The Complete Guide to Hemp & CBD Compliance Testing

If you're in the hemp or CBD business, lab testing isn't something you get around to eventually. It's foundational. It's legally required in most jurisdictions. And done well, it's one of the strongest differentiators your brand can have.

But the testing landscape is complicated. Requirements vary by state. Lab quality varies wildly. And figuring out what you actually need to test for — versus what's nice to have — can feel overwhelming, especially if you're newer to the industry.

We've spent years working with hemp and CBD brands through LabLinks, and we've learned a lot about what separates brands that handle compliance well from those that struggle. This guide covers the essentials: what you need to test, how to choose a lab, what your COA should include, and how to make your testing data work for you commercially.

The Legal Baseline: What's Required

The 2018 Farm Bill legalized hemp at the federal level, defining it as cannabis with less than 0.3% delta-9 THC by dry weight. That 0.3% threshold is the line between a legal hemp product and a controlled substance, and proving you're on the right side of it requires third-party testing.

At the federal level, the USDA requires hemp growers to test for THC content. But most CBD brands aren't just growing hemp — they're manufacturing finished products. And that's where state regulations come in, each with their own requirements.

While specifics vary, most state programs that regulate CBD products require:

• Cannabinoid potency testing — Verifying THC is below the legal limit and that CBD content matches label claims
• Contaminant screening — Testing for pesticides, heavy metals, and microbial contamination at minimum
• Batch-specific testing — Results must correspond to a specific production batch, not just a generic product
• COA accessibility — Many states require that Certificates of Analysis be available to consumers, either on-package or via QR code/website

The trend across the country is clear: requirements are getting stricter, not looser. States that had minimal testing requirements five years ago are now expanding their mandates. If you're only meeting the bare minimum today, you may find yourself scrambling to catch up tomorrow.

What Labs Test For: The Full Panel

A comprehensive CBD compliance testing program covers several categories. Here's what each one means and why it matters.

Cannabinoid Potency

This is the big one. Potency testing measures the concentrations of cannabinoids in your product — CBD, THC, CBG, CBN, and others depending on your formulation. This test serves two purposes: confirming your THC is below the legal limit and verifying that your CBD content matches your label claim.

Label accuracy matters more than many brands realize. If your label says 1000mg CBD and testing shows 650mg, you've got a mislabeled product. That's not just a trust issue — it's a regulatory liability. Reputable labs use HPLC (High Performance Liquid Chromatography) for potency testing, which provides the most accurate results.

Pesticide Screening

Hemp is a bioaccumulator, meaning it absorbs substances from the soil very efficiently. That's great for phytoremediation projects, but it means hemp can also absorb pesticides, including ones that weren't applied to the hemp crop itself but were present in the soil from prior agricultural use.

Most state regulations require screening for a panel of pesticides — typically 60 or more specific compounds. Even if your hemp was grown organically, testing provides documentation to back that claim. The testing methods (LC-MS/MS and GC-MS/MS) can detect pesticides at parts-per-billion concentrations.

Heavy Metals

For the same bioaccumulation reasons, hemp can concentrate heavy metals from the soil. The standard panel tests for the "big four" heavy metals:

• Lead — Neurotoxin with no safe level of exposure
• Arsenic — Naturally occurring in many soils, especially in agricultural regions
• Cadmium — Common in areas with historical mining or industrial activity
• Mercury — Less common in hemp but still part of standard screening

Results are compared against established limits (often based on USP <232> standards). Passing heavy metals testing is non-negotiable — these are serious health risks, and no amount of product quality elsewhere makes up for a heavy metals failure.

Residual Solvents

If your CBD is extracted using solvents like ethanol, butane, or CO2, residual solvent testing confirms that those solvents have been adequately removed from the final product. This is particularly important for concentrates, vape products, and tinctures.

CO2 extraction is generally considered the cleanest method, but testing is still important to verify. Hydrocarbon extractions (butane, propane) require especially rigorous residual solvent testing, as these solvents are harmful if consumed.

