Who's Responsible for a Cannabis COA in California?

California-specific and educational only, not legal advice. Rules change; operators should confirm current requirements with the Department of Cannabis Control or counsel.

▶ Try the interactive version (https://weed-central.com/learn/coa/usa-california?utm_source=newsletter.weed-central.com&utm_medium=newsletter&utm_campaign=who-s-responsible-for-a-cannabis-coa-in-california): follow one batch from farm to shelf and watch the label build up, color-coded by who adds each piece.Turn a jar of flower over and try to figure out who vouched for the numbers on it, and you hit one of the most misunderstood parts of legal cannabis. People assume the farm certifies its crop, or that the dispensary tests what it sells. In California, neither is true.

The short version:

A valid Certificate of Analysis (COA) can only be issued by an independent, state-licensed testing lab: a Type 8 licensee (license numbers start with C8-).

The distributor, not the farm and not the dispensary, is legally responsible for arranging that test and holding the batch while it happens.

The dispensary is the gatekeeper: it can only sell product that already carries a passing COA.

A "COA" a farm writes about its own weed has no legal standing. That's marketing, not testing.

Here's how it actually works, following one batch from the field to the shelf.

A quick note on the rulebook

California cannabis is regulated by the Department of Cannabis Control (DCC) under the state's MAUCRSA law. In 2021 the state merged its three former cannabis agencies into the DCC, and by late 2022 all the rules were consolidated into one place: California Code of Regulations, Title 4, Division 19. Older citations you'll still see online (the Bureau of Cannabis Control's Title 16 sections) are out of date.

Meet the players

The farm (cultivator) grows and harvests the batch and tags it in the state's track-and-trace system. It does not test and does not self-certify. Cultivation licenses use a CCL prefix.

The distributor takes possession of the whole batch, is legally responsible for arranging the lab test, does the final quality-assurance review, and packages and labels the product. Distributor licenses start with C11-.

The testing lab independently samples the batch, runs the panel, and issues the COA. Only a lab can. Labs are Type 8 (C8-) and must hold ISO/IEC 17025 accreditation.

The retailer (dispensary) accepts only product that already passed. Storefronts are C10-; delivery-only is C9-.

The state watches the whole chain through track-and-trace (Metrc), which assigns every batch a Unique Identifier (UID).

A microbusiness (C12-) can combine several of these roles under one license, but it still has to use an independent lab for the COA. Nobody tests their own product.

The COA workflow, step by step

Cultivation and batching (Farm). The farm grows a strain and defines a batch, a single uniform harvest lot (California caps a flower harvest batch at 50 pounds). The batch gets its UID in Metrc. The farm's job is a clean, accurately tagged batch, not a test result.

Transfer to the distributor (Distributor). The batch moves to a licensed distributor, who must take physical possession of the entire batch before testing. Arranging the test is the distributor's legal duty.

Representative sampling (Lab). A lab employee travels to the distributor's premises and pulls a representative sample from the whole batch, under video recording and a signed chain of custody. Product is never sampled outside the distributor's possession.

Analysis and COA (Lab). The lab runs the full compliance panel, measuring each analyte against a DCC action level (a pass/fail threshold). Then the lab, and only the lab, issues the Certificate of Analysis. It uploads the COA to track-and-trace within one business day and emails a copy to the DCC. Once issued, a lab can't alter a COA without DCC permission.

Pass, fail, or remediate (Distributor QA). On a pass, the distributor reviews the batch (confirming the COA matches it and is less than 12 months old, and that the label's THC and CBD figures match the COA) and releases it. On a fail, the batch is quarantined: the distributor destroys it, or, for manufactured products, the manufacturer remediates it under a DCC-approved plan and has it re-tested before it can reach a shelf.

Packaging and sale (Distributor, then Retailer). The distributor applies compliant packaging and the label, most of it drawn from the COA. The dispensary then accepts the goods only with a passing COA linked in track-and-trace, and adds price and tax at checkout.

The consumer. You can scan the UID to confirm it's a real, tracked package, or open a COA link (where a brand provides one) to see the lab-verified results.

What a licensed lab tests for

California requires a compliance panel, applied as relevant to the product type:

Cannabinoids (potency: Total THC and Total CBD)

Residual pesticides

Residual solvents and processing chemicals

Heavy metals (lead, arsenic, cadmium, mercury)

Microbial impurities (pathogenic bacteria and fungi)

Mycotoxins

Moisture content and water activity

Foreign material

One surprise: terpenes are not a required test in California. They appear on most COAs because labs and brands like to feature them, but the lab only runs the terpene profile if asked. Each contaminant has an action level, a maximum allowable amount; a single result at or over the line fails the whole batch.

