Will Colorado's Testing Rules Be the Downfall of Its Cannabis Industry?

By Scott Holden · Founder & CEO, Lab Effects · Golden, CO

Cannabis Course Correction · October 2026

Before any cannabis product reaches a Colorado shelf, a licensed laboratory measures it and reports a number. If the number lands under the legal limit, the batch is sold. If it lands over, the batch is treated, retested, or destroyed. No other document in this industry moves as much money, inventory, or public safety as that one number.

Most people assume the number is exact. It is not. Every laboratory measurement carries error. In cannabis, that error is large, loosely controlled, and almost never discussed in public. Labs know it. Regulators know it. Growers and manufacturers learn it the expensive way, one failed batch at a time. Consumers rarely hear about it at all.

This piece puts that problem on the record, with numbers. The argument is simple. Colorado treats one lab reading as final truth. Its rules ask very little of the instruments and habits that produce that reading. And when the reading is wrong, the lab keeps its fee while the licensee, the retailer, and the consumer absorb the damage. Together, those three facts create problems that no licensee can solve on its own, because nobody can comply their way past a measurement they cannot trust.

Colorado's regulated marijuana market is the case study here, because its rules and records are public enough to examine in detail. The problem does not stop there. Hemp and CBD businesses rely on the same instruments and the same kinds of labs, under a different patchwork of rules written by state health departments, by every other state, and even by private payment processors. Each rule-maker sets its own requirements, few of them rest on published science, and businesses spend their time jumping from one set of demands to the next.

What this piece covers

The stakes. What a false fail and a false pass each cost, who pays, and why a licensee has no real way to challenge a result.

The machinery. How few labs serve the market, how hard those instruments are working, and what happens inside them over a long day of cannabis samples.

The rules. What Colorado actually requires of a lab, compared with other cannabis states and with the labs that test water, blood, drugs, and food.

The evidence. Studies showing that labs report different answers for the same sample, the largest lab sanction on Colorado's public record, and limits set without published science.

The theater. How rules written by different agencies, and even by payment processors, contradict one another, and how the certificate of analysis became a sales prop that consumers are trained to demand but cannot read.

The fix. What we think, our proposed course corrections, and what licensees can do now.

By the numbers

What a wrong number costs

Testing costs a business twice. First it pays for the tests themselves, which add up far faster than most outsiders realize. Then it carries the risk that a result is wrong, which can cost far more than the tests. The lab shares in neither cost.

Start with the tests. Labs in other states that publish prices charge roughly $550 to $965 for a full compliance panel, and up to $1,350 for concentrates [1, 2]. The one Colorado figure on the record is $120 for a pesticide test alone, the price Nordic Analytical Laboratories quoted in 2018 [3]. That fee is rarely paid once. A manufacturer typically tests each batch of raw material, then tests potency and microbials again on every finished product, or runs the full panel on every finished product. In hemp private-label manufacturing, which largely serves small and midsize brands, production runs are small. Few customers order 10,000 units on a first order, and many never will. Spread across a small run, testing becomes a significant share of the cost of every unit sold.

The second cost is the batch itself. The Colorado Department of Revenue's Average Market Rate for bud is $601 a pound this quarter [4], and the rules set no maximum batch size [5]. A wrong fail on a 20-pound batch puts about $12,000 of flower at risk. On a 100-pound batch, it is about $60,000. The lab's stake in any single result is its fee. The licensee's stake is the entire batch. When the number is wrong, the licensee carries the entire cost, with no route to recover it. The lab carries none.

Even a result that is technically acceptable can cost money. A potency figure can sit within the variation the rules allow and still differ from what a buyer's own test shows, and buyers rarely know that such variation is permitted. The manufacturer then absorbs the retesting, the disputes, and the customer complaints over a number that was never as precise as the certificate made it look.

That is why accuracy is the real cost of testing. The University of California, Davis, studied the expense of mandatory testing for cannabis businesses and found that the value of product destroyed after failed tests made up a larger share of total testing costs than the lab fees did [6]. The fee is predictable. The error is not. A test that is fast but unreliable is the most expensive kind a business can buy, and as the rest of this section shows, the business that buys it carries all of that risk alone.

A false fail

In our experience, the false fail is the more common error and the more destructive one for licensees. A result reports something that is not there, or may not be, and clean product is quarantined, retested, treated, or destroyed. False passes make headlines when a recall follows. False fails rarely make the news, but they quietly drain manufacturers and growers, batch by batch, and over time they close businesses.

Whether a failed batch can be saved depends on which test it failed. A batch that fails for mold or bacteria can be decontaminated and retested as many times as needed. A batch that fails for pesticides or heavy metals cannot be decontaminated at all [7]. According to a January 2026 Division memo reported by Westword, nothing in Colorado's rules allows a licensee to further process a batch that failed for pesticides [8]. It is destroyed.

The licensee's only recourse under Rule 4-240 is to ask the same laboratory that reported the fail to run two more analyses on the original test batch. If either one fails, the batch is destroyed [9]. There is no provision for sending the sample to a second lab, and no process for disputing the result. The lab that produced the number is the only lab allowed to check it, and it bills for the check.

A failed result can also cost more than a batch. It can open an investigation, and the Division can place an administrative hold that freezes a licensee's inventory, so that nothing can be sold, moved, or destroyed until the investigation ends [10]. In serious cases, it can suspend a license before any hearing [11]. In 2025 alone, the Division took administrative action against 846 licenses and ran more than 160 product safety investigations [12]. Those powers rest on lab results that, as this piece shows, a licensee has no independent way to challenge.

A false pass

A wrong pass is the other half of the problem. It spreads the cost beyond the licensee to retailers and, at the end of the line, consumers. According to the Division, as Westword reported, 4 of the last 5 recalls involved products that had initially passed testing [8].

The clearest recent example arrived while this piece was being written. On October 13, 2026, the Division issued an advisory for a batch of vape cartridges made by StayCon LLC, which does business as Craft. The batch had passed its compliance tests and was sold at 226 stores between September 26, 2025, and July 11, 2026. It was later found over the limit for the pesticide chlorfenapyr, after what the advisory called an investigation into laboratory testing concerns [13]. That product spent nine and a half months on shelves with a passing certificate. Recalls involving Rotation Farms, Stash House, and Colorado's Best Dabs followed the same pattern: a passing result, additional testing after sale, and a recall [14, 15, 16].

Consider who carries that cost. The licensee paid for the test that passed. Retailers pulled the product and absorbed the loss. Consumers had already used it.

Now consider who was named. The October 13 advisory lists the manufacturer, both of its license numbers, the batch, and all 226 stores. It does not name the laboratory whose work prompted the investigation. Colorado law treats licensee testing results as confidential records [17], so the public is unlikely to learn from the Division which lab issued the passing result.

The missing name has a practical cost. A licensee choosing where to send its next batch has no way to know which lab issued a passing result that turned into a 226-store recall. The manufacturer's name is public. The lab's track record is not.

Who pays when the lab is wrong

The labs' contracts answer this question directly. Nordic Analytical Laboratories publishes its terms of service, which cap its liability at the amount the client paid for the specific service in dispute, exclude consequential damages, state that nothing in the terms guarantees a particular testing outcome, and require the client to indemnify Nordic [18]. We cite Nordic because its terms are public. We did not find published terms for the other labs.

