Batch-Level COAs: Why One PDF Link Is Not Enough

A Certificate of Analysis is not a property of your product. It is a property of one production run. A batch COA reports what a lab measured in the specific lot it received: the potency, the heavy metals, the microbials, the pesticides, all tied to a batch number and a test date. Ship a new batch and that document no longer describes what is in the bottle a customer is holding. This is the gap a single PDF link in a product description quietly creates, and it gets worse as your catalog grows.

A batch is one run, and a lot is one slice of it

A batch is the quantity of product made in a single, controlled production run: one extraction, one blend, one fill. A lot is a more granular identifier within or across batches, often used to mark a specific packaging run or a sub-portion that can be traced on its own. In practice many hemp brands use the terms loosely, and the COA itself will name whichever the lab tested. What matters is that both point at a defined quantity of material, not at the product line in the abstract.

That is why a reputable lab puts a batch or lot number on the report alongside the test date, the methods, and the LOD/LOQ. The numbers on the COA, 14.2% CBD, 0.21% total THC, lead at 0.3 ppm, are true for that material. The next run uses different biomass, a different extraction window, sometimes a different supplier of crude. Hemp is a hyperaccumulator, so soil and growing conditions move heavy metal results between harvests. Potency drifts batch to batch even when the recipe is identical. Lot testing exists precisely because each run has to be measured on its own terms.

So a COA answers a narrow question: what was in this specific lot when the lab tested it. It does not certify the product forever, and it does not describe the bottle on a shelf that came from a later run.

The failure mode of a single static PDF link

Most hemp and CBD merchants start the same way. You get a COA back from the lab, you upload the PDF to your media library or a Drive folder, and you paste the link into the product description. Done. Except it is the most fragile setup possible, and it fails in three predictable ways.

It goes stale the moment a new batch ships. The product page still links to the COA for batch A while you are now fulfilling orders from batch B. The link works, the PDF opens, everything looks fine, and the document is simply wrong for what you are sending. Nobody gets an error. That is what makes it dangerous.

The customer cannot tell which batch they have. Someone holding a jar reads a batch number on the label, opens your product page, and sees one PDF with a different batch number on it. Now they have a reason to doubt you. They cannot confirm that the report matches the product in their hand, which is the entire point of publishing a COA in the first place.

It invites mislabeling and expired-report risk. A static link has no concept of a test date or an expiration. Potency reports age, retest cycles come due, and a year-old COA sitting in a product description gives no signal that it is out of date. Swap the PDF at the same URL and the old version may still be cached or screenshotted somewhere. Forget to swap it and you are publishing a report that no longer represents current inventory. Either way you are one screenshot away from a customer or a marketplace asking why the document does not match the goods.

A single link treats the COA as permanent. The COA is not permanent. That mismatch is the whole problem.

Why this gets harder under the total THC rule

This was already a maintenance headache. The change in the federal hemp definition turns it into a catalog-wide one.

H.R. 5371 was enacted on November 12, 2025 and redefines hemp using total THC: no more than 0.3% on a dry-weight basis, where total THC counts delta-9 plus other THC isomers, not delta-9 alone. It also excludes from "hemp" any finished product with more than 0.4 mg of total THC and similar cannabinoids per container. The effective date is November 12, 2026, so it is law now but not yet in force. That one-year window is exactly when brands are re-testing and reissuing reports.

Practically, that means new COAs across much of your catalog. Many products that passed under a delta-9-only reading need to be re-tested against total THC. Some may need reformulation to fit the 0.4 mg per container limit. Each re-test produces a new report with a new test date, and your storefront has to show the current one, not the version you pasted in last year. If your COA system is a pile of static links, you are now hand-editing dozens of product descriptions and hoping you do not miss one. A change that should be a routine re-test becomes an error-prone migration. The total THC transition is covered in more depth in the hemp and CBD lab testing compliance guide, which is worth reading alongside this if you are mapping out re-tests.

What a batch-level system actually needs

Treating COAs as batch records rather than as a single attachment requires a few specific things. None of them are exotic, but a folder of PDFs and a pasted link delivers none of them.

• Every report tied to product, batch, lot, and test date. The COA has to be a record with structured fields, not just a file. You should be able to look at any report and know which product it belongs to, which batch and lot it covers, when it was tested, and which lab ran it.
• A way for a customer holding a package to look up their batch. The person with the jar reads a batch number off the label and needs to find the matching report, not your most recent upload. That means a lookup keyed on batch and lot, searchable from the package in hand.
• A QR code that resolves to the right batch COA. A QR printed on packaging is only useful if it lands on the report for that production run. A code that points at a generic "lab results" page forces the customer to search again, and a code hard-wired to one PDF breaks as soon as that package ships with a newer batch. The link has to resolve per report.
• Current batches surfaced automatically on the storefront. When you publish a new batch, the product page should reflect it without you editing HTML. The storefront should follow the data, so adding a report is the only step.

The table below is the difference in one view.

The pattern under all of this: the unit of record is the report, and the report carries its own batch, lot, and date. Everything else, the product page badge, the QR code, the customer lookup, points at that record instead of at a file path.

How LabLinks handles batch-level COAs

LabLinks is built around the report as the unit, which is what makes the above practical on a Shopify store without custom development.

You upload a COA, PDF or image, and enter the batch and lot number, the test date, the lab name, a pass or pending status, and any custom fields your industry needs. You link that report to a Shopify product. A theme app block shows a lab-tested badge on the product page that opens the report in an on-page popup viewer, so the current batch is always the one a shopper sees. Publish a new batch and the storefront updates on its own. There is no product description to re-edit, which is the step that breaks under the total THC re-test wave. Wiring the badge into a product page is covered in adding COAs to Shopify product pages.

Every store gets a searchable portal where a customer can look up a report by product, batch, or lot. That is the lookup a person holding a package actually needs: they read the batch number off the label and find the report for that run, not your latest upload. And LabLinks generates a QR code per report, so a code printed on packaging resolves to the specific batch COA rather than a generic results page. The mechanics of putting those codes on labels are in the guide on COA QR codes for product packaging.

Whether the report itself is trustworthy is a separate question worth getting right. How to read a CBD COA walks through the fields, whether you need a COA to sell CBD on Shopify covers the obligation, and third-party versus in-house lab testing explains why the source of the report matters. A batch-level system makes a good COA usable. It cannot make a bad one good.

The test to run on your own store is simple. Pull a product, read the batch number a customer would see on the package, and ask whether your storefront can show them the matching report. If the answer is "it shows the last PDF I uploaded," you have a static link pretending to be a batch record, and the next batch is when it breaks.