Certificate of Conformance vs. Certificate of Analysis: What Hemp Ingredient Buyers Need to Know

Two Documents, Two Very Different Levels of Assurance

In B2B hemp ingredient sourcing, two documents are commonly referenced as evidence of product quality and compliance: the Certificate of Analysis (COA) and the Certificate of Conformance (CoC). These are not interchangeable. They serve different functions, carry different levels of evidentiary weight, and have very different implications for a buyer's regulatory compliance posture.

Understanding the distinction is increasingly important as the November 12, 2026 federal compliance deadline approaches and buyers need to be certain that their documentation package actually demonstrates what it claims to demonstrate.

What a Certificate of Analysis (COA) Is

A Certificate of Analysis is a document issued by a testing laboratory that reports the actual results of analytical testing performed on a specific lot or batch of product. A COA includes:

• The name and accreditation status of the testing laboratory
• The specific lot or batch number of the sample tested
• The date of sample collection and testing
• The analytical methods used (e.g., HPLC for cannabinoids, GC-MS for terpenes, ICP-MS for heavy metals)
• The actual measured values for each analyte tested
• The laboratory's detection limits and reporting limits
• The signature or authorization of a qualified laboratory professional

For hemp ingredients, a compliant COA from an ISO 17025-accredited, DEA-registered laboratory that shows total THC (delta-9 THC + THCA × 0.877) at or below the federal limit is primary compliance documentation. It reflects actual laboratory measurement — not a supplier's claim about what the measurement would show.

What a Certificate of Conformance (CoC) Is

A Certificate of Conformance is a document issued by the supplier (not a laboratory) attesting that a product meets specified requirements. A CoC typically includes:

• The supplier's name and contact information
• A description of the product and lot number
• A statement that the product conforms to specified standards or specifications
• A reference to relevant testing, standards, or specifications that have been applied
• The signature of a supplier representative

Critically, a CoC is a supplier's declaration — it is not a laboratory result. It may reference laboratory testing that was performed, but it does not reproduce that testing data. It is a statement of conformity, not a demonstration of conformity.

Why the Distinction Matters for Hemp Compliance

In a market with significant fraud, adulteration, and mislabeling risk — risks that the ProPublica reporting on Colorado's hemp market made vivid in May 2026 — the difference between a supplier's declaration and actual laboratory data is not a semantic distinction. It is a due diligence gap that could have serious regulatory consequences.

A CoC without an accompanying COA is not sufficient for hemp compliance documentation. Under the 2024 Farm Bill's framework, the standard of compliance is demonstrated through testing conducted by ISO 17025-accredited, DEA-registered laboratories. A supplier's attestation that their product meets this standard is not a substitute for laboratory data showing that it actually does.

A CoC can supplement but not replace a COA. In some supply chain contexts, a CoC is used alongside a COA as a confirmation that the specific lot shipped matches the lot tested. This is a legitimate use of the document. But the CoC only adds value in this context if the underlying COA is current, lot-specific, and from an accredited laboratory.

A CoC is not auditable in the same way a COA is. If a regulatory body, customer, or insurer asks for compliance documentation, a CoC backed only by general reference to testing procedures will not satisfy the audit. A COA with specific lot numbers, dates, analytical results, and laboratory accreditation information provides a verifiable evidentiary record.

Common Misuses of These Documents in Hemp Supply Chains

Supplying a CoC without a COA. Some suppliers provide Certificates of Conformance as the primary compliance document, with either no COA or only a reference to historical or representative testing. This is a red flag. A CoC tells you the supplier believes their product is compliant. A COA tells you what the testing data actually shows.

Using a COA from a non-accredited or non-DEA-registered lab. A COA from a laboratory that lacks ISO 17025 accreditation or DEA registration does not meet the evidentiary standard the 2024 Farm Bill contemplates. The accreditation requirement exists to ensure laboratory methodology, equipment, and quality control meet rigorous standards. A COA from an unaccredited lab is a document — but not a compliant document.

Using a COA that tests delta-9 THC only. A COA that reports delta-9 THC within limits but does not include THCA is incomplete for total THC compliance purposes. Total THC = delta-9 THC + (THCA × 0.877). An ingredient with 0.2% delta-9 THC and 1.0% THCA would show a compliant delta-9 result while carrying a total THC value far above the legal limit.

Sharing a COA from a different lot. COA data is lot-specific. A COA from a previous production batch is informative for understanding the supplier's typical product characteristics, but it does not demonstrate compliance of the current lot being purchased.

What a Complete Hemp Ingredient Documentation Package Looks Like

For a single ingredient purchase, B2B buyers should collect and retain:

1. Lot-specific COA from ISO 17025-accredited, DEA-registered laboratory showing full cannabinoid panel including total THC calculation
2. Pesticide residue panel from the same or equivalent accredited laboratory
3. Heavy metals panel (lead, arsenic, cadmium, mercury at minimum)
4. Residual solvents panel (if applicable to the extraction method)
5. Microbial testing results (total aerobic count, yeast, mold, pathogens)
6. Certificate of Conformance from the supplier confirming the lot shipped matches the lot tested (as a cross-reference, not a primary compliance document)
7. Chain of custody documentation connecting harvest/cultivation batch to the tested lot

This package provides both regulatory compliance evidence and a basis for defending ingredient choices in any audit, dispute, or liability claim.

The Supplier Vetting Implication

Suppliers who offer only a CoC without readily providing lot-specific COAs from accredited laboratories are signaling one of two things: either they don't have the documentation, or they believe a CoC is equivalent — and both signals should prompt additional scrutiny before committing to a sourcing relationship.

In the current regulatory environment, where state enforcement actions and federal compliance deadlines are creating real legal and financial risk for non-compliant ingredient buyers, documentation quality is not a back-office detail. It is a core component of supplier qualification.