Microbial Contamination

Microbial testing checks for bacteria, yeast, mold, and specific pathogens like E. coli and Salmonella. Products that failed to maintain proper hygiene during manufacturing, or that have moisture content issues, can harbor microbial growth that poses direct health risks.

This testing is especially critical for ingestible products and anything that will be inhaled (vape products). Topicals have somewhat more lenient standards, but testing is still recommended.

Mycotoxins

Mycotoxins are toxic compounds produced by certain molds. Even if your microbial testing comes back clean, mycotoxins produced during earlier stages of growth or processing can persist in the final product. Aflatoxins and ochratoxin A are the primary concerns. This is a test that some brands skip but shouldn't — mycotoxins are carcinogenic and are increasingly part of state testing mandates.

Choosing the Right Lab

Not all testing labs are equal, and this is an area where cutting corners will cost you. Here's what to look for:

1. ISO 17025 accreditation. This is the international standard for testing laboratory competence. It means the lab's methods have been independently validated and their results are reliable. Don't use a lab that isn't ISO 17025 accredited — full stop.
2. State-specific licensing. Many states require labs to hold a specific state license to perform compliance testing. Results from an unlicensed lab may not be accepted by regulators.
3. Turnaround time. Standard turnaround is 5-7 business days. Rush options (24-48 hours) are available at most labs for an additional fee. Factor testing time into your production schedule.
4. Transparency about methods. A good lab will tell you exactly which analytical methods they use (HPLC, LC-MS/MS, ICP-MS, etc.) and will include method references on the COA.
5. Customer support. You should be able to call your lab and ask questions about your results. If they're hard to reach or dismissive of questions, that's a red flag.

We've heard from brands here in Minneapolis and across the country about the difference a good lab partnership makes. It's worth paying a bit more for a lab you trust over the cheapest option available.

What Your COA Should Include

A complete and compliant Certificate of Analysis should contain:

• Lab name, address, and accreditation information
• Your company name and the product/sample identification
• Batch or lot number corresponding to the tested sample
• Date the sample was received and date testing was completed
• Test results for each analyte with units of measurement
• Pass/fail determinations against applicable limits
• Limits of detection (LOD) and limits of quantitation (LOQ) for each test
• Signature or digital authorization of the lab director or authorized signatory

If your COA is missing any of these elements, it may not hold up under regulatory scrutiny — and savvy customers will notice the gaps.

Sharing Results with Your Customers

Compliance testing does double duty: it satisfies regulators and builds customer confidence. But only if your customers can actually see the results.

The CBD consumer base is one of the most COA-literate customer demographics in all of ecommerce. Many CBD shoppers actively check COAs before making a purchase, and they know what they're looking for. If your COAs aren't easy to find, you're losing sales to competitors whose are.

Best practices for sharing CBD lab results include:

• Display a "Lab Tested" badge on every product page with linked test results
• Make results searchable by batch or lot number for customers who want to verify their specific product
• Include a QR code on packaging that links to batch-specific results
• Update results promptly when new batches are tested — stale data erodes trust
• Present results in a consumer-friendly format, not just a raw lab PDF

This is exactly the problem we set out to solve with LabLinks. Upload your lab data, connect it to your products, and your Shopify store automatically displays testing badges, detailed results, and batch-searchable portal pages. New batch? Upload the data and badges update instantly.

Staying Ahead of the Curve

The hemp and CBD regulatory environment is still evolving. New federal guidance could arrive at any time, and state-level rules change regularly. The brands that thrive long-term are the ones that treat compliance not as a burden but as a brand asset.

Test comprehensively. Choose accredited labs. Keep your COAs organized and accessible. And make your commitment to quality visible to every customer who visits your store. The investment in thorough hemp lab testing and transparent reporting isn't just about avoiding regulatory trouble — it's about building a brand that customers trust and return to.