

Microbials – yeasts, molds, and bacteria, with Aspergillus species the headline risk for anyone with a compromised immune system.

Mycotoxins – required in many, but not all, state programs. These are toxins produced by certain molds, tested separately from the organisms themselves.

Residual solvents – for extracts and concentrates: whatever was used to strip the plant must be shown to have left the product, within limits.

Moisture and water activity – required for flower in many markets, because water activity helps predict whether microorganisms can grow. Moisture content and water activity are related measurements, but not interchangeable.

The depth on each contaminant – what the limits are, how the methods work, what failure means – lives in our contaminant testing pillar; this page is the map, that one is the terrain.

Who actually sets the requirements?

For marijuana products, state law and state regulators set the requirements. There is still no single federal compliance-testing standard for products sold through state-legal cannabis programs. Each state specifies its own required panels, action limits, and sampling rules. The nearest thing to a common thread is accreditation: most established state programs require compliance laboratories to hold ISO/IEC 17025 accreditation, the international standard for testing-laboratory competence.[2] It provides a framework for competent, documented laboratory work without prescribing one cannabis method, one analyte list, or one set of limits.

For hemp products, the picture is federal-plus-state: the USDA’s hemp rule (7 CFR Part 990)[3] governs pre-harvest compliance testing – including the requirement that total THC be calculated with the THCA conversion – and states layer their own product rules on top. That broader federal framework is the one about to change (below).

The usual compliance sequence is simple: a batch is sampled, and that batch is held from retail sale until the required results come back passing. The COA is not paperwork after the fact; it is the gate.

How do states differ?

States built their programs independently, without a national cannabis-safety standard to copy. They made different choices about acceptable risk, testing cost, laboratory capacity, and whether to screen broadly or target particular hazards. The resulting rules are not identical, but the differences cluster along a handful of predictable axes. Learn those axes and any state’s rules become easier to read.

Which pesticides, at what limits. One state screens for several dozen compounds, another for over a hundred; the same pesticide can carry different action limits across a state line. This is the single biggest source of “passed there, failed here.”

Microbial philosophy. Some states set total yeast-and-mold count thresholds; others target specific organisms (notably Aspergillus species) and ignore the total count; some do both. The two philosophies can disagree about the same sample.

Panel breadth. The heavy-metal big four versus expanded metal lists; terpene profiling required, optional, or absent; vitamin E acetate screening in vape products post-2019.

Remediation and retesting. Whether a failed batch can be remediated (irradiated, extracted, re-tested) or must be destroyed – and how many retests are allowed, which is where lab-shopping incentives live.

Sampling rules. Batch sizes, who collects the sample, chain of custody – the unglamorous rules that determine whether the tested gram actually represents the untested pound.

Label tolerance. How far a claimed value may differ from the laboratory result. California, for instance, does not consider a cannabinoid label inaccurate when its difference from the COA is within ±10%.[4]

We keep this page at the pattern level deliberately: a fifty-state table is out of date the week it publishes – this article’s own previous version proved it, listing a state as having no testing mandate that has now had one for six years.

What changes with the 2026 federal hemp redefinition?

Congress enacted the new hemp definition in November 2025, originally with an effective date of November 12, 2026.[5] A second law signed on September 2, 2026 created a split timetable.[6] On November 12, cannabinoids that cannot be produced naturally by cannabis – and naturally occurring cannabinoids synthesized or manufactured outside the plant – fall outside the hemp definition. On December 11, the remaining changes take effect: the dry-weight standard shifts to total THC, including THCA, and final hemp-derived cannabinoid products are limited to 0.4 mg per container of total THC plus other cannabinoids determined to have similar effects.

Current total-THC calculations generally convert THCA using the 0.877 factor, although the statute itself says only that THCA must be included – the formula is USDA hemp-testing practice, not statutory text. For laboratories and producers, the practical consequence is direct: a finished-product COA reporting only delta-9 THC will no longer answer the federal compliance question, and many high-THCA and full-spectrum products that qualified under the old definition will not qualify under the new one. The full legal picture – dates, definitions, and what remains genuinely unsettled – is in our guide to the 2026 hemp redefinition and total THC.

What does this mean for reading a COA?

Four practical habits. First, confirm that the batch or lot number on the COA matches the package in your hand – a genuine certificate can still belong to a different batch. Check the testing date and the name of the licensed laboratory. Look for a passing result across the contaminant panels required for that product; on an extract, pay particular attention to residual solvents. And read potency as a measurement with known uncertainty, not as scripture: sampling, laboratory variation, and storage can all move the number. Testing requirements exist so you don’t have to trust anyone’s word – but they only work if someone reads the certificate. For what home testing can and can’t add to that picture, see whether you can test cannabis at home.

References

1. Jameson LE, Conrow KD, Pinkhasova DV, et al. Comparison of State-Level Regulations for Cannabis Contaminants and Implications for Public Health. Environmental Health Perspectives. 2022;130(9):097001. doi:10.1289/EHP11206
2. ISO/IEC 17025 – General requirements for the competence of testing and calibration laboratories. https://www.iso.org/ISO-IEC-17025-testing-and-calibration-laboratories.html
3. U.S. Department of Agriculture. Establishment of a Domestic Hemp Production Program, 7 CFR Part 990. https://www.ecfr.gov/current/title-7/subtitle-B/chapter-IX/part-990
4. California Code of Regulations, Title 4, §15724(h) – cannabinoid label accuracy tolerance. https://www.law.cornell.edu/regulations/california/4-CCR-15724
5. Continuing Appropriations, Agriculture, Legislative Branch, Military Construction and Veterans Affairs, and Extensions Act, 2026, P.L. 119-37, Division B, §781 (Nov. 12, 2025), amending 7 U.S.C. §1639o. https://www.govinfo.gov/content/pkg/PLAW-119publ37/html/PLAW-119publ37.htm
6. Continuing Appropriations and Extensions Act, 2027, P.L. 119-103, §2019 (September 2, 2026), delaying most §781 provisions until December 11, 2026. https://www.govinfo.gov/content/pkg/PLAW-119publ103/html/PLAW-119publ103.htm

Last updated September 13, 2026 – rebuilt from the 2017 state-by-state series opener into a full requirements guide · Originally published February 6, 2017  · Reviewed by Nani Frenkel, chief editor