Colorado's rules complete the picture. Rule 4-205(F) makes every sampling and testing cost the financial responsibility of the licensee that submits the batch [5].

When a result is wrong, the lab is paid for the test, paid for the retest, and owes nothing more.

Every dollar of the error lands on the licensee, the retailer, or the consumer.

The state can sanction a lab, and the Nordic order described later in this piece shows it sometimes does. But a fine paid to the state returns nothing to the licensee whose batch was destroyed, or to the retailer who pulled a recalled product. For the people who actually lose money on a wrong result, there is no recourse at all.

How close to the line is close enough?

A compliance result is treated as a bright line. One part under the limit passes. One part over fails. But a measurement is never a single exact value. It is a best estimate inside a range of uncertainty, and that range can be wide.

Colorado's own rule shows how wide. Rule 6-440 allows two measurements of the same sample at the same lab to differ by up to 30 percent and still both count as acceptable work [19]. That figure is a ceiling, not a typical result. It is also the only precision standard the rule sets, and the rule never says how often a lab must run a duplicate at all. In practice, a compliance result can rest on a single analysis.

Other scientific fields handle this differently. They measure a sample more than once, report the average along with the spread, and judge compliance with that spread in view. Labs accredited to ISO/IEC 17025 are required to evaluate their measurement uncertainty [20], but nothing in Colorado's rule requires that range to appear on the certificate a licensee receives, and the pass-fail decision ignores it.

So a batch that passes by a hair has not been shown to be clean. It has been shown to read under the line once, on one instrument, on one day. Run it again, send it to another lab, or let the Division pull it off a shelf for surveillance testing, and the same batch can read over the line without anything about the product changing. Before sale, that is a retest. After sale, it is a recall.

The rule accepts two readings 30 percent apart as good work, then treats whichever one was reported as the verdict.

7 labs, nearly 900 licenses

The number of labs matters for two reasons. Fewer labs means each one carries more work, and more work means more pressure on the instruments and habits that keep results accurate. Fewer labs also means fewer alternatives for a licensee who distrusts a result. Colorado's market has very few.

On October 1, 2026, the Division counted 177 medical and 412 retail cultivation licenses, 120 medical and 184 retail product manufacturing licenses, and 7 medical and 7 retail testing licenses [21]. Those 14 testing licenses belong to 6 companies operating 7 labs: SC Labs, AgriScience, Bona Fides, Gobi, Kaycha, and Nordic Analytical, which runs one lab in Denver and one in Pueblo.

Not every lab can run every test. The Division's certification sheet lists AgriScience as not certified for pesticides or residual solvents, and Nordic's Pueblo lab as suspended for pesticides [22]. For the pesticide panel, the test with no decontamination and no second chance, the entire state has 5 certified labs.

The lab count has fallen steadily. Colorado had 16 registered testing labs in 2017 [23] and 21 testing licenses at the end of 2020 [24]. RM3, which a state hearing officer found had handled about a third of the state's potency testing by 2021, had its potency certification suspended in 2022 and later said in a lawsuit that the action forced it to close. Aurum Labs in Durango closed in 2023 [25, 26]. The RM3 case shows how concentrated the market already is: one lab's suspension meant about a third of the state's potency testing had to move somewhere else.

The workload, from the last year the Division published it

Take a conservative estimate. Assume volume fell along with the number of producers, to around 250,000 test packages a year. Spread across 7 labs, that is about 36,000 packages per lab per year, or roughly 140 every working day, and many packages carry several test categories.

No lab publishes a daily capacity we could verify, so that figure stands as an estimate with its assumptions stated. In our reading, it leaves little slack for a bad run, a down instrument, or a week when large harvests arrive at once. The rulebook anticipates this. Rule 4-230 lets the Division reduce required contaminant testing if it has reasonable grounds to believe labs have reached maximum capacity [5]. The Division has also twice delayed new testing requirements, in 2021 and again in 2026, because no laboratory was certified to run them [31].

What happens inside the instrument

What happens inside the instrument is the part a grower never sees. Cannabis is one of the hardest materials an analytical instrument is asked to read. A concentrate can be 70 to 80 percent cannabinoids by weight, with terpenes, waxes, and lipids behind them. All of it enters the instrument alongside the pesticide the lab is hunting for at parts per billion. Four problems follow, and each is documented in the published literature.

Carryover: contamination inside the instrument

Instruments do not fully clean themselves between samples, so a trace of each sample rides into the next. Chemists call this carryover. In plain terms, it is contamination. Agilent, a leading instrument maker, measured this directly. After one injection of a strong pesticide standard, the next blank, a sample containing nothing, still showed 3 pesticides, and one of them, diazinon, was still measurable in the second blank before fading below detection by the fourth [32]. That test used clean solvent. Cannabis is harder on the system, and Agilent notes that cannabis work on a gas chromatograph needs extended bake-out times to prevent carryover and ghost peaks [33]. A ghost peak is exactly what it sounds like: a contaminant on the readout that is not in the sample.

For a licensee, this means a clean batch can be contaminated inside the lab by residue from someone else's sample, and fail because of what the lab ran just before it.

The standard remedies are to run a blank after any strong sample and to run samples from weakest to strongest [34, 35]. Both depend on knowing which samples are strong before they are run. In compliance testing, that is the very question being asked.

Matrix suppression

A mass spectrometer detects a pesticide by turning its molecules into an electrical signal. Everything else in the sample competes for that signal, and in cannabis, everything else is mostly cannabinoid. The result is that a pesticide that is truly present can read smaller than it really is.

The published numbers are not subtle. One peer-reviewed method reported high signal suppression, more than half the signal lost, for most analytes under one sample preparation [36]. A 2025 study identified co-extracted cannabinoids as the likely main contributors to suppression, and separately found that extraction recovered as little as 29 percent of one pesticide [37]. Restek found suppression above 20 percent for a significant number of analytes [38]. PerkinElmer measured one pesticide at 29 percent of its true amount without a correcting reference compound and 101 percent with one [39].

That reference compound is called an internal standard. It is a known chemical added to every sample so the lab can see how much signal the sample is hiding and correct for it. On LC-MS/MS pesticide work, suppression tends to push results low, which means a contaminated sample can pass, and the effect is strongest in the samples with the most cannabinoid in them: concentrates and the most potent flower. On a gas chromatograph, the matrix can also boost a signal and push results high. Either way, without correction, the number on the certificate is not a faithful measure of what is in the sample. Colorado's rules do require an internal standard on LC/MS and GC/MS analyses, under Rule 6-430, but only "when available or appropriate for the assay" [5]. The quality rule, Rule 6-440, does not mention internal standards at all [19].

Calibration across extremes

An instrument reports a concentration by comparing each sample against a calibration curve built from known standards. That curve is only reliable across the range it covers. A cannabis lab may run a near-pure isolate and a lightly dosed finished product in the same sequence, values that sit orders of magnitude apart. Samples outside the curve must be diluted and rerun, and each dilution and rerun is one more chance for error and one more cost in time. Colorado's rules require a calibration curve and checks against a 20 percent drift limit, but set no number of samples between checks during a run [5, 19], so drift between the first sample and the last can go unmeasured for a long stretch.

