Cannabis Testing Laboratory Data Guide 2026

NIST reported 10.3% to 30.9% between-laboratory relative standard deviation for total THC across six cannabis plant samples in its second Cannabis Laboratory Quality Assurance Program exercise [1]. That result is the clearest answer to why a 2026 cannabis laboratory data guide matters: the number printed on a certificate of analysis, or COA, is not automatically interchangeable with a result from another laboratory. Sampling, preparation, method performance, units, uncertainty, and reporting rules all affect what the result can support.

What cannabis testing laboratory data can actually tell you

A COA can document the identity of a submitted sample, the laboratory and method used, the analytes sought, and the results reported. It can support a jurisdiction-specific release decision when the sample and testing satisfy the governing program, but it does not prove that every unit in a production lot has identical composition.

That distinction begins at sampling. ASTM describes sampling as a source of uncertainty in cannabis and hemp testing, while the USDA hemp rule requires laboratories to report measurement uncertainty with delta-9 THC results because the uncertainty affects the compliance range [2][3]. A precise-looking decimal therefore should not be read as perfect knowledge of the lot.

Cannabis testing also spans unlike questions. Potency methods quantify cannabinoids; contaminant panels may examine pesticides, microorganisms, mycotoxins, residual solvents, heavy metals, moisture, or water activity under the applicable state program [4][5]. A pass for one panel says nothing about an analyte that was not required, sampled, or tested.

For dispensary teams, the useful unit of analysis is the complete result record, not a copied THC value. Link the product and lot identifiers to the sample identifier, laboratory, accreditation status, method, analyte, result, unit, reporting limit, uncertainty where reported, decision rule, issue date, and certificate version.

The strongest public data on laboratory variability

NIST distributed cannabis plant samples in its second Cannabis Laboratory Quality Assurance Program exercise. Across six samples, the final report found between-laboratory relative standard deviations of 10.3% to 30.9% for total THC, 15.5% to 38.2% for delta-9 THC, and 9.6% to 21.6% for THCA [1]. These are study-specific interlaboratory dispersion results from laboratories using multiple methods, not estimates for every laboratory or product.

A peer-reviewed Washington State analysis examined 17,000 flower samples tested by seven laboratories and found statistically significant potency differences associated with the laboratory used [6]. The study also identified evidence consistent with laboratory shopping, but observational data cannot by itself establish the cause of every difference.

A California proficiency-testing study evaluated 10 laboratories using blinded cannabis samples and found that performance varied by analyte and matrix [7]. Proficiency tests are valuable because participating laboratories receive related material, yet they still do not recreate all routine chain-of-custody, sampling, storage, and production-lot conditions.

The broader measurement literature explains why. ISO/IEC 17025 requires competent laboratories to address method validation, measurement traceability, sampling where applicable, handling of items, technical records, measurement uncertainty, result validity, and reporting [8]. Accreditation demonstrates assessment against the standard’s scope; it does not make two different methods or sampling plans numerically identical.

Screenshot-ready cannabis laboratory evidence table

RSD means relative standard deviation. The final row is an editorial calculation grouping seven ISO reporting concepts: title, laboratory identity, unique identification, customer identity, method, item description, and results with units [8]. Programs and certificate formats can require additional fields.

Reading potency without false precision

Cannabinoid labels may report neutral cannabinoids, acidic precursors, or calculated totals. Oregon defines total THC using a conversion formula that combines delta-9 THC and THCA, and the conversion applies a factor of 0.877 to THCA [4]. That factor reflects molecular mass loss during decarboxylation; it is not a guarantee that a consumer’s use conditions convert all THCA.

Units must remain attached. A result in percent by mass is not directly interchangeable with milligrams per serving, milligrams per package, or concentration in an extract. The conversion requires the tested matrix and relevant product mass, and any local calculation should be labeled rather than presented as a laboratory result.

Reporting limits matter equally. “Not detected” generally means the laboratory did not detect the analyte above the stated method threshold; it does not establish absolute absence. NIST’s cannabis quality-assurance work emphasizes fit-for-purpose methods and reference materials because calibration and matrix effects shape defensible quantification [9].

Do not round before applying a rule unless the governing program says to do so. Preserve the original reported value, unit, qualifier, and uncertainty, then record any separate compliance decision exactly as issued by the authorized party.

Contaminant results and action limits

An action limit is a policy threshold, not the laboratory’s limit of detection and not a universal toxicological boundary. California publishes category-specific limits for inhaled and other cannabis products, while Oregon publishes its own testing rules and tables [4][5]. A product passing one jurisdiction’s panel cannot be relabeled as passing another jurisdiction’s program without satisfying that program.

Microbiological results require special care because methods can target viable organisms, genetic material, indicator organisms, or named pathogens. FDA’s laboratory methods compendium illustrates that food microbiology methods are organism-specific and procedural [10]. A generic “microbial pass” field discards information needed to understand what was examined.

Moisture content and water activity are also different. Moisture describes the amount of water, while water activity concerns water available to support reactions and microbial growth. NIST's finding that between-laboratory dispersion differed by cannabinoid and sample reinforces why the method and result should travel together [1].

For a dispensary intake workflow, record the jurisdiction and rule version that governs each decision. A changed action limit, panel, or sample rule should create a new comparability period rather than silently rewriting the old one.

