Compliance Testing vs. Potency Testing: What's the Difference?

October 14, 2026

Photo by DarkoStojanovic via Pixabay.

A batch of flower can sail through potency testing with a THC number that matches the label to the decimal point and still never make it onto a dispensary shelf, because it's carrying aspergillus or a pesticide residue over the action limit. The reverse happens just as often: a batch clears every contaminant screen with a spotless certificate of analysis, gets packaged and sold, and turns out to be labeled well above what it's actually testing at. Both of these are real, common outcomes, and both point to the same underlying confusion that trips up growers and consumers alike -- compliance testing and potency testing are not the same thing, even though people use the terms as if they were.

Regulators don't treat them as interchangeable. They're separate, distinctly scoped panels with different instruments, different failure thresholds, and in a lot of states, different labs running them. One asks whether a product is safe to consume. The other asks whether the label is telling the truth about strength. A product can pass one and fail the other, and in 2026 that gap has turned into one of the more active regulatory flashpoints in the industry -- Massachusetts yanking retail product off shelves over THC discrepancies, California stripping testing permits from four labs in under three years, Colorado lawmakers openly discussing whether commercial labs should keep their oversight role at all. This piece breaks down what each test actually screens for, why the distinction matters whether you're growing for a compliance market or just buying from one, and what this year's enforcement actions reveal about a testing system that, in places, has been quietly gamed.

Compliance Testing: The Full Safety Panel

Photo via Unsplash.

Compliance testing is the mandatory umbrella panel every legal batch has to clear before it touches a shelf, and it's not one test -- it's a stack of them, run against a stack of separate thresholds. Depending on the state, a compliance panel typically covers pesticide residues, heavy metals (lead, arsenic, cadmium, mercury), residual solvents left over from extraction, microbial contaminants like E. coli and salmonella, mycotoxins, water activity, and moisture content. Each of these has its own pass/fail line, set independently of anything related to cannabinoid percentage.

That independence is the whole point. If a batch comes back with chlorpyrifos or bifenazate over the state's action limit, that batch fails, full stop, regardless of whether the THC number on the proposed label is dead accurate. Potency has no bearing on a pesticide failure, a heavy metal failure, or a microbial failure. Regulators built it this way deliberately, so that a well-grown, high-THC batch can't get a pass on safety screens just because the cannabinoid profile looks good.

Water activity and moisture content look like minor housekeeping metrics next to pesticide and heavy metal panels, but they're doing real predictive work. Water activity (aw) measures how much free moisture is available for microbial and fungal growth, and most compliance frameworks cap it somewhere around 0.65 aw for flower. A batch can test clean for mold and mycotoxins on the day of testing and still be sitting right at the edge of that threshold, which means it's not actually safe in the sense that matters to a consumer three weeks later in a jar on a shelf -- it's a batch primed to develop mold risk in storage. That's the forward-looking function this part of the panel serves, and it's a big part of why legal product, cured and dried to spec, behaves so differently in storage than untested material.

This is also the piece of the testing regime most responsible for the actual safety gap between legal and illicit market cannabis. Potency inflation controversies get headlines, but they're a labeling problem. Compliance testing, when it's working, is the thing standing between a consumer and moldy or pesticide-laden product -- which is a different and arguably more serious category of problem entirely.

Potency Testing: Just One Piece of the Panel

Photo via Unsplash.

Potency testing is narrower than people assume, and it's worth being precise about what it actually measures: cannabinoid concentration. THC, CBD, and increasingly a panel of minor cannabinoids get quantified, and that number becomes the basis for what goes on the label. It is a compliance requirement in the sense that every state mandates it before sale, but it's scoped to answer exactly one question: does the label match what's in the package. It says nothing about pesticides sitting in the same sample, nothing about mold, nothing about heavy metals. A lab can run a flawless potency panel on a batch that would fail every other screen in the building.

States have built real structure around how potency gets sampled, because a single pull from a single jar doesn't represent an entire batch. New York's Office of Cannabis Management, for example, requires five samples tested across a batch under 9 NYCRR, with homogeneity established among three consecutive batches or lots before a producer can lean on reduced sampling going forward. The logic is straightforward: plant material isn't uniform. Cannabinoid concentration varies by bud position on the plant, by curing conditions, even by which cola a sample happened to come from, and five pulls get you closer to a representative average than one does.

That's also why every state builds in a variance window rather than demanding an exact match to the labeled number. Plant material has natural variability, and lab instruments themselves carry margin of error -- results can shift slightly based on calibration, extraction method, and even which lab ran the sample. A variance band isn't regulators being lax; it's an acknowledgment that biology and instrumentation both have noise in them.

Put those two things together and you get the central, underappreciated truth of this whole topic: a product can be dead-on accurate for THC percentage and still get pulled from shelves for a mold or pesticide failure, and a product can be spotless on every contaminant panel and still get pulled for being mislabeled on potency. They're genuinely independent outcomes.