Dirty instruments and human judgment

All of these effects worsen as an instrument gets dirtier, and instrument makers publish how fast. Agilent's cannabis pesticide kit guide recommends replacing the gas chromatograph's inlet liner about every 40 injections, the liquid chromatograph's guard column about every 135, and the analytical columns about every 400 [30]. One terpene method that changed liners every 200 samples still found significant residue on removal [40]. A 2025 pesticide method capped each sequence at 75 injections before replacing consumables [37]. SCIEX, in a note meant to show how robust its instrument is, ran 830 cannabis flower injections without cleaning the mass spectrometer. Results corrected by internal standards held within 5 percent, but the raw signal at the end had fallen to between 64 and 97 percent of where it started [41]. The internal standards caught that loss. Without them, it would have been invisible.

Apply those intervals to a busy lab. An LC-MS/MS running 100 pesticide injections a day would need a new guard column about every day and a new analytical column about every four days. A gas chromatograph running the same load would need a new inlet liner more than twice a day. On the vendor's own schedule, a busy lab should be replacing parts almost constantly. Each replacement costs money and instrument time. Skipping them saves both, and nothing in Colorado's rule would flag it.

Nobody outside the labs knows whether Colorado's labs keep that schedule, because inspection reports are not published. What is known is that the rule does not ask. It requires documentation of maintenance and leaves replacement to each lab's own procedures, with no interval of any kind [19].

Then there is the person at the screen. The instrument reports each compound as a peak on a chart, and the amount of the compound is calculated from the area under that peak. The software draws where each peak starts and ends, and an analyst reviews those boundaries and can adjust them. Chemists call this step integration. It is necessary, and it is also a judgment call. Two careful analysts can draw the edges of the same small peak differently, which changes the calculated area and therefore the amount reported. Near a legal limit, that difference can decide a batch.

Naming a peak is a judgment too. An instrument identifies a compound by matching its signal to a reference standard the lab has run. When a peak appears that matches no standard on hand, or sits where a known compound usually appears, an analyst can assign it to the nearest compound the lab does have a standard for. A terpene, a flavor compound, or an instrument artifact can end up reported as a cannabinoid or a contaminant. That call is easy for the lab and can be catastrophic for the manufacturer, whose product now carries a certificate listing something it does not contain. Lab Effects has seen this happen with its own products, as described below under "What we have seen ourselves."

The instrument maker says to replace the liner every 40 injections, the guard column every 135, and the column every 400.

Colorado's rule says to document your maintenance.

What Colorado's rule asks of a lab

On paper, Colorado has a real framework. A testing lab must be certified by the Division on the recommendation of the state health department, accredited to the international laboratory standard ISO/IEC 17025, inspected on site once a year, and enrolled in proficiency testing [5, 42]. The details inside that framework are where it thins out.

Colorado's quality rule next to two other cannabis states

Sources: Colorado Rule 6-440 [19]; California Department of Cannabis Control [43]; Michigan Department of Licensing and Regulatory Affairs [44].

The Colorado column tells the story. The checks that catch an instrument drifting over a long day are the ones Colorado leaves undefined or omits entirely. A Colorado lab could run 200 samples on one blank and one calibration curve and still meet every word of the rule.

A test the lab can see coming

Proficiency testing is meant to catch a lab that has drifted. An outside provider sends a sample with a hidden answer, and the lab must find it. Under Rule 6-435, a lab seeking certification must have passed proficiency testing in each category within the preceding 12 months. After that, the rule requires ongoing participation but sets no frequency of its own. Passing means correctly identifying at least 80 percent of the target analytes, with no false positives. One failure costs the lab nothing. Suspension comes only after two consecutive failures, or two out of three, and certification can be reinstated after the next passing event [5].

The test also looks nothing like a normal workday. The sample comes from an approved vendor the lab chooses [45], on a schedule the lab knows. Nothing stops a lab from running it on a freshly maintained instrument, with a new column, at the front of a run, by its best analyst. That is simply what any lab would do with a known test, and none of it breaks a rule. But it means the only routine outside check measures the lab at its best, not on a crowded Tuesday afternoon with a column at injection 390 and a rush order due by five. Clinical labs face a different rule: federal law requires them to handle proficiency samples in the same way as patient samples, run by the same staff [46].

Oversight nobody can read

The health department requested $1,156,232 for its marijuana lab certification line for fiscal year 2024-25 [47], roughly $165,000 per lab, covering an annual inspection, document review, and related costs. The results of that oversight are not public. State law treats testing results as confidential and permits release only in aggregated, de-identified form [17]. The dataset that would show which labs fail product and which almost never do exists, and it cannot be published.

The Denver Gazette came as close as the law allows. Its analysis of about 325,000 total yeast and mold results found an unusual cluster of results just below the legal limit of 10,000 colony-forming units (CFU) per gram, and a drop just above it [26].

The cluster matters because mold does not know where the legal line is. Honest measurements of mold on flower should spread smoothly across 10,000 CFU, with about as many batches landing just over as just under. A pile-up just under the limit means something in the process, not the plant, is moving results toward passing. Lab rounding could do it. So could growers treating or resampling until a batch squeaks under, or borderline fails that pass on retest. Aggregate data cannot tell those causes apart. Lab-by-lab data can. When researchers examined Washington State's data that way, a similar pile-up at a THC threshold appeared at some labs but not others, and was largest at two labs the state later suspended [48]. Colorado holds the data that could answer the same question, and its privacy statute keeps it sealed.

A cluster just under the limit shows that something in the process moves results toward passing. Only lab-level data can show where, and Colorado law keeps that data out of public view.

What other labs are held to

Cannabis is not the first product a state has asked private labs to grade. The labs that test drinking water, run blood work, release drugs, and check produce for pesticides are mostly private businesses too. The difference is that each of those fields long ago wrote down a short list of habits a lab must keep for its answers to be trusted. Colorado's cannabis rule leaves most of that list to each lab's own procedure manual. Four habits do most of the work.

The four checks, in plain terms

How often each field requires those checks, next to Colorado cannabis

Environmental labs make the most useful comparison. They use the same kinds of instruments to look for many of the same contaminants, pesticides and metals among them. The cannabis matrix is far harder on those instruments, which is an argument for stricter rules, not looser ones. In 2019, Washington State's Department of Ecology studied this question and recommended that its legislature hold cannabis labs to its environmental lab accreditation framework, noting that an ISO certificate alone does not distinguish a lab's capability [56]. Colorado kept the certificate and added one inspection a year whose report the public cannot read.

When a result fails

The other fields also share a habit that runs opposite to Colorado's retest rule: they question a failing result before acting on it. EPA methods require a positive hit from an ordinary chromatography detector to be confirmed on a second column or by mass spectrometry before it is reported [34]. Federal drug rules require a failing result to be investigated at the bench, with the instrument, standards, and calculations checked, before anyone decides whether the fault lies with the product or the lab. A failing lot cannot simply be retested until it passes [53].

Colorado's rule does neither. The lab reports its fail, and the licensee's only check is two more runs at the same lab, which may use the same instrument and the same method. If the first fail came from the lab itself, through carryover contamination, a misidentified peak, or drifting calibration, the same conditions can produce the same error twice more. A clean batch is then destroyed on three results that all agree, without any outside lab ever looking at it and without anyone required to find out why it failed. The procedure can also go wrong in the other direction, when two passing retests overturn a first result that was right. Nothing in the rule tells these cases apart, and nobody is assigned to try.

