If you’ve ever stared at a Certificate of Analysis (COA) and thought, “This looks official, so it must be safe”, you’re not alone. But when it comes to mycotoxins, the details matter more than the “Pass” stamp.
Mycotoxins are chemical toxins made by certain molds. The big names in cannabis testing are aflatoxins (B1, B2, G1, G2) and ochratoxin A (OTA). They can show up even when flower looks fine, and they don’t reliably disappear with heat, extraction, or “post-processing.”
This guide breaks down what cannabis mycotoxin testing should look like on a COA, how to spot red flags fast, and the moments when the safest move is to walk away.
Mycotoxins 101: what aflatoxin and ochratoxin really mean
Aflatoxins are most linked with Aspergillus molds. Ochratoxin A is commonly linked with Aspergillus and Penicillium. You don’t need to memorize mold species, but you should remember this: mycotoxins are chemicals, not live mold.
That’s why two products can look the same, smell the same, and burn the same, yet one has a clean COA and the other has a toxin problem.
Most regulated programs focus on:
- Aflatoxin B1, B2, G1, G2 (often also reported as Total aflatoxins)
- Ochratoxin A
States set their own rules. Many use action limits around 20 µg/kg (ppb) for these targets, but don’t assume. Look up your state’s current action limits and required analytes in primary guidance documents, like New Jersey’s CRC testing guidance (Feb 2025) and similar updates from other regulators.
For examples of how states publish lab expectations (sampling, reporting, pass/fail logic), see the New Jersey CRC Testing Guidance PDF and Vermont’s Laboratory Testing Action Limits and Parameters Guidance (Oct 2025).
How mycotoxins end up in cannabis (and why you can’t “fix” them later)
Think of cannabis like bread. Leave it warm and damp long enough, and something will grow. In cannabis, risk climbs with:
- High humidity during late flower
- Slow drying, uneven drying, or packed bins
- Long storage in warm rooms
- Poorly cleaned trimming and packaging areas
A key point for consumers and budtenders: killing mold isn’t the same as removing toxins. Some remediation steps may reduce viable microbes, but mycotoxins can remain.
Colorado’s regulator guidance on mycotoxin testing and acceptable analytical approaches is a helpful baseline for what “real testing” looks like (methods, confirmation expectations): Colorado Department of Public Health and Environment: mycotoxin testing.
People with higher risk include medical patients using cannabis daily, anyone with chronic lung issues, and immunocompromised consumers. This isn’t medical advice, but if immune function is reduced (transplant meds, chemo, advanced HIV, biologics, long-term steroids), treat COA review as non-negotiable and talk with a clinician about safer options.
What the COA should show for cannabis mycotoxin testing (minimum required details)
A COA is only as strong as its transparency. At a minimum, the mycotoxin section should show:
Analytes tested
- Aflatoxin B1, B2, G1, G2 (and sometimes Total aflatoxins)
- Ochratoxin A
Numbers that allow you to judge the result
- Result (a real value, or clearly “<LOQ”)
- Units (usually µg/kg, same as ppb)
- LOQ (limit of quantitation) and ideally LOD (limit of detection)
- Action limit used for pass/fail
Lab credibility signals
- The lab’s accreditation status (many jurisdictions expect ISO/IEC 17025)
- The test method (often LC-MS/MS or similar)
- Sample matrix (flower, concentrate, edible) and batch ID
- Sample date, report date, and any amendments
If you want to sanity-check accreditation language, start with an accreditor’s program page like A2LA’s Cannabis Testing Laboratory Accreditation Program. For a clear example of how a national lab describes ISO/IEC 17025 accreditation, see Health Canada’s Cannabis Laboratory.
Good vs bad COA entries (quick comparison)
| COA line item | Good entry | Bad entry (walk-away energy) |
|---|---|---|
| Result format | “Ochratoxin A: <LOQ” | “Ochratoxin A: ND” (no LOQ shown) |
| LOQ/LOD | LOQ and LOD listed per analyte | Missing LOQ/LOD or buried off-page |
| Units | “µg/kg (ppb)” | Units missing or inconsistent across analytes |
| Action limit | Listed next to analyte or in legend | Not shown, only “Pass” displayed |
| Method | “LC-MS/MS” (or validated method stated) | “In-house method” with no detail |
| Lab status | Accreditation stated with scope available | No accreditation mentioned, or expired |
For more background on why states often align around low ppb thresholds and why matrix effects matter, this explainer from Waters is useful context: Mycotoxin testing for cannabis and hemp.
COA red flags that should stop the sale (or your purchase)
These are the patterns that show up again and again in problem COAs:
“ND” with no LOQ: “Not detected” is meaningless without the level the lab can actually quantify. ND could mean “below LOQ,” or it could mean “we didn’t test correctly.”
Pass/fail without numbers: A real COA lets you see the result, the LOQ, and the limit.
Missing method or matrix: Mycotoxins are hard to measure in sticky, complex cannabis matrices. If the report doesn’t say what was tested (flower vs oil), trust drops fast.
Accreditation isn’t clear: If a lab claims ISO/IEC 17025 but provides no accreditor, no scope, or no ID, treat it as a marketing line until verified.
Retest games: If the COA shows a failed result, then a “retest pass” with no explanation of sampling, composite logic, or lot disposition, pause. A new sample can dodge a hotspot.
When to walk away: a practical decision guide
You don’t need to be a chemist. Use this simple approach:
Walk away immediately if:
- The COA shows Fail for any regulated mycotoxin
- The report lists no mycotoxin panel at all (in a market where it’s required)
- Results are shown as ND but LOQ is missing
- The lab can’t show credible accreditation, or the COA looks edited or incomplete
- Batch ID on the label doesn’t match the COA
Proceed with caution (ask questions) if:
- Results are “<LOQ,” but the LOQ is high and close to the action limit
- The COA is old, amended repeatedly, or missing sampling details
- The product is high-risk for storage issues (discount bins, old harvest, poor packaging seal)
For dispensary teams, it helps to keep one internal rule: if you can’t explain the mycotoxin results in two sentences, don’t stock it until you can.
Common misconceptions that keep people exposed
“Irradiation removes mycotoxins.” It may reduce microbes, but toxins can remain. Don’t accept remediation as proof of safety without a clean COA.
“You can see mold, so you’ll know.” Not reliably. Mycotoxins can be present without obvious visual mold.
“Extracts are always safer.” Not always. Concentration steps can also concentrate contaminants if input material was compromised. The COA for the finished product matters.
Harm-reduction tips (without pretending you can test at home)
If something feels off and the COA isn’t clean:
- Don’t try to “air it out” or mix it with other flower.
- Store cannabis cool and dry, and avoid humid jars that smell musty.
- If you’re immunocompromised, treat inhalation products as higher risk, and talk with a clinician about safer routes and sourcing.
If you manage a menu, consider keeping a short, staff-facing COA standard. Colorado’s mycotoxin methods page is a solid reference for what regulators expect labs to do: CDPHE mycotoxin testing.
Conclusion
A COA shouldn’t feel like a magic spell. It’s a document you can read, judge, and reject when it doesn’t hold up. The safest cannabis mycotoxin testing reports show the analytes, real numbers, LOQ/LOD, action limits, methods, and credible lab accreditation. When any of those pieces are missing, walking away isn’t being picky, it’s basic self-protection.