Third-party lab testing for CBD — why it matters
A certificate of analysis (COA) from an independent laboratory is the only document that verifies what a cannabidiol (CBD) oil actually contains. Not the label. Not the brand’s website. Not the marketing copy. The COA — issued by a lab with no financial relationship to the manufacturer — reports exact cannabinoid concentrations, tetrahydrocannabinol (THC) levels and contaminant screening results for a specific production batch.
The CBD market has no universal quality enforcement. A 2024 study published in Frontiers in Pharmacology found heavy metals in 44 of 202 commercially available CBD products, with lead as the most prevalent contaminant. Labels claimed concentrations that didn’t match actual contents. Without independent lab verification, a buyer has no way to confirm that a 3000mg CBD oil actually contains 3000 mg of cannabidiol — or that the bottle is free from pesticides, solvents and microbial contamination.
This article explains what third-party testing involves, what each panel checks for, how to spot red flags, and what Australian standards require under the Therapeutic Goods Administration (TGA). For context on how CO₂ extraction produces CBD oil before testing begins, that article covers the manufacturing side.
What third-party lab testing means
Third-party means the testing laboratory operates independently from the CBD manufacturer. No ownership stake, no supply agreement, no financial incentive to produce favourable results. In-house testing — where the manufacturer runs its own checks — carries an obvious conflict of interest. The company testing its own product decides what to report.
Credible third-party labs hold ISO/IEC 17025 accreditation, the international standard for testing and calibration laboratories. ISO 17025 confirms the lab meets management and technical competence requirements — calibrated instruments, validated methods, reproducible results. In most countries, regulatory authorities will not accept results from non-accredited labs. The accreditation number appears on the COA near the lab’s letterhead.
“Lab tested” on a label can mean almost anything. A manufacturer could send one sample to an accredited lab, receive a clean COA, then never test again. The only reliable indicator is a batch-specific COA from an ISO 17025-accredited independent laboratory — with the batch number on the COA matching the batch number on the bottle.
What a CBD lab report actually tests
A full certificate of analysis covers six testing panels. Each panel checks for a different category of quality and safety concern. Skipping any one of them leaves a gap in the product’s quality profile.
Cannabinoid potency. High-performance liquid chromatography (HPLC) measures individual cannabinoid concentrations — cannabidiol (CBD), THC, cannabigerol (CBG), cannabinol (CBN), CBC, CBDV and others. A complete potency panel typically reports 11 or more cannabinoids. For full spectrum CBD oil, the COA should show measurable levels of multiple cannabinoids. For broad spectrum CBD oil, THC should read “ND” (Not Detected) while other cannabinoids remain present.
Heavy metals. Inductively Coupled Plasma Mass Spectrometry (ICP/MS) screens for lead, arsenic, mercury and cadmium — the four metals most commonly found as contaminants in hemp-derived products. Hemp is a bioaccumulator, meaning the plant absorbs heavy metals from soil and water during growth. Without testing, those metals end up in the final oil. Australia’s TGO 93 standard sets specific limits: lead ≤5.0 ppm, arsenic ≤3.0 ppm, cadmium ≤0.5 ppm, mercury ≤0.5 ppm.
Pesticides. Labs screen for insecticides, fungicides and plant growth regulators — typically 66 to 72 individual analytes depending on the regulatory framework. Even hemp grown under organic conditions can carry pesticide residue from neighbouring farms, contaminated water or soil history. The COA lists each tested compound with either a quantified result or “ND.”
Residual solvents. If the extraction process uses solvents like butane, ethanol or hexane, trace amounts can remain in the finished oil. Labs test for up to 15 residual solvents. CO₂ extraction avoids this issue entirely — supercritical carbon dioxide evaporates completely, leaving no solvent residue. The COA still includes the panel to confirm the product is solvent-free.
