How Cannabis Is Tested in the US: State Lab Limits Compared

Cannabis is still federally illegal, so the FDA and USDA do not set its safety limits. Each state writes its own. The result is a patchwork: the same pre-roll can pass in one state and fail across the border.

This explainer covers what a compliance lab actually does to a sample, compares the published limits in seven states, and shows where the checks break down. If you want to read the report itself, start with our line-by-line COA guide.

What happens to a batch before it reaches the shelf

A sample is pulled from a finished batch, sent to a licensed lab, and the batch cannot be sold until the lab reports a pass.

1. Sampling
   A lab employee or, in New York, a separately licensed sampling firm collects a representative sample from the batch and records it in the state's seed-to-sale system.
2. Potency
   The lab measures cannabinoids, usually by HPLC. California has required one standardized cannabinoid method for flower and pre-rolls since January 1, 2024.
3. Safety panel
   Pesticides, heavy metals, microbes, mycotoxins, residual solvents (for extracts), water activity and moisture, plus foreign material.
4. Certificate of analysis
   Results are reported per analyte with a pass or fail. A failed batch cannot be released for retail sale; states differ on whether it can be remediated and retested.

Potency: what the THC number is allowed to miss by

Potency is a label-accuracy check, not a safety test, and each state sets a tolerance.

California's rule (4 CCR 15307.1) treats a THC or CBD claim as accurate if the certificate of analysis is within plus or minus 10.0% of the label. New York's testing-limits document sets a labeled-potency variance of 90–110% for medical cannabis and 85–115% for adult-use products. Colorado uses a 15% band for retail edibles to qualify for reduced testing.

Labs report total THC as THCA converted with a factor plus delta-9 THC. Our guide on whether THC percentage matters explains why the number is a weak guide to effect.

Action limits in seven states

For inhaled products, most states copy the pharmacopeia-style limits of 0.2 µg/g arsenic and cadmium, 0.5 µg/g lead and 0.1 µg/g mercury; Washington and Michigan's flower limits are looser.

Sources: state rules and regulator documents listed below, checked September 2026. *Michigan figures come from a search summary of the CRA technical guidance, which blocked direct download; treat them as provisional. "State list" means the state publishes a pesticide list we did not count.

What the numbers mean in practice

• Lead: a Washington flower testing 1.0 µg/g passes; the same flower fails in California, Colorado, New York and Oregon.
• Arsenic: Washington's 2.0 µg/g is ten times the 0.2 µg/g limit for inhaled products in Colorado and New York.
• Water activity: 0.65 aw is the shared line because mold growth becomes likely above it.
• Extra metals: New York also caps nickel at 5.00 µg/g for adult-use flower and pre-rolls, and chromium and copper.

Microbes, mycotoxins and solvents

Pathogen tests are usually presence/absence: any detection in the tested gram fails the batch.

Pathogens most states screen

Salmonella, STEC E. coli, Aspergillus (fumigatus, flavus, niger, terreus)

Colorado yeast and mold

< 10,000 CFU/g

Washington mycotoxins

Aflatoxins 20 µg/kg; ochratoxin A 20 µg/kg

Colorado solvents

Butane, propane, ethanol < 1,000 ppm; toluene < 180 ppm; hexane < 60 ppm

Aspergillus matters most for inhaled products, because spores go straight to the lungs. California lists four species; a detection of any of them fails the sample.

Where testing fails

The published limits are rarely the weak point; the weak points are who picks the lab, who pulls the sample, and whether regulators check the results.

• Lab shopping. Producers pay the lab and can choose it. Massachusetts ordered, from April 1, 2025, that each test sample go to a single lab, saying the change would help it enforce against lab shopping. Our investigation of THC inflation covers the evidence.
• Label drift. A 2025 study in Scientific Reports bought 277 Colorado products: 96% of concentrates but only 56.7% of flower were within ±15% of the label.
• Lab misconduct. California revoked the licenses of four labs between December 2023 and July 2024, each involved in inflating THC potency. Michigan recalled about 64,000 pounds of product tested by Viridis Laboratories in November 2021.
• Reporting gaps. A Massachusetts State Auditor audit covering 2019 and 2020 found that the Cannabis Control Commission did not ensure that businesses and labs properly reported products that tested positive for pesticides.
• Uneven limits. Washington's looser metal limits and optional heavy-metal testing for non-medical products mean "passed" does not mean the same thing everywhere.

Limits of this data

We compared inhaled-product limits because flower and vapes are what most buyers purchase; edible and topical limits are higher in most states. Rules change often: California adopted new pesticide action levels (rulemaking DCC-2025-03-R, approved July 27, 2026) that take effect October 1, 2026, and New York revised its testing limits on February 9, 2026.

We did not count every state's pesticide list, and Michigan's numbers are from a secondary summary. Always check the regulator's current document before relying on a number, and confirm the seller is licensed with our license check guide.