COA authenticity and chain of custody

Start with the regulator’s license directory or approved-laboratory list rather than trusting a logo. Confirm that the laboratory was authorized for the relevant scope on the report date, then compare the COA’s laboratory identity, address, sample identifier, and signature or authorization fields with the source record [4][5].

Trace the COA lot to the package received. A matching product name is insufficient because names can repeat across batches. Investigate duplicate certificate numbers, missing pages, altered dates, inconsistent units, results copied between analytes, and a revised certificate that does not identify what changed.

ISO/IEC 17025 calls for amendments to reports to be clearly identified and to include the reason for change when appropriate [8]. Keep the original and amended documents; do not overwrite the earlier file.

Virginia pharmaceutical processor rules include laboratory testing and record obligations within their regulated framework [11]. Operators should use the current Virginia Administrative Code and Cannabis Control Authority materials for applicability, rather than applying another state’s table by analogy [11][12].

For help organizing intake, revision, and exception records, see our COA management service. The related dispensary compliance statistics page provides a broader regulatory context, while cannabis payment risk statistics covers a different evidence chain.

A defensible local laboratory-data dashboard

Build the dashboard from certificate-level records. Useful measures include certificates received, certificates matched to inventory lots, certificates superseded, results with missing units, unresolved identifier mismatches, and lots placed on hold by an authorized owner.

Any percentage needs a declared denominator. For example, “COA match rate = certificates matched to the received lot identifier divided by certificates reviewed,” which is a calculation definition rather than a recommended target. Exclude only records named in advance and publish the unresolved count beside the rate.

Avoid averaging potency across products unless the business question and weighting are explicit. An unweighted mean gives a small lot the same influence as a large lot, while a mass-weighted mean requires reliable lot masses. Neither average substitutes for reviewing each lot’s release status.

Keep source values immutable. Store normalized fields separately, identify the transformation, and preserve the source document’s checksum or controlled file reference. This allows a reviewer to distinguish a laboratory correction from an internal transcription correction.

Methodology and limitations

This guide is a desk review of 14 sources published or updated from 2017 through 2025 and verified on July 23, 2026. We prioritized regulators, standards bodies, government scientific agencies, and peer-reviewed studies, then mapped each quantitative claim to the study population and date shown in the source list.

The NIST, Washington, and California findings are not pooled because their samples, designs, analytes, laboratories, and periods differ [1][6][7]. No number on this page estimates a national cannabis laboratory error rate.

Rules are jurisdiction-specific and can change. ISO material describes a competence framework, NIST provides measurement science, and state rules control only within their scope [4][5][8][9]. This guide is operational research, not legal or scientific advice for a particular product.

Frequently asked questions

Does a passing COA prove the whole lot is safe?

No. It documents results for the submitted sample under the stated methods and decision rules. Representativeness depends on the sampling plan, chain of custody, lot homogeneity, and program requirements [2][8].

Why can two laboratories report different THC results?

Sampling, sample preparation, extraction, calibration, method selectivity, instrument performance, uncertainty, and reporting conventions can all contribute. NIST's exercise measured 10.3% to 30.9% between-laboratory RSD for total THC across its six cannabis plant samples [1].

Is “not detected” the same as zero?

No. It normally means the result fell below a stated detection or reporting threshold for that method and matrix. Retain the qualifier and threshold instead of replacing the result with zero [8][9].

Can a dispensary calculate total THC itself?

It can reproduce a jurisdiction’s published formula for review if it labels the result as a calculation and keeps the laboratory values unchanged. Oregon’s published total-THC formula uses the 0.877 THCA conversion factor [4].

What should be checked when a COA is revised?

Confirm the certificate identifier, revision date, reason, affected fields, authorizing laboratory, and lot match. Keep every version because ISO/IEC 17025 expects amended reports to be identified [8].

Sources

1. NIST, Cannabis Laboratory Quality Assurance Program: Exercise 2 Cannabinoid Final Report (NIST IR 8519), published June 2024.
2. ASTM International, D8334 Standard Practice for Sampling of Cannabis/Hemp Post-Harvest Batches, published 2020.
3. USDA, Establishment of a Domestic Hemp Production Program, published January 19, 2021.
4. Oregon Health Authority, Cannabis Testing Rules, OAR Chapter 333 Division 7, accessed July 23, 2026.
5. California Department of Cannabis Control, Testing Laboratories, updated 2024.
6. Jikomes and Zoorob, The Cannabinoid Content of Legal Cannabis in Washington State Varies Systematically Across Testing Facilities and Popular Consumer Products, published March 14, 2018.
7. Wiley et al., An Inter-Laboratory Comparison of Cannabinoid Analysis in Cannabis, published 2021.
8. ISO, ISO/IEC 17025:2017 General Requirements for the Competence of Testing and Calibration Laboratories, published November 2017.
9. NIST, NIST Tools for Cannabis Laboratory Quality Assurance, updated December 16, 2025.
10. FDA, Bacteriological Analytical Manual, updated January 2024.
11. Virginia Administrative Code, Regulations Governing Pharmaceutical Processors, updated January 1, 2025.
12. Virginia Cannabis Control Authority, Laws and Regulations, accessed July 23, 2026.
13. AOAC International, Cannabis Analytical Science Program, updated 2024.
14. CDC, Cannabis and Public Health, updated February 15, 2024.

Conclusion

Laboratory data becomes useful when the sample, method, units, thresholds, uncertainty, and certificate history stay connected. If your team wants light administrative help keeping that evidence organized, book a free consultation call.