How to Match a Cannabis COA to the Package in Your Hand

You scan the QR code on a cannabis package. A polished laboratory report opens. The product name looks right, the potency looks believable, and every safety panel says Pass.

There is still one question to answer before that report means anything:

Was this certificate of analysis issued for the product in your hand?

A COA describes a sample from one batch or lot. It is not a permanent certificate for a brand or strain name. If the package and report identifiers do not match, you have evidence about some product—not necessarily yours.

This guide shows you how to make that match in a few minutes, which discrepancies matter, and when to stop and ask for help. If you first need a tour of potency, terpene, pesticide, microbial, and solvent panels, begin with our complete guide to reading cannabis lab results. Here, we are solving the identity problem.

The short version: match identity before reading results

Put the unopened package next to the full COA and compare these fields:

If the batch or lot does not match, stop. Do not average the numbers, accept a close-looking code, or let the product name overrule the identifier.

Batch, lot, UID, and sample ID are not interchangeable

Cannabis labels may carry identifiers from different stages in the supply chain. Their names vary by state and product type, so read the field labels—not just the shape of the code.

Batch or lot number

This groups material made or harvested under defined conditions. Flower may use a harvest batch; edibles, vapes, and concentrates may use a production batch or process lot. It is usually the best consumer-facing bridge between package and COA.

California’s current regulations are unusually direct: when cannabis or cannabis products were packaged at sampling, the labeled batch number must match the batch number on the COA. The state’s representative-sampling checklist also tells distributors to confirm that the COA corresponds to the correct batch before goods reach retail.

UID or package ID

A unique identifier follows inventory through a regulated track-and-trace system. In California you may see a long Metrc UID. A UID can be more specific than a batch number, but not every consumer-facing COA displays it.

Do not assume every long code is a UID. A retail SKU, universal product code, order number, or QR payload may identify a catalog item rather than the tested inventory. Look for explicit labels such as UID, package ID, or Metrc tag.

Laboratory sample ID

The lab creates its own sample or accession number. It identifies material inside the laboratory workflow, and your package normally will not carry it. New York’s consumer COA guide, for example, distinguishes the batch/sample ID from the lot unique identifier used for product history and recalls. A webpage repeating its own sample ID is not an independent match; you still need a bridge to the package.

Product name and strain name

These are supporting clues, not primary keys. Two batches of Blue Dream can have different potency, terpene profiles, dates, and contaminant results. A producer may also reuse a flavor name across several runs. That is why strain names cannot replace chemistry, and they cannot replace traceability either.

How to match a COA to your package, step by step

Keep the package closed until you finish so labels remain intact if you need to return it.

1. Find the package’s strongest identifier. Photograph each label panel. Look for Batch, Lot, Production Batch, Harvest Lot, UID, or Package ID, including under peel-back labels.
2. Open the complete report. Scan the QR code, then look for a PDF or full-results option. A branded summary page with three green checkmarks is not the COA.
3. Verify where the link landed. Prefer the lab’s domain or a brand portal with the complete signed report. If the QR code is broken, ask the licensed retailer for the COA.
4. Match the batch or lot character for character. Compare letters, digits, hyphens, and leading zeroes. A24-081 and A24-018 are different. So are LOT7 and LOT7-R unless the producer documents the relationship.
5. Match a second identifier when available. Confirm the UID/package ID or, if omitted, the producer, product form, unit count, and description.
6. Check the date sequence. Collection cannot precede production of the tested batch. Testing should precede sale. Packaging after testing may be legitimate for bulk-tested flower, but rules vary.
7. Verify the laboratory. Confirm its name and license through your regulator. California requires ISO/IEC 17025 accreditation and COA uploads to track and trace; its testing-laboratory overview explains the process.
8. Only now read the results. Review pass/fail status, potency units, reporting limits, and required contaminant panels. Use our THC label math guide if THCA, delta-9 THC, and total THC are confusing.

When a label is crowded, use the TIWIH label scanner to organize the visible chemistry, then compare its transcription against the package itself. A scan can reduce typing; it cannot authenticate an unmatched COA or turn missing information into evidence.

A decision table for common mismatches

One nuance: a batch match is necessary, not magical. It does not prove that the sample represented every unit, the PDF is unaltered, every possible contaminant was tested, or storage left the product unchanged.

Why a perfect match still has limits

Flower is biologically variable. A laboratory measures a representative sample, not every bud in every jar. Sampling, homogenization, storage, analytical methods, and ordinary measurement uncertainty can all affect the relationship between one test portion and your unit.

A 2025 study independently tested 277 products from 52 Colorado dispensaries. Using a ±15% accuracy threshold, 96.0% of concentrates but 56.7% of flower products matched labeled THC. The authors noted that flower is less homogeneous and more sensitive to sampling differences [Giordano et al., 2025]. This does not show that most COAs are fake. It shows why a match cannot promise that every bud has an identical number.