Microbial contamination. Testing covers total aerobic microbial count, yeast and mould, E. coli, salmonella and enterobacteria. Contamination can occur during cultivation, processing, bottling or storage. A “Pass” result means microbial counts fall within acceptable limits. Any detected pathogen like salmonella or E. coli triggers an automatic fail.
Mycotoxins. Labs screen for aflatoxins (B1, B2, G1, G2) and ochratoxin A — toxic compounds produced by Aspergillus and Penicillium mould species that can grow on hemp during cultivation or storage. Australia’s TGO 93 sets aflatoxin B1 at a maximum of 2 µg/kg. Mycotoxin contamination is invisible to the naked eye and undetectable without laboratory analysis.
Batch-specific testing vs one COA for everything
CBD oil quality varies between production batches. Different hemp harvests produce different cannabinoid ratios. Extraction conditions fluctuate. Post-processing introduces variables. A COA from batch 2024-A tells you nothing about batch 2025-C — cannabinoid concentrations, contaminant levels and THC content can shift measurably from one production run to the next.
Batch-specific testing means every production run gets its own COA. The batch number printed on the bottle matches the batch number on the lab report. A buyer can trace any specific bottle back to its exact test results. That’s the standard EU Labs follows — every bottle carries a batch number linking to an independent COA covering the full cannabinoid panel and all contaminant screenings.
A universal COA — one report covering “all products” or an entire product line — is a red flag. It means the manufacturer tested once and applied those results across every future batch, regardless of variation. Some brands publish a single COA from their initial production run and never update it. The COA might be years old while the product on the shelf comes from an entirely different batch, harvest and extraction run. If a brand’s COA has no batch number or the batch number doesn’t match the product label, the test results cannot be linked to the specific bottle.
Red flags — when lab testing claims don’t hold up
The phrase “lab tested” appears on nearly every CBD product sold online. The difference between genuine third-party verification and a meaningless marketing line comes down to what a buyer can actually access and verify. These are the most common red flags.
No COA available. The brand claims lab testing but provides no certificate of analysis on its website or upon request. If the results exist, there’s no reason to hide them. No COA means no verification — full stop.
In-house testing only. The COA lists the manufacturer’s own facility as the testing lab, or the lab name matches the brand name. In-house results carry no independent verification. A third-party COA should name a separate, identifiable laboratory with its own ISO 17025 accreditation.
Missing panels. The COA reports cannabinoid potency but skips heavy metals, pesticides, solvents or microbial testing. A potency-only COA confirms CBD content but says nothing about product safety. All six panels — potency, heavy metals, pesticides, residual solvents, microbial and mycotoxins — should appear on a complete report.
Outdated results. The COA date is 12 months old or more while new batches ship continuously. Cannabinoid profiles degrade over time, and each new production batch introduces fresh variables. A current batch needs a current COA.
Batch number mismatch. The batch number on the bottle doesn’t match the batch number on the COA, or the COA has no batch number at all. Without a traceable link between the specific product and the specific test, the results are unverifiable.
Australian standards — TGO 93 and TGA requirements
Australia’s Therapeutic Goods Administration (TGA) sets quality requirements for medicinal cannabis products through Therapeutic Goods Order 93 (TGO 93). Every medicinal cannabis product supplied to Australian patients after 1 July 2023 must comply with TGO 93 quality standards. Non-compliant products risk being unsafe, incorrectly dosed or contaminated.
TGO 93 specifies maximum contaminant limits for plant-based cannabis materials. Heavy metals must fall within strict thresholds: lead at no more than 5.0 parts per million, arsenic at 3.0 ppm, cadmium at 0.5 ppm and mercury at 0.5 ppm. Aflatoxin B1 must not exceed 2 micrograms per kilogram. Cannabinoid assay limits require the actual content to fall within 80–120% of the stated amount for herbal forms and 90–110% for other dosage forms.