What ends up on the package, and who puts it there

A California label has two zones. The primary panel (the front) carries the product identity (e.g. "Cannabis Flower"), the net weight in both metric and US units, the THC and CBD content (a percentage for flower; milligrams per serving and per package for edibles and concentrates, straight from the COA), and the universal cannabis symbol.

That symbol trips up a lot of write-ups: California's is an exclamation point in a triangle with "THC," printed in black or white against a contrasting background. It is not the yellow triangle some other states use, and it must be at least half an inch tall.

The informational panel carries the UID, the batch number, the licensee's name and contact, the packaging date, the government warning, a Prop 65 warning where applicable, and, for edibles, ingredients, allergens, and nutrition facts. A few things people assume are required aren't: the lab's name, the test date, and full license numbers are commonly printed, but they live on the COA, not on a mandated label field.

The government warning, word for word

Since July 1, 2024, California requires this exact bold statement on flower and other non-manufactured products:

GOVERNMENT WARNING: THIS PACKAGE CONTAINS CANNABIS, A SCHEDULE I CONTROLLED SUBSTANCE. KEEP OUT OF REACH OF CHILDREN AND ANIMALS. CANNABIS MAY ONLY BE POSSESSED OR CONSUMED BY PERSONS 21 YEARS OF AGE OR OLDER UNLESS THE PERSON IS A QUALIFIED PATIENT. CANNABIS USE WHILE PREGNANT OR BREASTFEEDING MAY BE HARMFUL. CONSUMPTION OF CANNABIS IMPAIRS YOUR ABILITY TO DRIVE AND OPERATE MACHINERY. PLEASE USE EXTREME CAUTION.

Manufactured products (edibles, vapes, concentrates) use a near-identical version that swaps in "PRODUCT" and adds: "THE INTOXICATING EFFECTS OF CANNABIS PRODUCTS MAY BE DELAYED UP TO TWO HOURS."

Why there can be more than one QR code

The UID / track-and-trace code ties the physical package back to the state record.

A COA link or QR opens the full lab results. Useful, but here's the surprise: it's a voluntary industry practice, not a California requirement. (The DCC has proposed a rule to make retailers provide a COA on request, but it isn't in effect yet.)

A store or menu QR is pure marketing, added by the retailer. Not required.

Common myths

"The farm issues the COA." Only a licensed lab can.

"The dispensary is responsible for testing." No; the distributor arranges it, the dispensary refuses anything untested.

"A brand's in-house lab result counts." It has to be an independent, ISO/IEC 17025 lab. No self-certification.

"If it's on a shelf, testing is optional." Untested product legally can't be sold.

"Label potency and the COA can differ." The label numbers come from the COA, and the distributor checks they match before release.

How to read a COA as a customer

Three quick checks:

Does it pass? Look for an overall pass, and scan for any fail on the contaminant sections.

Does it match the package? The COA's Total THC / CBD should line up with the label, and the batch numbers should match.

Is it current and real? Product shouldn't be released on a COA more than 12 months old, and the issuing lab should be a Type 8 (C8-) licensee. Scanning the UID confirms it's a tracked, legitimate package.

FAQ

Is a cannabis farm required to include a COA in California? No. The farm doesn't create or provide the COA. The distributor arranges the lab test, and the lab issues the COA.

Can a dispensary sell untested cannabis? No. It can only sell product that already carries a passing COA linked in track-and-trace.

How long is a COA good for? Product can't be released to retail on a COA more than 12 months old.

What happens on a fail? The batch is quarantined and destroyed, or, for manufactured products, remediated under a DCC-approved plan and re-tested. It can't be sold as-is.

The one-line takeaway

The farm makes it, the distributor arranges the test and packages it, the lab proves what's in it, and the dispensary sells it, with the state watching through track-and-trace. Almost everything you actually rely on, the potency numbers and the proof they're real, comes from the lab step, not the farm and not the store.

California-specific and educational only, not legal advice. Sources: California Department of Cannabis Control (cannabis.ca.gov (https://cannabis.ca.gov?utm_source=newsletter.weed-central.com&utm_medium=newsletter&utm_campaign=who-s-responsible-for-a-cannabis-coa-in-california)), California Code of Regulations Title 4, Division 19, and Business and Professions Code Division 10 (§26120).