Who's Responsible for a Cannabis COA in New York?

New York-specific and educational only, not legal advice. Rules change; operators should confirm current requirements with the OCM or counsel.

New York's adult-use market is young, and its rulebook is one of the most consumer-facing in the country. It does something California does not: it requires a scannable QR code on the package that opens the lab results.

It also adds a step most states skip: an independent, state-approved sampling firm pulls the sample while the licensee watches, on video. Here is one batch's path from farm to shelf.

The short version:

The COA comes from an independent, OCM-permitted, ISO/IEC 17025 lab.

The producing licensee (cultivator or processor) arranges and pays for testing. A distributor here is logistics-only.

An independent, OCM-approved sampling firm pulls the sample, on video, while the licensee observes.

New York requires a scannable QR linked to the COA on the label, the opposite of California.

Here is how it actually works, following one batch from the field to the shelf.

▶ Try the interactive version (https://weed-central.com/learn/coa/usa-new-york?utm_source=newsletter.weed-central.com&utm_medium=newsletter&utm_campaign=who-s-responsible-for-a-cannabis-coa-in-new-york): follow one batch from farm to shelf and watch the label build up, color-coded by who adds each piece.

A quick note on the rulebook

New York cannabis is regulated by the Office of Cannabis Management (OCM) under 9 NYCRR Part 128 (packaging, labeling, marketing, and laboratory testing). Product is tracked in Metrc (New York recently migrated from BioTrack).

Meet the players

The cultivator grows and tags the batch in Metrc.

The processor finishes it into retail form. The producing licensee, not a distributor, arranges testing.

The sampling firm is an independent, OCM-approved company that pulls the random sample on video, an actor most states don't have.

The lab runs the panel and issues the COA. It must be OCM-permitted and ISO/IEC 17025 accredited.

The dispensary verifies labeling on intake and sells only tested, passing product.

The COA workflow, step by step

Cultivator / harvest batch (Cultivator). The cultivator grows the batch and tags it in Metrc (New York recently migrated from BioTrack). This becomes the label’s lot UID + barcode.

Processor makes final form (Processor). The processor finishes the lot into retail form. The producing licensee, not a distributor, arranges + pays for testing directly.

Independent sampling firm (Sampling firm). New York is unusual: an OCM-approved sampling firm pulls the random sample while the licensee observes, and the whole event is video-recorded.

Permitted lab analysis (Lab). An independent, OCM-permitted, ISO/IEC 17025 lab runs the full panel (potency, pesticides, metals, microbials, mycotoxins, solvents; terpenes are tested too).

COA issued (via Metrc) (Lab). The lab issues the COA and reports it through Metrc. This unlocks mg THC/CBD per serving + per package and the tested-by line.

Pass / fail (Regulatory). Pass → released. A fail is remediated + re-tested (a revised COA) or destroyed.

Package + label (Processor). The processor applies the NY universal symbol (yellow triangle + leaf + “THC!” + a red “21+”), the warnings, and, required in NY, a scannable QR linked to the COA.

Dispensary sale (Dispensary). The dispensary verifies labeling on intake and sells only tested, passing product.

What a licensed lab tests for

A New York lab runs a full contaminant and potency panel:

Cannabinoid potency (mg THC and CBD per serving and per package)

Residual pesticides

Heavy metals

Microbials and mycotoxins

Residual solvents

Terpenes (tested in New York, unlike some states)

A pass is released; a fail is remediated and re-tested (with a revised COA) or destroyed. The lab reports the COA through Metrc.

What ends up on the package, and who puts it there

A New York label carries the product identity, the net weight, the potency from the COA, the lot UID and barcode, the processor, the required warnings, and, uniquely, a QR code that opens the COA.

New York's universal symbol is a yellow triangle with a cannabis leaf and "THC!", paired with a red "21+" mark. It is distinct from California's black-and-white "!THC" triangle.

The warning, word for word

New York requires health warnings, including a rotating message that changes across packages:

This product contains cannabis and THC

KEEP OUT OF REACH OF CHILDREN AND PETS. For use only by persons 21 years of age and older

Warning: Do not use if pregnant or nursing · Poison Center 1-800-222-1222

Cannabis can impair concentration and coordination. Do not operate a vehicle or machinery under the influence of cannabis. (rotating health warning)

The QR question

This is the headline difference. New York requires a scannable QR code on the label that links to the product's COA, so a shopper can pull up the lab results in the aisle. In California the same QR is voluntary. A second code ties the package to its Metrc track-and-trace record.

Common myths

"The COA QR is just marketing." In New York it is required on the label.

"A distributor arranges the test, like California." No; the producing licensee does. The distributor is logistics-only.

"The licensee samples its own product." No; an independent OCM-approved sampling firm pulls the sample, on video.

"The dispensary tested it." No; it verifies labeling and sells only what already passed.

How to read a COA as a customer

Three quick checks:

Does it pass? Look for an overall pass, and scan for any fail on the contaminant sections.

Does it match the package? The COA's Total THC and CBD should line up with the label, and the batch numbers should match.

Is it current and real? The issuing lab should be an independent, accredited facility, and the tracking tag confirms it is a real, logged package.

The one-line takeaway

in New York the producing licensee (cultivator/processor) arranges testing, the distributor is logistics-only, and an independent, OCM-approved sampling firm pulls the sample on video. New York even requires a scannable COA QR on the label (the opposite of California), plus its own yellow-triangle “THC!” + “21+” symbol and a rotating health warning.

New York-specific and educational only, not legal advice. Sources: New York Office of Cannabis Management (OCM), 9 NYCRR Part 128; New York Metrc track-and-trace.