Same sample, different answer

All of this would matter less if Colorado's labs agreed with one another. They do not, and the gap has been measured. In the table below, "spread" means the gap between the highest and lowest reading as a share of their average, the same way Rule 6-440 measures duplicates.

Reported results for the same or comparable samples

Potency

The cross-lab numbers are what most people expect: different labs, different answers. Lab shopping, where a licensee picks the lab that reports the most favorable result, explains part of that [59]. The more troubling row is the third one. A single lab reported the same batch at 36.5 percent THC on one occasion and 47 percent on another. Ripple's chief executive, Justin Singer, summarized it plainly: the same labs, using the same methods on the same samples, could not reproduce their own results [57].

The single lab's 25 percent spread falls inside the 30 percent difference Rule 6-440 accepts between duplicates. That is not a defense of the result. It shows how wide the rule's tolerance really is: wide enough to absorb a ten-point swing in THC on one batch at one lab. What caused the swing is unknown. Instrument condition, sample preparation, uneven distribution of THC within the product, and method differences are all possible. The rules require nothing that would show which.

Mold

The microbial test costs growers the most, because mold is the most common reason a batch fails in Colorado. The last year the Division published those figures was 2019, when 13.65 percent of the 40,837 adult-use flower and trim batches tested failed the microbial test, and medical batches failed at 12.7 percent [62]. That is about 5,600 failed adult-use batches in a single year, each one quarantined and then treated, destroyed, or diverted to extraction.

How the mold is counted matters. Plating grows whatever is in the sample on a dish and counts the colonies. Quantitative PCR (qPCR) counts the mold's DNA. When 15 samples were tested both ways, plating failed 10 and qPCR failed three [61]. If the DNA count was closer to the truth, most of those plating fails sent product that would have passed into treatment or destruction. The published explanations run in both directions. Plate counts can be inflated by bacterial growth, and different growing media can produce tenfold differences in counts [61, 63, 64]. qPCR can count mold that is already dead, for example after a batch has been irradiated. Colorado sets the limit at 10,000 CFU per gram but does not specify a method. The practical result is that the same batch can pass at one lab and fail at another, purely because of how each lab counts. A grower often learns which method was used only when a batch fails.

In 2019, Denver's health department bought flower from 25 dispensaries and placed hold orders on 20 of them, every one for yeast and mold, on product that carried passing certificates [65]. Mold can grow after testing, the shelf sample can differ from the tested one, or either result can be wrong. Whichever it was, the certificate did not tell consumers what was on the shelf.

Pesticides

The California pesticide study shows the error running the other way. The labs were not jumping at shadows. They reported no false positives. They missed most of the contamination that was unambiguously there, which is what matrix suppression predicts. The study appeared in a trade journal, and it carries no conflict of interest statement, so weigh it accordingly. We found nothing that contradicts it. It also matches the Division's own observation that 4 of the last 5 recalls involved product that had passed [8]. It is one small study of spiked distillate, not a measure of what sits on Colorado shelves. What it shows is how far a single reading can land from the truth, and the mold data above shows the same gap opening in the direction that destroys clean product.

What we have seen ourselves

Most of the labs in the examples below are outside Colorado. That is the point. The same instruments, methods, and business pressures operate in every state, and Colorado's rules, like most states', do little to guard against them. What follows shows what those gaps look like when they land on a real business.

Lab Effects has run into the same problems with its own products, and the examples are hard to explain any way other than lab error. Years ago, a Michigan lab reported medium-chain triglycerides (MCT) in products that contain none. Lab Effects does not use MCT anywhere in its terpene business, so the compound could not have been there. Several labs have reported THC in botanically derived terpenes made from plants that are not cannabis.

To check results like these, Lab Effects routinely sends blind controls alongside its samples. These are ordinary materials such as olive oil and sunflower oil, which contain no cannabinoids of any kind. Labs have reported THC in those controls too. A lab that finds THC in olive oil is telling its customer something about the lab, not about the oil.

If a lab can find THC in sunflower oil, it could find it in any kitchen in the state. Nobody would conclude the kitchen was growing cannabis. They would conclude the test was wrong. Cannabis businesses do not get that benefit of the doubt. For them, the same result is treated as the truth.

One of those cases has since been resolved, and how it was resolved is telling. A lab reported several cannabinoids, including THCA at about 0.2 percent, in a Lab Effects formulation product that contains no cannabinoids. It also reported CBDV and two forms of THC in a customer's finished cartridge made with that product. Lab Effects wrote a technical guidance statement for the lab explaining the product's composition and laying out how to confirm or rule out each identification. After retesting, the lab changed its result: the product now shows no cannabinoids at all. According to the customer, the lab had matched the peaks against a more complete reference database. The product never changed. Only the lab's identification of what it was seeing did. Getting there took a manufacturer willing to do the analytical work and a customer willing to wait. A licensee without either would have been left with the first certificate.

The most recent case shows what this costs in practice. An international customer is buying Lab Effects cannabis-derived terpenes for products sold in Japan, where the Ministry of Health, Labour and Welfare sets some of the strictest THC limits in the world: 10 parts per million for oils and powders, 1 ppm for most other products, and 0.1 ppm for water-based products [66]. At those levels, the customer needs a clean non-detect result. Few laboratories in the United States advertise the ability to test for THC that low, and the ones Lab Effects has used have reported THC in its blind controls.

The lab handling this order has been checked the same way. In earlier rounds, the customer included blind controls among its samples, labeled like any other strain: sunflower oil and terpene blends made entirely from plants that are not cannabis. The lab reported THC in them, and in one round the controls returned the highest THC readings of any sample. The lab also tested two samples of the same material, submitted at different times but drawn from the same source container. One passed. The other failed.

Then the lab reported 11 of the customer's cannabis-derived terpenes at between 57 and 1,225 ppm THC, with CBD above 2.6 percent in two of them. Every one would have failed Japan's limit. The lab rechecked the results with a second method on the same extracts and reported them confirmed. Fresh samples from the same lots told a different story. Northern Lights, first reported at 971.73 ppm, came back at 1.39 ppm. Blue Dream, first reported at 493.79 ppm, came back below the lab's quantitation limit. The material never changed. Only the test did. On those fresh samples, the lab's GC-MS/MS readings also ran higher than its LC-MS/MS readings, by more than two and a half times where both could be measured, a gap the lab attributed to matrix enhancement it had not corrected for. The lab has since called the matter serious and opened an internal investigation. As of this writing, it has not explained what went wrong.

For scale, Colorado's quality rule accepts two readings of the same sample that differ by up to 30 percent. These two readings of the same lot differed by a factor of about 700. Under Colorado's retest rule, a licensee facing results like the first ones would get no outside lab, only two more runs at the same lab. This lab's own second method had already repeated the error once.

Our working theory is that labs are identifying certain terpenes as cannabinoids. That would explain why the botanical controls, which are made entirely of terpenes, read higher than cannabis-derived oils, which contain a smaller share of terpenes alongside other plant compounds. It is a theory. The lab has not confirmed or ruled it out, and the fresh-sample results suggest that something in sample preparation may also be involved.