Domestic manufacturers must hold a TGA manufacturing licence demonstrating compliance with Australian Good Manufacturing Practice (GMP) principles. Imported products must come from facilities meeting equivalent GMP standards. The TGA requires sponsors to maintain evidence of GMP compliance valid at the time each batch was manufactured — not just at the time of initial registration.
For Australian buyers, TGO 93 sets the quality floor. A CBD oil that meets TGO 93 has passed heavy metal, pesticide, microbial and potency testing at levels the Australian regulator considers safe. A product that hasn’t been tested to TGO 93 standards offers no such assurance. The CBD oil legality overview explains how TGA scheduling works alongside these quality requirements.
How EU Labs handles testing
EU Labs sends every production batch to an independent third-party laboratory for testing before any product ships. The lab — not EU Labs — performs the analysis and issues the certificate of analysis. Each COA covers the full cannabinoid panel (CBD, THC, CBG, CBN, CBC and other minor cannabinoids), heavy metals, pesticides, residual solvents, microbial contamination and mycotoxins.
Every EU Labs bottle carries a batch number that links directly to the corresponding COA. The EU Labs CBD Oil 3000mg Full Spectrum delivering 60 mg/mL, the EU Labs CBD Oil 12000mg Full Spectrum at 240 mg/mL, and the EU Labs Broad Spectrum 3000mg — each product in the range follows the same batch-specific testing protocol. The CBD oil concentrations article explains what those mg/mL figures mean in practice.
EU Labs manufactures using supercritical CO₂ extraction, which eliminates residual solvent risk by design — carbon dioxide evaporates completely from the finished extract. All products use medium-chain triglyceride (MCT) coconut oil as the carrier. The full range, including CBG and CBN oils, is available in the Stillroot shop. For buyers comparing options, the guide to buying CBD oil online in Australia covers what to check during the purchasing process.
Frequently asked questions
What is a certificate of analysis for CBD oil?
A certificate of analysis (COA) is a document issued by a laboratory reporting the results of testing performed on a specific batch of CBD oil. A third-party COA comes from an independent lab with no financial relationship to the manufacturer. The report lists individual cannabinoid concentrations — CBD, THC, CBG, CBN and others — alongside contaminant screening results for heavy metals, pesticides, residual solvents, microbial impurities and mycotoxins.
What does ISO 17025 accreditation mean for a testing lab?
ISO/IEC 17025 is the international standard for testing and calibration laboratory competence. An accredited lab has demonstrated that its instruments are calibrated, its testing methods are validated and its results are reproducible. Regulatory authorities in most countries require ISO 17025 accreditation before accepting lab results as reliable. The accreditation number typically appears on the COA near the lab’s name and address.
How do I check if a CBD oil COA is genuine?
Verify the batch number on the COA matches the batch number on the product bottle. Confirm the lab named on the COA is an independent, identifiable laboratory — not the manufacturer’s own facility. Check that the COA covers all six panels: cannabinoid potency, heavy metals, pesticides, residual solvents, microbial contamination and mycotoxins. For common COA abbreviations like LOD, LOQ and ND, a guide to COA testing terms explains what each means.
Why is batch-specific testing important?
CBD oil quality varies between production batches because hemp harvests, extraction conditions and post-processing introduce variables with every run. A COA from one batch does not represent a different batch. Batch-specific testing means each production run receives its own independent COA, and the batch number on the bottle matches the batch number on the lab report — allowing any buyer to trace a specific product to its exact test results.
Does EU Labs publish COAs for every product?
EU Labs issues batch-specific certificates of analysis for every product in the range. Each EU Labs bottle carries a batch number linking to an independent lab report that covers cannabinoid potency, THC compliance, heavy metals, pesticides, residual solvents, microbial contamination and mycotoxins. The full spectrum vs broad spectrum article explains how COA results differ between the two product types.
These products have not been evaluated by the TGA. They are not intended to diagnose, treat, cure, or prevent any disease. You must be 18+ to purchase. Please consult a healthcare professional before use.
