How to Read a COA for Delta 9 THC Gummies

You’ve got a pack of Delta 9 gummies in your cart. The label says 10 mg per piece. The flavor sounds great. But here’s the question that actually matters: how do you know there’s really 10 mg in each gummy, and nothing else riding along with it?

The answer is one document: the Certificate of Analysis, or COA. Once you know how to read a COA, you can check the lab’s numbers against the label, do the per-gummy math yourself, and confirm the batch was screened for contaminants. You don’t need a chemistry degree for any of it.

At CannaBuddy, we publish lab results for everything we carry because you should never have to take a brand’s word for it. This guide walks through a Delta 9 gummy COA section by section, using a clearly labeled example so you can apply it to any report, ours or anyone else’s. (Quick note before we dig in: hemp-derived THC products are for adults 21 and over.)

What is a COA, and why third-party testing matters

A COA (Certificate of Analysis) is a lab report that verifies what’s inside a cannabis product. For a gummy, that means which cannabinoids are present and in what amounts, and, on a full-panel report, confirmation that the batch was screened for things you don’t want in there, like pesticides and heavy metals.

Think of it as a nutrition label with receipts. The brand tells you what’s in the gummy. The COA proves it.

Here’s the thing, though: a COA is only as trustworthy as the lab that produced it. Would you trust a restaurant that inspects its own kitchen? Probably not. When a brand tests its own products in-house, there’s an obvious incentive to see the numbers it wants to see. Third-party lab testing removes that conflict. An independent lab gets paid to run the test, not to deliver a flattering result.

And this isn’t a hypothetical worry. A 2017 study published in JAMA found that roughly 70% of CBD products purchased online were inaccurately labeled: some contained less cannabinoid content than advertised, some contained more, and some contained THC that wasn’t disclosed at all. Edibles are especially prone to this, because a few milligrams one way or the other is invisible to the eye. That’s the problem independent testing exists to solve.

Our example gummy COA (illustrative, not a real product)

Everything below references one made-up report so the math stays concrete. These numbers aren’t from any CannaBuddy product or partner. They’re a teaching example.

• Product: Delta 9 THC gummies, 20-count
• Labeled dose: 10 mg Delta 9 THC per gummy, 200 mg per package
• Gummy weight: 4.0 grams (4,000 mg) each
• Batch: EXAMPLE-001
• Delta 9 THC result: 2.5 mg/g (0.25% by weight)
• THCa result: ND
• CBD result: <LOQ
• Safety panels: pesticides, heavy metals, residual solvents, microbials, mycotoxins, all “pass”

Let’s read it top to bottom.

The header: lab name, accreditation, and test date

Start at the top. You should see the lab’s name, address, and license or accreditation number. If you can’t tell who ran the test, stop right there. An anonymous report tells you nothing.

The gold standard is accreditation to ISO/IEC 17025, the international benchmark for testing laboratories. Accreditation means someone independent has vetted the lab’s methods, equipment, and staff. When you see it on a COA, that’s a good sign.

Then find the test date. COAs don’t technically expire, but cannabinoid content in a gummy can drift over time, and a report from two years ago says little about the batch sitting on a shelf today. A COA older than 12 months is a yellow flag. Not a dealbreaker on its own, but worth noticing.

Batch and lot number: the step everyone skips

Honestly, this is the section that matters most, and it’s the one most shoppers blow right past.

Every COA is tied to a specific batch or lot number, and it should match the number printed on your gummy package. In our example, that’s EXAMPLE-001. A COA for a different batch is a COA for a different product. Brands sometimes lean on one strong test result for months while the actual batches rotate underneath it. Matching the numbers is how you catch that.

The potency panel: from mg/g to mg per gummy

Now for the main event. The potency panel lists each cannabinoid the lab tested for (the “analyte”), usually with two result columns: milligrams per gram (mg/g) and percentage by weight. Two abbreviations trip people up:

• ND means “not detected.” The lab didn’t find any of that cannabinoid.
• LOQ stands for “limit of quantitation,” the smallest amount the equipment can reliably measure. A result of “<LOQ” means trace amounts may exist, but they’re too small to count.

Here’s where gummies differ from flower. The lab doesn’t report “mg per gummy.” It reports concentration, and you (or the brand) multiply by the gummy’s weight to get the dose. The formula:

mg per gummy = mg/g result × gummy weight in grams

Our example gummy weighs 4.0 grams and tested at 2.5 mg/g Delta 9 THC:

2.5 mg/g × 4.0 g = 10 mg Delta 9 THC per gummy

You get the same answer from the percentage column. A 4,000 mg gummy at 0.25% is 4,000 × 0.0025 = 10 mg. Multiply by the count to get the package total: 10 mg × 20 gummies = 200 mg per package. That lines up with the label, which is what you want to see.

A couple of practical notes. Some labs report the whole-gummy result directly (“10.2 mg per unit”), which saves you the math. And real-world results rarely land exactly on the label. A reading of 9.6 mg or 10.4 mg on a 10 mg gummy is normal variance. A reading of 6 mg or 15 mg is a problem. Many state programs allow roughly 10% variance, so use that as a rough yardstick.

The 0.3% rule: why a 10 mg gummy can still be hemp

This is the question we get most often in the shop. If hemp is capped at 0.3% Delta 9 THC, how does a gummy carry 5 or 10 mg of it?

The 2018 Farm Bill defines hemp as cannabis containing no more than 0.3% Delta 9 THC on a dry-weight basis. The key phrase is by weight. A gummy is heavy. Most of its mass is sugar, pectin, and flavoring, so a few milligrams of THC is a tiny fraction of the whole piece.