To its credit, the lab has been cooperative and wants to find the cause. But each round costs more: about $300 per test, plus $250 for each GC-MS/MS confirmation, which would have nearly doubled the cost of confirming all 11 samples, from $3,300 to $6,150. Lab Effects is supplying free samples and discounted material, the customer's release is delayed while 9 more strains wait for fresh retests, and tens of thousands of dollars in business are on hold. In effect, the customer and Lab Effects are paying for the lab's research into its own errors.

The deeper problem is what happens next. Even when a sample passes, the customer cannot rely on that result. Once the same material becomes a production batch worth $10,000 or more, the next test could fail, with nothing about the material having changed. And with so few labs to choose from, and the ones tried having failed the controls, there is no reliable second opinion to turn to. For the customer, every batch has become a round of Russian roulette. That is the uncertainty this entire piece describes, landing on a real business with a real order.

The largest lab sanction on the record

In August 2026, Nordic Analytical Laboratories signed a stipulation with the Division. It is the largest sanction against a Colorado testing lab we found on the public record [67]. Because inspection reports are sealed, a signed order like this is the only public view of what can go wrong inside a Colorado lab. The problems Nordic admitted match the ones described earlier in this piece.

For its Denver lab, Nordic admitted violating rules that require the laboratory director to maintain quality control and quality assessment programs that identify failures as they occur; require control materials that differ in source, lot, or concentration from the calibration material in each run; require a negative control and two levels of controls spanning the calibration curve; require results to be accurate, precise, and scientifically valid before reporting; and require pesticide test batches to be retained for 90 days. For its Pueblo lab, Nordic admitted violating the rule requiring a quality assurance and quality control program that sufficiently monitors laboratory processes and results [67].

Read those admissions against the instrument section above. Independent controls and multilevel controls are how a lab catches drift and calibration problems within a run. A retained sample is how anyone can check a result afterward. Nordic admitted violating the rules that require them.

The sanction included a $360,000 fine, revocation of Nordic's pesticide certifications at both labs with leave to reapply, a dedicated lab director and a dedicated quality manager at each site, and an obligation to keep sending batches that passed pesticide screening between June 25 and September 24, 2025, to a different laboratory for retesting, at a minimum monthly rate. A 30-day suspension was held in abeyance for 24 months [67]. The Division's current certification sheet shows Nordic's Denver lab certified for pesticides again through November 30 [22].

The order judged three months of Nordic's passing pesticide results unreliable enough to retest elsewhere. Retesting can confirm whether those results were right. It cannot pull back product already sold, and it compensates no one.

In February 2025, a Division spokesperson told the Denver Gazette that Colorado's overlapping regulatory mechanisms ensure labs produce consistently accurate results [26]. Eighteen months later came the Nordic order. In between, Kyle Lambert, the Division's deputy director, told a public forum that "sample adulteration is a common violation" [29]. A bill to overhaul lab oversight, including a state reference laboratory and surveillance testing of products pulled from shelves, was postponed indefinitely by a Senate committee on an 8–0 vote [68]. As far as we could find, the Division's own surveillance testing program has published no results as of this writing.

Each of those facts points the same way. The state says the system works. Its own enforcement record shows serious failures inside a certified lab. And the two reforms that would let anyone test the state's claim, a reference lab and published surveillance results, have stalled or gone unpublished.

Limits nobody justified

Accuracy is only half the problem. The other half is the line the number is measured against. Each state sets its own limits for pesticides, solvents, metals, and microbes. Those limits vary from state to state, and few states publish the toxicology behind them. Well-tested frameworks already exist: EPA limits for food crops, FDA rules for food and drugs, and the international pharmaceutical guideline on residual solvents [69]. Cannabis regulators rarely adopt them outright.

Our earlier piece documented one example. When Colorado expanded its residual solvent panel in 2026, it set 18 added compounds at "None Detected." Seventeen of them belong to the pharmaceutical guideline's lowest-risk class, which accepts 5,000 parts per million without further justification, and the Division published no toxicology for any of the zeros [69, 70].

A zero limit also has a hidden problem that ties back to accuracy. "None Detected" means only that the instrument did not see the compound. Its meaning depends entirely on how sensitive that instrument is that day, and on whether carryover or suppression is affecting the result. In practice, a zero limit is a limit set by each lab's machine.

The rules also disagree with themselves. Colorado regulates hemp manufacturing through its health department, under a separate rule with its own residual solvent list. Every one of those 18 compounds appears on that hemp list at a numeric limit, with the lowest-risk solvents allowed up to 1,000 parts per million [71]. The same compound, in the same state, can be acceptable at 1,000 parts per million in a hemp product and forbidden at any detectable level in a marijuana product. Multiply that across 50 states and two regulated markets, and a business selling into more than one of them is complying with limits that contradict each other, none of which has to explain itself.

The same split reaches the labs themselves. Colorado hemp manufacturers must have their products tested by a lab approved by the health department [71], while the Division separately certifies labs to test marijuana. The two lists are kept by different agencies, and a lab on one is not necessarily on the other. We know of at least one Colorado lab that has accepted and billed for hemp samples without being on the health department's approved list, using an intake form that asks whether each sample is hemp or marijuana. Nothing on the form says whether the lab is approved to test hemp. Lab approvals also change over time, and no one notifies the businesses relying on them. In effect, every hemp company is expected to audit its own labs' standing on a state website.

Selling across state lines adds another layer. A result that satisfies Colorado may not satisfy another state, which can set its own rules about whose lab results it accepts. A business can pay for a test, receive a passing certificate, and still find that the certificate does not count in the next market. That is the spiderweb these businesses work inside: the same uncertain measurement described throughout this piece, which must now also come from the right lab, on the right agency's list, for the right state.

Compliance theater

For consumers, the visible end of this system is a certificate of analysis (COA), usually reached through a QR code on the package. It looks authoritative. It describes one sample, measured once, on one day, by one lab, under rules that ask little of the instrument that produced it. It says nothing about where the ingredients came from, whether they were legally sourced, or how the product was handled after testing.

In the hemp and CBD market, much of the pressure to put that document in front of consumers does not come from a regulator at all. Payment processors that serve CBD e-commerce commonly require sellers to link a finished-product COA to each product, often through a QR code on the label, before they will process a sale. That is a private business rule, written to manage the processor's own risk, and it now shapes how an entire market presents safety to the public.

The effect is to turn consumers into pseudo-regulators. Shoppers are trained to ask for QA and QC documents, and to treat a link to one as proof of quality, without the training to read a chromatogram, judge a detection limit, or recognize when a result sits inside its own margin of error. Brands, in turn, learn that the COA sells. A compliance record becomes a marketing asset, displayed for reassurance rather than read for meaning. That is theater: the appearance of oversight, performed for an audience that cannot check it.

Food and drugs do not work this way. Nobody buys lettuce or aspirin with a pesticide report attached. Their safety rests on facility audits, process controls, supply chain records, and regulators who check the labs. Cannabis and hemp have turned that model inside out. They hand consumers a lab report the system itself cannot verify, which quietly shifts the regulator's job onto the person at the counter.

Why the system drifts this way

This section is our opinion. Colorado's testing labs are for-profit businesses paid per sample. They compete on turnaround and price, and the licensee chooses which lab to use. Every hour an instrument spends running blanks, controls, and replicates, or sitting idle while a column is replaced, is an hour it is not billing. None of that means any lab cuts corners, and we are not saying any named lab does. It means the habits that make results trustworthy cost time and money, the rules do not require most of them, and the market does not reward them. A system built that way will drift toward speed and volume unless the rules push back.

