Who's Responsible for a Cannabis COA in Colorado?

Colorado-specific and educational only, not legal advice. Rules change; operators should confirm current requirements with the MED or counsel.

Pick up a jar in a Colorado dispensary and the potency number on it did not come from the store, and it did not come from the grower's own say-so. Colorado runs one of the oldest adult-use markets in the country, and its testing chain differs from California's in one big way: there is no distributor in the middle.

The cultivator (or the products manufacturer) arranges testing directly, and in Colorado the licensee even collects its own sample. An independent, state-licensed lab is still the only party that can issue the result. Here is how one batch gets from the grow room to the shelf.

The short version:

A Certificate of Analysis (COA) can only come from an independent, MED-licensed testing facility that holds ISO/IEC 17025 accreditation.

There is no distributor tier. The cultivator or products manufacturer arranges the test directly.

Colorado licensees collect their own samples: trained designated collectors pull a representative sample under a written plan. The state pulls samples mainly for audits.

The store is the gatekeeper: it can only sell product that Metrc shows as tested and passed.

Here is how it actually works, following one batch from the field to the shelf.

▶ Try the interactive version (https://weed-central.com/learn/coa/usa-colorado?utm_source=newsletter.weed-central.com&utm_medium=newsletter&utm_campaign=who-s-responsible-for-a-cannabis-coa-in-colorado): follow one batch from farm to shelf and watch the label build up, color-coded by who adds each piece.

A quick note on the rulebook

Colorado's adult-use market is regulated by the Marijuana Enforcement Division (MED), part of the Department of Revenue, under the rules at 1 CCR 212-3. Every plant and package is tracked in Metrc, the state's track-and-trace system, from tag to sale.

Meet the players

The cultivation facility grows and harvests the batch and tags it in Metrc. Retail cultivation licenses carry a 403R prefix. It does not self-certify results.

The products manufacturer (MIP) turns flower into edibles, concentrates, and vapes, and arranges its own testing.

The testing facility independently analyzes the sample and issues the COA. Only a lab can. Colorado testing licenses carry a 405R prefix and must hold ISO/IEC 17025 accreditation.

The retail store accepts only product Metrc shows as passed, and adds its own license number and the date of sale. Store licenses carry a 402R prefix.

The state (MED) watches the whole chain through Metrc and pulls its own audit samples.

The COA workflow, step by step

Cultivation facility (Cultivator). The grow tags each plant with a Metrc UID and defines a Harvest/Production Batch. This becomes the label’s batch number, cultivator license, and net weight. Colorado has no distributor tier.

Self-sampling (Cultivator). Unlike California, the licensee samples its own batch: two trained “Designated Test Batch Collectors” pull a representative sample under a written Sample Plan. (The MED pulls samples only for audits.)

Independent testing facility (Lab). The batch goes to an independent, MED-licensed, ISO/IEC 17025-accredited Testing Facility. Nothing is printed yet.

Full compliance panel (Lab). The lab runs potency + contaminants (pesticides, solvents, metals, microbials, mycotoxins, water activity). Results post to Metrc.

Results / COA issued (Lab). The lab, and only the lab, issues the results. This unlocks the label’s % Total THC & CBD and the tested-by lab + date.

Pass / fail (Regulatory). Pass → the cultivator/MIP may transfer it. A fail is decontaminated/remediated and re-tested before anything can move.

Package + label (Cultivator). Child-resistant packaging goes on with the red-and-white “!THC” diamond (min ½″×½″), the potency, and Colorado’s two required warnings.

Retail store (Store). The store verifies conforming labeling, adds its own license number and the date of sale, and sells only Metrc-“passed” product.

What a licensed lab tests for

A Colorado lab runs a compliance panel scaled to the product type:

Cannabinoid potency (Total THC and CBD)

Microbials and mycotoxins

Residual pesticides

Residual solvents (for concentrates)

Heavy metals

Water activity and moisture, as applicable

A single result over an action level fails the batch. A failed batch can be decontaminated or remediated, but it must be re-tested and pass before anything can move.

What ends up on the package, and who puts it there

A Colorado label carries the product identity, the net weight, the potency (a percentage of Total THC and CBD for flower, or milligrams per serving and per package for edibles), the batch number, the cultivator, and the required warnings, all in child-resistant packaging.

Colorado's required mark is not California's triangle. It is a red-and-white diamond with an exclamation point and "THC," and it must be at least half an inch by half an inch. Edibles carry that same diamond stamped on each individual piece.

The warning, word for word

Colorado requires specific warning language on the package, including a blunt line that catches people off guard:

This product was produced without regulatory oversight for health, safety, or efficacy.

There may be long term physical or mental health risks from use of marijuana including additional risks for women who are or may become pregnant or are breastfeeding. Use of marijuana may impair your ability to drive a car or operate machinery.

Contains Marijuana. Keep away from children.

The QR question

Colorado does not require a QR code linking to the COA on the package. The batch number and Metrc tracking are what tie the product back to its test record. Some brands add a COA QR voluntarily, but it is not mandated.

Common myths

"The grower certifies its own weed." The grower collects the sample, but only an independent ISO-accredited lab can issue the result.

"There's a distributor like in California." No. Colorado has no distributor tier; the licensee arranges testing directly.

"The store tested it." No; the store only sells what Metrc shows as passed.

"If it's on the shelf, testing was optional." Retail marijuana has to clear its required testing before sale.

How to read a COA as a customer

Three quick checks:

Does it pass? Look for an overall pass, and scan for any fail on the contaminant sections.

Does it match the package? The COA's Total THC and CBD should line up with the label, and the batch numbers should match.

Is it current and real? The issuing lab should be an independent, accredited facility, and the tracking tag confirms it is a real, logged package.

The one-line takeaway

Colorado has no distributor, the cultivator or products manufacturer arranges testing directly and even samples its own batch (the state lab-tests only for audits). Everything a customer relies on, the potency, the tested-by line, still comes from the independent lab. Colorado’s mark is a red-and-white “!THC” diamond, not California’s triangle.

Colorado-specific and educational only, not legal advice. Sources: Colorado Marijuana Enforcement Division (MED), 1 CCR 212-3; Colorado Metrc track-and-trace.