Run it on our example. The gummy weighs 4,000 mg, and 0.3% of that is 12 mg. A 10 mg gummy sits at 0.25%, comfortably under the line. That’s why you see 5 mg gummies, 10 mg gummies, and occasionally larger pieces with higher doses: the heavier the gummy, the more Delta 9 THC it can hold while staying under 0.3%. A 2-gram gummy, by contrast, tops out at 6 mg.

It’s also why both the mg/g and the percentage columns on the COA matter. The percentage is the compliance number. The mg/g, multiplied by weight, is your dose.

One honest caveat: a COA is not a universal certificate of legality. Several states cap THC per serving or per package regardless of weight, some count total THC rather than Delta 9 alone, and those rules change. Always read lab results alongside the laws where a product is sold, possessed, or shipped.

Total THC vs Delta 9: what the gummy version looks like

On a flower COA, THCa (tetrahydrocannabinolic acid) and Delta 9 THC show up as separate line items, because THCa only converts into Delta 9 THC when you apply heat, a process called decarboxylation. Labs combine them with a standard formula:

Total THC = (THCa × 0.877) + Delta 9 THC

On a gummy COA, this usually looks boring, and boring is good. Gummies are made with distillate that’s already been decarboxylated, so THCa should read ND or <LOQ. In our example, THCa is ND, which means total THC equals Delta 9 THC: 10 mg. Simple.

If a gummy COA shows a meaningful THCa number, pause. You don’t heat an edible when you eat it, so THCa in a gummy mostly just sits there, and its presence suggests the formulation or the testing is off. (For the full THCa story, our THCa flower collection is where that conversation belongs.)

Also scan the rest of the panel. Many gummies blend in CBD, CBN, or CBG, and the COA should show those at amounts matching the label. Our example reads <LOQ for CBD, so this is a straightforward Delta 9 gummy with no companion cannabinoids.

Contaminant panels: pesticides, heavy metals, solvents, microbials

A full-panel COA goes beyond potency and screens for the stuff nobody wants in their gummies:

• Pesticides: residue from chemicals used during cultivation. Hemp is a bioaccumulator, so what’s sprayed on the field can end up in the extract.
• Heavy metals: lead, arsenic, cadmium, and mercury, which hemp pulls from soil.
• Residual solvents: leftovers from extraction, like ethanol or butane. Gummies are made from extract, so this panel matters as much as it does for vapes.
• Microbials: mold, yeast, E. coli, salmonella. Gummies are food, after all.
• Mycotoxins: compounds produced by certain molds.

Each panel shows the measured level, the allowable limit, and a “pass” or “fail.” A pass means the result came in below the threshold. Our example passes every panel, which is exactly what you should expect from anything you’re going to eat.

Potency-only COAs exist and aren’t inherently shady, but for an edible, a full panel is the standard worth holding brands to.

Red flags: spotting a fake or useless gummy COA

Not every COA deserves your trust. Here’s what should make you pause:

• No batch number, or one that doesn’t match the package. This is the most common issue, and it makes the whole document meaningless.
• A stale test date. Anything over a year old.
• No lab name or accreditation. Treat the report as decoration.
• Per-gummy math that doesn’t work. If 2.5 mg/g on a 2-gram gummy is being sold as 10 mg, somebody’s wrong.
• Potency-only results on an edible. You’re eating it. Ask for the safety panels.
• Numbers that look too clean. Every cannabinoid landing on a perfectly round figure, mismatched fonts, blurry sections. Real lab software doesn’t produce sloppy documents, but photo editors do.

And one from experience: if a brand makes its lab results hard to find, that’s a choice. Legitimate companies want you checking their work.

How to verify a gummy COA yourself (in under two minutes)

Learning how to read a COA is step one. Verifying it is step two, and it’s faster than you’d think:

1. Scan the QR code on the package. If it leads to the brand’s homepage instead of an actual COA, that’s a miss.
2. Match the batch number on the COA to the one on your gummies.
3. Confirm the lab is real and accredited. A ten-second search should turn up a website.
4. Run the math. mg/g × gummy weight should land near the labeled dose, and the percentage should sit under 0.3%.
5. Check the safety panels for “pass” across the board.

That’s it. Make it a habit before you buy, the same way you’d “start low, go slow” after.

How CannaBuddy handles gummy testing

We’ll keep this short, because the whole point of this article is that you shouldn’t have to take our word for anything.

Every product we carry, CBD, Delta 8, and Delta 9 gummies included, comes from partners like Wyld, Wana, 3Chi, and Cheeba Chews who test through independent, accredited labs, and those COAs live on our lab results page. Paperwork is part of our vetting. We’ve passed on gummies with sketchy or missing lab reports more times than we can count. That’s the job.

Got questions about a specific product? Our FAQ page covers the basics, and our team in Charlotte and Matthews is always happy to pull up a COA and walk through it with you.

Frequently asked questions

---

Once you can read a gummy COA, you’ll never shop blind again. You’ll start noticing which brands make it easy and which ones make you dig, and that tells you plenty on its own. Next time you’re browsing, pull up the lab report, run the math, and then add to cart. It takes two minutes, and it’s the best habit an edible fan can build.

Ready to try it? Browse our Delta 9 gummies and check the lab results. We’ll be here if you have questions.

---

Please note: Hemp-derived THC products are intended for adults 21 and over. Always review applicable state and local laws before purchasing hemp-derived products.