What we think

So, will these rules be the downfall of Colorado's cannabis industry? Not on their own. But a system that destroys good product on bad numbers, ships contaminated product on passing ones, and bills the licensee either way is a steady drain on an industry already at record-low wholesale prices [4]. Every one of those losses is preventable.

We do not think the people running these labs are careless. We think they are working near the limit of what their instruments can do, on one of the hardest materials in analytical chemistry, under a rule that tells them to document maintenance without saying how often to do it. Their only routine outside check is a scheduled proficiency sample they can see coming. Their contracts put every dollar of a wrong answer on the customer.

That system produces results. It does not produce results anyone can verify, and the system is built so that nobody outside the labs can see which results were accurate. Licensees are left with impossible choices: accept a fail they cannot challenge, sell on a pass that may be recalled, and absorb the cost either way.

The takeaways are straightforward. A single cannabis lab result is less certain than the pass-fail stamp suggests. The rules do little to narrow that uncertainty. The people who bear its cost have no means to reduce it. Colorado asks less of its cannabis labs than California asks of its own, and far less than the federal government asks of the labs that test water, blood, drugs, and food, while giving those few labs more work than they say they can comfortably handle. And across marijuana and hemp, the rule-makers multiply contradictory requirements while handing consumers documents they cannot interpret. Every one of those problems can be fixed in the rulebook.

Proposed course corrections

• Start every lab from the same point. Require that every calibration and check standard come from an accredited reference-material producer (ISO 17034), with a certificate tracing its stated concentration, so that every lab calibrates against the same known values. Enforce the existing requirement that each run's control material come from a different source or lot than its calibration material, the rule Nordic admitted violating.
• Correct for the sample. Require internal standards, ideally isotope-labeled versions of the target compounds, in every mass spectrometry method, with no "when available" exception: pesticides, mycotoxins, and low-level THC. Require matrix-matched calibration or a documented correction wherever a method is known to inflate or suppress results, as gas chromatography does.
• Define the run. Write a batch size into Rule 6-440, with a method blank at the start, a calibration check every 10 samples, and a blank after any sample above the action level, as California and Michigan already require.
• Set a maintenance floor for columns, liners, and source cleaning, measured in injections rather than left to each lab's procedures.
• Report the uncertainty. Require replicate analysis on results near a limit, and print each result's measurement uncertainty on the certificate.
• Make proficiency testing blind and unscheduled, delivered through the ordinary sample stream, at a set minimum frequency.
• Allow a second opinion. Let a licensee send a failed sample to a second certified lab, and let that result count.
• Standardize methods where results depend on them, starting with the microbial count and the instruments used for potency and THC, and require matrix correction wherever a method is known to inflate or suppress results.
• Publish the oversight. Release inspection reports and lab-level pass and fail rates. If the privacy statute prevents it, amend it. It was written to protect licensees, and it now shields the labs that grade them.
• Fund a state reference lab with cannabis tax revenue, and publish what the surveillance program found.
• Stop staging compliance for consumers. Put the burden of verification on regulators, auditors, and supply chain records, where it belongs, rather than on shoppers scanning QR codes.
• Base limits on published science. Adopt existing EPA, FDA, and ICH frameworks, and publish the justification for any limit that departs from them. Start with the 2026 residual solvent panel, which lists natural constituents of fruit and plant flavorings alongside industrial solvents.
• Match workload to capacity. Either cap daily throughput at each lab's validated capacity or recognize that the number of labs is part of the problem.

Earlier in this series: our piece on the Division's methylene chloride advisories and its flavoring guidance, with its own proposed corrections [70].

What licensees can do now

Until the rules change, licensees can protect themselves by asking more of the labs they pay. The safest labs hold current ISO/IEC 17025:2017 accreditation for each method a licensee relies on. Licensees can ask each lab for its measurement uncertainty and its method detection limits, and for the blank and control results from the run that included their batch. They can ask whether a lab uses internal standards for pesticides and which microbial method it uses, and periodically split a sample between two labs to see how closely they agree. A lab that is willing to discuss its protocols and results is worth more than one that is merely fast.

Why we write these

We publish these pieces knowing that few people will read every word, and that saying anything at all draws attention we would rather not have. The alternative is to say nothing while an industry we have spent nearly 15 years building erodes under rules that do not work. We are not interested in complaining. Every piece in this series ends with specific corrective steps, which is why we call it Cannabis Course Correction. They are not the only possible solutions, but no one will be able to say the industry did not offer answers grounded in sound science.

Our interest, and the limits of this piece

Lab Effects supplies terpenes and flavorings. Our customers are licensed manufacturers whose products pass through these labs, and, as described under "What we have seen ourselves," labs have repeatedly reported compounds in our products that cannot be there, which is one of the ways we came to this subject. We are not neutral about how these labs are regulated, and we are not pretending to be.

Beyond what Nordic admitted in its own signed order, we are not alleging that any lab or any person at the Division acted in bad faith or broke the law, and nothing in this piece says so. Where we describe what happens inside an instrument, we are describing published chemistry, not any particular lab's bench. Where we describe what a lab admitted, we are summarizing its own signed order.

This piece has limits. The Division last published test volumes for 2020, so our per-lab workload figures are estimates with their assumptions stated. The interlab studies are small, and two were run by parties with an interest in the outcome, which we note where they appear. The maintenance intervals are a vendor's recommendations for its own equipment, not a rule. None of that changes the structure we describe. We are publishing this as a courtesy to the industry and to the Division, because most of the fix lies in a rulebook that is open for comment every year. We will provide any cited document on request.

Sources

Every factual claim in this piece rests on one of the documents below, numbered in the order they are first cited. We will provide copies of any of them on request.