An earlier Colorado study retested 23 flower products. Observed THC averaged 23.1% below the labels’ lowest values; about 70% fell more than 15% below label claims [Schwabe et al., 2023]. The sample was small, and the cause was unclear. The result argues against treating a percentage as exact—not against testing altogether.

For more context, read why cannabis testing standards can fail consumers and our analysis of why dispensary labels are often wrong. The practical hierarchy is:

1. A matched, regulatorily compliant COA is better evidence than an unmatched report.
2. A COA with complete identity and safety panels is better than a potency-only summary.
3. A COA remains a batch-level measurement with uncertainty, not a personal-effects guarantee.

Use the identifier to check recalls, too

Batch identity matters after purchase. Regulators recall specific products and lots rather than every item sharing a brand name.

California’s cannabis recall portal publishes affected products and tells consumers to check package UIDs and batch numbers. Washington’s recall notices likewise list affected products with lot or inventory identifiers. Search your own regulator’s current recall page; rules and databases vary by jurisdiction.

If your identifier matches a recall, follow the regulator’s disposal or return instructions. Do not consume the product simply because its original COA says Pass. A recall may reflect new testing, mislabeling, a later investigation, or a problem discovered after release.

Keep the package, receipt, COA link, and photos until the product is finished. That record gives a retailer, regulator, or clinician more useful information than a strain name alone.

Turn a verified batch into useful personal data

Once identity checks out, the COA becomes a dated chemistry snapshot you can use.

• Scan: Capture the package with the label scanner, then correct any misread digits.
• Compare: Use the strain comparison tool, terpene guide, and High Families to put the chemistry in context.
• Save: Use the High IQ app to save the batch, dose, timing, and experience. Our cannabis journal guide explains why notes beat memory.

This is the pivot from shopping by hype to learning from evidence: package identity → batch chemistry → your response. A COA cannot predict your experience perfectly, but a matched COA gives your notes a much stronger starting point.

Common mistakes to avoid

• Matching only the strain name. Names are reused across producers and batches.
• Confusing sample ID with batch ID. The first identifies work inside the lab; the second ties testing to production.
• Trusting the QR destination automatically. A code is a link, not authentication.
• Assuming rules are national. Adult-use cannabis is state-regulated, and hemp may use another framework. Oregon, for example, describes a hemp-label workflow for locating a batch-specific COA.
• Treating “Pass” as “risk-free.” Panels, limits, storage, and responses still matter. See our counterfeit vape-cart guide for a category where identity deserves extra caution.

FAQs

What if the package says “lot” but the COA says “batch”?

The words can vary. Compare the actual identifiers and the rest of the product information. If the same code appears in both places and the producer, product form, and dates agree, it may be the intended bridge. If the codes differ, ask the retailer or producer rather than assuming lot and batch are nested.

Is a QR code legally required on every cannabis package?

No national rule covers every state-regulated product, and hemp rules differ. Some markets require a QR code or web address; others make results available through retailers. Check your regulator’s current guidance.

What if the COA has no batch number?

Look for a source batch, production batch, harvest lot, or UID elsewhere on the report. If no field ties the report to the package, treat it as unverifiable for your unit and request the complete report.

Should I return a product when the batch numbers do not match?

Do not rely on the mismatched COA. Keep the product sealed, document both identifiers, and ask the licensed retailer for the correct report and its return policy. If the product may be recalled, follow your regulator’s instructions.

Key takeaways: the Professor High checklist

Before you trust a cannabis COA, answer five questions:

1. Does the batch or lot match exactly?
2. Does a second identifier or the full product description agree?
3. Do collection, testing, packaging, and sale dates make sense?
4. Is the lab legitimate and the report complete?
5. Is the batch absent from current recall notices?

Five yeses do not create certainty. They create something more useful than marketing: a traceable reason to believe the report belongs to the product in your hand.

Sources

1. Giordano G, Brook CP, Ortiz Torres M, MacDonald G, Skrzynski CJ, Lisano JK, Mackie DI, Bidwell LC. (2025). Accuracy of labeled THC potency across flower and concentrate cannabis products. Scientific Reports, 15, 20822. doi:10.1038/s41598-025-03854-3
2. Schwabe AL, Johnson V, Harrelson J, McGlaughlin ME. (2023). Uncomfortably high: Testing reveals inflated THC potency on retail Cannabis labels. PLOS ONE, 18(4), e0282396. doi:10.1371/journal.pone.0282396
3. California Department of Cannabis Control. Testing laboratories and Medicinal and Adult-Use Cannabis Regulations, revised January 1, 2026.
4. California Department of Cannabis Control. Representative sampling checklist for distributors and Cannabis recalls and safety notices.
5. Oregon Liquor and Cannabis Commission. Hemp Registry Guide.
6. New York Office of Cannabis Management. How to Read a Lab Certificate of Analysis for Your Cannabis Product.
7. Washington State Liquor and Cannabis Board. Reading a Product Label and Notice of Cannabis Recalls.