Hemp Testing Requirements: A Brand's Compliance Checklist

If you sell hemp or CBD products, your compliance story starts and ends with a lab report. Hemp testing requirements are not a single rulebook you can memorize once and forget. They shift by state, by product type, and as of late 2025 they are about to shift at the federal level too. This checklist gives you a practical way to work through what you actually need to test, how often, and how to prove it to a customer, a processor, or a marketplace reviewer.

The short version: test every batch on a full panel at an accredited lab, keep the current Certificate of Analysis (COA) tied to the product it covers, and re-test whenever the inputs change. The rest of this post unpacks each of those and ends with a numbered checklist you can run against your own catalog.

Full-panel testing vs potency-only

Potency-only testing tells you one thing: how much of each cannabinoid is in the sample (THC, CBD, CBG, CBN, and often terpenes). That number matters for labeling and for staying under the THC limit, but it is a fraction of what a buyer needs to trust your product.

A full-panel COA adds the safety analytes:

• Heavy metals, specifically lead, arsenic, cadmium, and mercury. Hemp is a hyperaccumulator, meaning it pulls metals out of the soil into the plant, so this is not optional diligence.
• Pesticides, which can concentrate during extraction.
• Microbials: yeast and mold, E. coli, Salmonella.
• Residual solvents left over from extraction.
• Mycotoxins, plus moisture / water activity and foreign matter.

If you are deciding between the two, the practical answer for most retail hemp is full panel. Potency-only is fine for an in-process check during R&D, but a potency-only document published as your product's proof of safety is a weak position. Many states require the full panel for finished retail goods anyway, and so do the larger marketplaces. For a field-by-field breakdown of each analyte and why it appears, see what a hemp COA actually tests for.

Batch and lot testing: every production run

This is the requirement brands most often get wrong. A COA describes one batch. It does not describe your product line, your brand, or next month's run from a new harvest.

Every production run is chemically distinct. Different biomass, a different extraction lot, a different blend ratio: any of these can move your potency or introduce a contaminant the previous batch did not have. So the rule is simple to state and easy to skip: test each batch, assign it a lot number, and keep that COA linked to the units it came from.

That linkage is where most compliance gaps open. A brand will test diligently, then publish one PDF on a generic product page while three different batches sit in the warehouse. When a customer scans a package or a reviewer asks for proof, the document on screen does not match the lot in hand. Batch-level COAs are worth their own deep dive, and we cover the mechanics in the hemp testing compliance guide.

Using ISO/IEC 17025 accredited labs

Not all labs produce equally defensible results. ISO/IEC 17025 is the international standard for the competence of testing and calibration laboratories. A lab that holds it has shown that its methods are valid, its instruments are calibrated, and its results are reproducible.

Why you should insist on it:

• Marketplaces and many processors reject COAs from non-accredited labs outright.
• Some state programs require accreditation for the testing that supports retail sale.
• An accredited COA shows the method used per analyte (for example, HPLC for cannabinoid potency, ICP-MS for heavy metals), the LOD and LOQ (the detection and quantitation limits), the batch or lot number, and a pass or fail per analyte.

When you receive a COA, check that it actually names the lab's accreditation, lists methods, and shows pass/fail lines. A document that only shows a few numbers with no methods or limits is a red flag, regardless of how official the letterhead looks. If you are weighing where to send samples, the tradeoffs between third-party and in-house lab testing are worth reading before you commit.

The total-THC rule: the federal floor is changing

Here is the single most important current fact for hemp compliance testing.

The 2018 Farm Bill defined hemp as Cannabis sativa L. with no more than 0.3% delta-9 THC on a dry-weight basis. Because only delta-9 was capped, an industry of intoxicating isomers (delta-8 and others) grew in the gap.

That changes. H.R. 5371 was enacted on November 12, 2025. It redefines hemp using total THC: not more than 0.3% on a dry-weight basis, where total THC counts delta-9 and other THC isomers, not delta-9 alone. It also excludes from "hemp" any finished product with more than 0.4 mg of total THC and similar cannabinoids per container.

The effective date is November 12, 2026, 365 days after enactment. It is law now but not yet in force, which is exactly why brands are searching for guidance.

What this means for your testing plan:

• Expect to re-test against total THC, not just delta-9.
• Update your COAs so they report total THC clearly.
• Possibly reformulate to fit the 0.4 mg per container limit on finished goods.
• Be ready to show the current batch COA to customers, processors, and marketplaces.

This is the federal floor, not the ceiling. We walk through the math and the migration in cannabinoid compliance and the total-THC rule for 2026.

Requirements vary by state and product type

There is no single national hemp testing rulebook, and treating the federal definition as the whole picture is how brands get blindsided. The federal definition is the floor. On top of it, states set their own required panels, action limits, sampling rules, and labeling requirements, and those rules often differ by product type within the same state.

A few concrete ways this plays out:

Build your testing plan against the strictest jurisdiction you sell into, not the most lenient. It is cheaper to over-test one panel than to pull a product after a complaint. If you sell on Shopify, the operational side of staying compliant on the storefront is covered in CBD compliance for Shopify stores.

Retest triggers: when a new COA is required

A COA is a snapshot, and several events invalidate the snapshot. Re-test when any of these happen:

• New batch or harvest. Covered above, and the most common trigger.
• New supplier or raw material source. Different biomass carries a different contaminant profile.
• Formula or formulation change. A new blend ratio, carrier oil, or added ingredient changes the chemistry.
• Contamination concern. A failed result, a recall in your supply chain, or a customer complaint warrants a fresh test.
• Regulatory change. The total-THC rule is itself a re-test trigger for product you intend to keep selling past the effective date.

If you are unsure whether a change counts, default to testing. The cost of a panel is small next to the cost of selling a product you cannot back with a current document.

The hemp testing compliance checklist

Work through this against each product line in your catalog.

1. Confirm your product type and state(s). List every state you ship to and the strictest panel and limits among them.
2. Choose an ISO/IEC 17025 accredited lab. Verify the accreditation is current and covers the methods you need.
3. Order a full panel, not potency-only. Potency plus heavy metals, pesticides, microbials, residual solvents, mycotoxins, moisture/water activity, and foreign matter.
4. Test every production run. Assign a unique lot number to each batch and tie the COA to it.
5. Check that total THC is reported. Ahead of the November 12, 2026 effective date, make sure your COAs show total THC and your finished products fit the 0.4 mg per container limit.
6. Read the COA before you publish it. Confirm it shows methods, LOD/LOQ, batch/lot, and a pass/fail per analyte.
7. Match the published COA to the lot on the shelf. The document a customer sees must describe the exact units they can buy.
8. Set your retest triggers. New batch, new supplier, formula change, contamination concern, or a regulatory change like the total-THC rule.
9. Make the current COA easy to find. Publish it on the product page and give customers a way to look it up by product, batch, or lot.
10. Re-audit on a schedule. Requirements move; revisit this list when you add a SKU, enter a new state, or a rule changes.

Steps 7 and 9 are where publishing tooling earns its keep. LabLinks is built for exactly this: upload a COA as a PDF or image, enter the batch/lot number, test date, lab name, and status, then link it to the matching Shopify product so a lab-tested badge and an on-page viewer appear automatically. Each store also gets a searchable portal so a customer can find the right report by product, batch, or lot, and QR codes connect packaging to the correct COA. The step-by-step setup lives in our guide to adding COAs to Shopify product pages, and the first five reports are free.