1. Pinnacle Analytics. Compliance testing price list. Accessed October 2026. https://pinnacle-analytics.com/pricing/
2. MJBizDaily. California marijuana testing costs under Phase 3. December 20, 2018. Accessed October 2026. https://mjbizdaily.com/california-marijuana-phase-3-testing-costs/
3. MJBizDaily. Cost of new mandatory pesticide testing tough to absorb for Colorado growers. August 22, 2018. Accessed October 2026. https://mjbizdaily.com/cost-of-new-mandatory-marijuana-pesticide-testing-tough-to-absorb-for-colorados-growers/
4. Colorado Department of Revenue. Average market rates for retail marijuana, effective October 1, 2026. Accessed October 2026. https://tax.colorado.gov/average-market-rate
5. Colorado Marijuana Enforcement Division. Colorado Marijuana Rules, 1 CCR 212-3 (Rules 4-205, 4-215, 4-230, 6-415, 6-430, 6-435). Accessed October 2026. https://med.colorado.gov/rules
6. Valdes-Donoso P, Sumner DA, Goldstein R. Costs of cannabis testing compliance: assessing mandatory testing in the California cannabis market. PLoS One. 2020;15(4):e0232041. Accessed October 2026. https://pubmed.ncbi.nlm.nih.gov/32324781/
7. Colorado Marijuana Enforcement Division. Compliance tip: third-party decontamination. June 2, 2023. Accessed October 2026. https://med.colorado.gov/sites/med/files/documents/230602_Compliance_Tip_Third-Party_Decontamination.pdf
8. Westword. Colorado marijuana businesses diluting failed pesticide batches (MED memo of January 23, 2026). January 2026. Accessed October 2026. https://www.westword.com/news/colorado-marijuana-businesses-diluting-failed-pesticides-40835828/
9. 1 CCR 212-3, Rule 4-240, Contaminated product and failed test results. Accessed October 2026. https://www.law.cornell.edu/regulations/colorado/1-CCR-212-3-4-240
10. Colorado Marijuana Enforcement Division. Compliance tip: quarantining product under administrative hold (Rule 8-110(B)). May 24, 2021. Accessed October 2026. https://med.colorado.gov/sites/med/files/documents/210524_Quarantining_Product_Compliance_Tip_Final.pdf
11. 1 CCR 212-3, Part 8, Enforcement and discipline (Rules 8-110 and 8-210, summary suspensions). Accessed October 2026. https://regulations.justia.com/states/colorado/200/212/rule-1-ccr-212-3/part-8/
12. Colorado Marijuana Enforcement Division. MED publishes 2025 regulatory and enforcement update report. February 2026. Accessed October 2026. https://med.colorado.gov/press-release/med-publishes-2025-regulatory-and-enforcement-update-report
13. Colorado Department of Revenue and Colorado Department of Public Health and Environment. Health and safety advisory: StayCon LLC dba Craft (chlorfenapyr). October 13, 2026. Accessed October 2026. https://drive.google.com/file/d/1FBZJyY9P2TuoenCS54VgZcRV9RfI4fKf/view
14. Westword. Banned pesticide recall, Rotation Farms. January 2026. Accessed October 2026. https://www.westword.com/news/banned-pesticide-cannabis-recall-colorado-dispensaries-40827624/
15. CBS Colorado. Contaminated marijuana recalled from hundreds of Colorado dispensaries. December 31, 2025. Accessed October 2026. https://www.cbsnews.com/colorado/news/contaminated-marijuana-recalled-hundreds-colorado-dispensaries
16. Westword. Colorado's Best Dabs recall. July 2026. Accessed October 2026. https://www.westword.com/news/colroado-cannabis-dab-recall-pesticides-40911702/
17. C.R.S. 44-10-204, Confidentiality of licensee records. Accessed October 2026. https://colorado.public.law/statutes/crs_44-10-204
18. Nordic Analytical Laboratories. Terms of service. Accessed October 2026. https://www.nordicanalytic.com/terms.php
19. 1 CCR 212-3, Rule 6-440, Quality assurance and quality control. Accessed October 2026. https://www.law.cornell.edu/regulations/colorado/1-CCR-212-3-6-440
20. International Organization for Standardization. ISO/IEC 17025:2017, General requirements for the competence of testing and calibration laboratories. 2017. Accessed October 2026. https://www.iso.org/standard/66912.html
21. Colorado Marijuana Enforcement Division. Count of marijuana licensees by type. Updated October 1, 2026. Accessed October 2026. https://med.colorado.gov/licensee-information-and-lookup-tool
22. Colorado Marijuana Enforcement Division. Licensed facilities: testing facilities certification sheet. Accessed October 2026. https://med.colorado.gov/licensee-information-and-lookup-tool/licensed-facilities
23. Westword. Hickenlooper sends marijuana bill to Secretary of State unsigned. 2017. Accessed October 2026. https://www.westword.com/news/colorado-governor-john-hickenlooper-sends-marijuana-bill-to-secretary-of-state-unsigned-9139407/
24. Colorado Marijuana Enforcement Division. 2020 annual update. Accessed October 2026. https://spl.cde.state.co.us/artemis/revserials/rev131internet/rev1312020internet.pdf
25. MJBizDaily. Colorado lab RM3 potency certification suspended. 2022. Accessed October 2026. https://mjbizdaily.com/colorado-cannabis-testing-lab-rm3-potency-certification-suspended/
26. Denver Gazette. Is Colorado cannabis safe? Testing for potency, contaminants riddled with loopholes. February 7, 2025. Accessed October 2026. https://www.denvergazette.com/2025/02/07/is-colorado-cannabis-safe-testing-for-potency-contaminants-riddled-with-loopholes/
27. Kaycha Labs. Colorado laboratory page. Accessed October 2026. https://www.kaychalabs.com/location/colorado-cannabis-cbd-hemp-testing-lab/
28. SC Labs. Frequently asked questions. Accessed October 2026. https://www.sclabs.com/faq/
29. ProPublica and Denver Gazette. Colorado marijuana regulators consider major changes to how labs test for contaminants. February 11, 2026. Accessed October 2026. https://www.propublica.org/article/colorado-regulators-marijuana-lab-testing-system
30. Agilent Technologies. Cannabis pesticide and mycotoxin kit user guide, 5994-1540ENCA. Accessed October 2026. https://www.agilent.com/cs/library/usermanuals/public/Cannabis-kit-5994-1540ENCA-agilent.pdf
31. Colorado Marijuana Enforcement Division. Industry bulletins index (21-12, 24-04, 25-11, 25-16, 26-07, 26-09). Accessed October 2026. https://med.colorado.gov/industry-bulletins
32. Agilent Technologies. Autosampler carryover of pesticides, technical overview 5991-6246EN. 2015. Accessed October 2026. https://agilent.com/cs/library/technicaloverviews/public/5991-6246EN.pdf
33. Agilent Technologies. Sensitive and robust detection of pesticides in dried cannabis by GC-MS/MS, application note 5994-0568EN. Accessed October 2026. https://labrulez.com/pdf/paper/application-sensitive-and-robust-detection-of-pesticides-in-dried-cannabis-8890-7010b-triple-quadrupole-gc-ms-5994-0568en-agilent.pdf
34. US Environmental Protection Agency. SW-846 Method 8000D: determinative chromatographic separations, revision 5. 2018. Accessed October 2026. https://www.epa.gov/sites/default/files/2015-12/documents/8000d.pdf
35. Dolan JW. Autosampler carryover. LCGC North America. 2006. Accessed October 2026. https://www.chromatographyonline.com/view/autosampler-carryover-2
36. Pérez-Parada A, et al. Analytical improvements of hybrid LC-MS/MS techniques for the efficient evaluation of emerging contaminants in marijuana. Chromatographia. 2016. Accessed October 2026. https://link.springer.com/content/pdf/10.1007%2Fs10337-016-3029-9.pdf
37. MacKenzie D, et al. Determination of 96 pesticides in cannabis by LC-MS/MS and GC-MS/MS. Anal Bioanal Chem. 2025. Accessed October 2026. https://link.springer.com/article/10.1007/s00216-025-05918-9
38. Cochran J, et al. Evaluation of a modified QuEChERS approach for pesticide analysis in cannabis. LCGC. 2017. Accessed October 2026. https://www.chromatographyonline.com/view/evaluation-modified-quechers-pesticide-analysis-cannabis
39. Dalmia A, et al. Novel LC-MS/MS method with a dual ESI and APCI ion source for analysis of California-regulated pesticides. Spectroscopy. 2020. Accessed October 2026. https://www.spectroscopyonline.com/view/novel-lc-ms-ms-method-with-a-dual-esi-and-apci-ion-source-for-analysis-of-california-regulated-1
40. Agilent Technologies. Terpenes in hemp by GC-FID, application note 5994-7684EN. Accessed October 2026. https://agilent.com/cs/library/applications/an-terpene-cannabis-gc-fid-5994-7684en-agilent.pdf
41. SCIEX. Robustness of pesticide analysis in cannabis flower over 830 injections, technical note. Accessed October 2026. https://sciex.com/content/dam/SCIEX/pdf/tech-notes/food-and-beverage/cannabis/Cannabis-Robustness_6500_RUO-MKT-02-14023-A.pdf
42. Colorado Department of Public Health and Environment. Marijuana testing facility inspection and certification. Accessed October 2026. https://cdphe.colorado.gov/laboratory-services/mtf-inspection-certification
43. California Department of Cannabis Control. Standard operating procedures for test methods. 2023. Accessed October 2026. https://cannabis.ca.gov/wp-content/uploads/sites/2/2023/08/approved_text_standard_test_methods_operating_procedures.pdf
44. Michigan Department of Licensing and Regulatory Affairs. Safety compliance facility technical guide. October 2019. Accessed October 2026. https://www.michigan.gov/documents/lara/10-25-19.AU.Safety_Compliance_Facility_Technical.Guide_670162_7.pdf
45. Colorado Marijuana Enforcement Division. Marijuana Sciences Group: approved proficiency test providers. Accessed October 2026. https://med.colorado.gov/marijuana-sciences-group
46. 42 CFR 493.801, 493.841, and 493.931, CLIA proficiency testing enrollment, performance, and frequency. Accessed October 2026. https://www.law.cornell.edu/cfr/text/42/493.801
47. Joint Budget Committee staff. FY 2024-25 staff budget briefing: Department of Public Health and Environment (Marijuana Lab Certification line). Accessed October 2026. https://content.leg.colorado.gov/sites/default/files/fy2024-25_pubheabrf1.pdf
48. Zoorob MJ. The frequency distribution of reported THC concentrations of legal cannabis flower products increases discontinuously around the 20% THC threshold in Nevada and Washington state. J Cannabis Res. 2021;3:6. Accessed October 2026. https://pmc.ncbi.nlm.nih.gov/articles/PMC7958443
49. The NELAC Institute. TNI Standard, volume 1: management and technical requirements for laboratories performing environmental analysis. 2016. Accessed October 2026. https://deq.louisiana.gov/assets/docs/Lab_Accreditation/2016_TNI_Standard_V1.pdf
50. 42 CFR 493.1256, CLIA control procedures. Accessed October 2026. https://www.law.cornell.edu/cfr/text/42/493.1256
51. 42 CFR 493.1443, CLIA laboratory director qualifications. Accessed October 2026. https://www.law.cornell.edu/cfr/text/42/493.1443
52. 21 CFR 211.160 and 211.165, current good manufacturing practice: laboratory controls and testing for release. Accessed October 2026. https://www.law.cornell.edu/cfr/text/21/211.165
53. US Food and Drug Administration. Investigating out-of-specification (OOS) test results for pharmaceutical production: guidance for industry. 2022. Accessed October 2026. https://www.fda.gov/media/158416/download
54. 21 CFR Part 1, Subpart R, Laboratory accreditation for analyses of foods. Accessed October 2026. https://www.ecfr.gov/current/title-21/chapter-I/subchapter-A/part-1/subpart-R
55. US Department of Agriculture, Agricultural Marketing Service. Pesticide Data Program quality control standard operating procedure. Accessed October 2026. https://www.ams.usda.gov/sites/default/files/media/PDPQCSOP.pdf
56. Washington State Department of Ecology. Cannabis laboratory accreditation recommendations. Publication 19-03-004. January 2019. Accessed October 2026. https://apps.ecology.wa.gov/publications/documents/1903004.pdf
57. Roberts C. Study: Colorado cannabis labs produce unreliable THC potency results. MJBizDaily. November 4, 2025. Accessed October 2026. https://mjbizdaily.com/study-colorado-cannabis-labs-produce-unreliable-thc-potency-results/
58. MJBizDaily. THC potency inflated in most Colorado marijuana flower. 2025. Accessed October 2026. https://mjbizdaily.com/thc-potency-inflated-in-most-colorado-marijuana-flower/
59. Jikomes N, Zoorob M. The cannabinoid content of legal cannabis in Washington State varies systematically across testing facilities and popular consumer products. Sci Rep. 2018;8:4519. Accessed October 2026. https://www.nature.com/articles/s41598-018-22755-2
60. Smith BC, et al. Inter-laboratory variation in cannabis analysis: pesticides and potency in distillates. Cannabis Science and Technology. 2019. Accessed October 2026. https://www.cannabissciencetech.com/view/inter-laboratory-variation-cannabis-analysis-pesticides-and-potency-distillates
61. McKernan K, et al. Metagenomic analysis of medicinal Cannabis samples; pathogenic bacteria, toxigenic fungi, and beneficial microbes grow in culture-based yeast and mold tests. F1000Research. 2016;5:2471. Accessed October 2026. https://f1000research.com/articles/5-2471/v1
62. Colorado Marijuana Enforcement Division. 2019 annual update. Accessed October 2026. https://spl.cde.state.co.us/artemis/revserials/rev131internet/rev1312019internet.pdf
63. McKernan K, et al. Media choice and total yeast and mold counts in cannabis. F1000Research. 2021;10:624. Accessed October 2026. https://f1000research.com/articles/10-624/v2
64. Punja ZK, et al. Frontiers in Microbiology. 2023;14:1192035. Accessed October 2026. https://www.frontiersin.org/journals/microbiology/articles/10.3389/fmicb.2023.1192035/pdf
65. Westword. In random mold tests, 80 percent of Denver marijuana dispensaries fail. 2019. Accessed October 2026. https://www.westword.com/news/in-random-mold-tests-80-percent-of-denver-marijuana-dispensaries-fail-11467203/
66. Business of Cannabis. Japan issues update on new THC limits in CBD products, which remain strictest in the world. September 2024. Accessed October 2026. https://businessofcannabis.com/japan-issues-update-on-new-thc-limits-in-cbd-products-which-remain-strictest-in-the-world/
67. Stipulation, agreement, and order: Nordic Analytical Laboratories LLC. Colorado Marijuana Enforcement Division. August 2026. Accessed October 2026. https://drive.google.com/file/d/1o91xvfzEk7kYYJdQohihztnZuq4hnjJW/view
68. Colorado General Assembly. SB26-161, postponed indefinitely April 28, 2026. Accessed October 2026. https://www.leg.colorado.gov/bills/SB26-161
69. International Council for Harmonisation. ICH Q3C(R8): impurities, guideline for residual solvents. Accessed October 2026. https://ema.europa.eu/documents/regulatory-procedural-guideline/ich-guideline-q3c-r8-impurities-guideline-residual-solvents-step-5_en.pdf
70. Holden S. An "ingredient," so says the MED. Lab Effects. October 2026. Accessed October 2026. https://labeffects.com/blogs/news/colorado-med-ingredient-methylene-chloride-vape-recall
71. Colorado Department of Public Health and Environment. 6 CCR 1010-24, regulated hemp facility manufacturing requirements, residual solvent list. Accessed October 2026. https://www.sos.state.co.us/CCR/GenerateRulePdf.do?fileName=6CCR101024&ruleVersionId=11299