How Tight Is 'Accurate' Potency, Really?

Allowed THC label variance ranges differ by state rule, with MA enforcement permitting the widest margin (75%-125% of labeled THC) compared to the narrower ranges under NY Sec. 113.12 and 123.6.

Accurate is doing a lot of work in that phrase, because the legal definition of accurate potency varies more than most people realize, and it varies a lot by state. New York runs two different standards depending on the regulation you're looking at: Section 113.12 sets an allowable range of 90-110% of labeled potency, while Section 123.6 permits a wider band of 85-115%, and on top of either of those, labs get an additional +/-2% allowance for measurement variability. So a product labeled at 20% THC could, depending on which section applies, legally test across a fairly wide range and still be considered compliant.

Massachusetts took a visibly harder line starting in May 2026. Rather than relying solely on producer-submitted lab results, the Cannabis Control Commission began independently re-testing retail THC claims, and it set its own enforcement threshold at 75-125% of labeled amount -- pulling anything that fell outside that band from retail shelves. That's a wider mathematical window than New York's standard, but the enforcement mechanism behind it is the real story: an independent re-test, run by the regulator rather than trusted to the original producer-selected lab, catching discrepancies that a self-reported COA wouldn't have flagged.

The practical consequence of all this is that a product compliant in one state could fail outright in another, with zero change to the product itself -- only the regulatory ruler changes. A batch tested and labeled at 22% THC that sits at 25.5% actual potency clears Massachusetts' 125% ceiling by a hair but could trip a tighter standard elsewhere.

None of this means the variance windows themselves are evidence of regulatory sloppiness. Cannabinoid distribution within a single plant is naturally uneven -- a cola's upper third routinely tests higher than its lower third, and batch averages smooth over real physiological variation that exists whether or not anyone's measuring it. The variance bands exist because the underlying biology demands them. The problem isn't that tolerance exists; it's how far some actual results have drifted outside even generous tolerance, and why.

Why Potency Inflation Became a 2026 Scandal

Photo by Elsa Olofsson via Unsplash.

2026 has been the year potency testing stopped being a quiet back-of-house QA step and became a public credibility problem. A widely cited study released this year found that 48% of licensed cannabis products tested deviated by more than 20% from their labeled THC concentration -- not a rounding error, a near-coin-flip's worth of products with a meaningfully wrong number on the label. A separate peer-reviewed study in PLOS One, examining Colorado dispensary samples, found something almost counterintuitive: average observed potency ran 23.1% lower than the lowest value stated on the label, meaning the deviation problem isn't purely inflation -- some products are shipping with real potency well below what's printed, too.

California's enforcement record gives the clearest picture of how this happens at the lab level. The Department of Cannabis Control has pulled testing permits from four labs since December 2023 -- NCALC, ProForma Labs, California Cannabis Testing Labs, and Verity Analytics -- with Verity accused of overstating THC results by as much as 32%. That's not measurement noise; that's a lab producing numbers that systematically flattered whoever was paying for the test, which is exactly the incentive structure critics have been warning about for years: producers can shop around for the lab that returns the number they want.

Enforcement hasn't been clean on the other side either. An administrative law judge reviewing DCC's case against a fifth lab, BelCosta, found the agency's case was built on insufficient evidence and called the DCC's actions unduly punitive -- a useful reminder that the regulators chasing lab fraud aren't infallible themselves, and that due process matters even when the underlying problem (potency inflation) is real and well-documented.

California responded by opening rulemaking in June 2026 specifically aimed at preventing lab shopping and potency inflation going forward -- not just punishing bad actors after the fact, but restructuring the incentives that let it happen. Colorado took a more structural swing at the same problem in April 2026, with lawmakers considering stripping commercial labs of their state oversight role entirely and shifting toward state-collected dispensary samples rather than samples a producer chooses and submits. Different states, same diagnosis: letting the party with the incentive to inflate also choose the lab and the sample is the design flaw.

The Federal Hemp Shift That Changes Potency Math

Federal hemp law changed the actual math behind potency testing in a way that's easy to miss amid the state-level lab scandals, but it matters just as much. P.L. 119-37, signed November 12, 2025, moves hemp regulation off the old delta-9-only THC standard and onto a total THC metric -- meaning labs now have to account for THCA's conversion potential, not just the delta-9 molecule sitting in the sample at test time. Under the new law, hemp is capped at 0.3% total THC by dry weight, and products also face a container-level cap of 0.4 milligrams of total THC per container -- a dramatically stricter ceiling than most hemp-derived beverages and edibles on shelves today were formulated around.

That shift from delta-9-only to total THC isn't a technicality. A hemp flower product that comfortably cleared the old standard because its delta-9 reading sat under 0.3% can fail outright under a total THC calculation if its THCA content was high enough to push the converted total over the line. Formulators who built products around the old math are now looking at reformulation, not just relabeling.

Congress softened the landing somewhat with a stopgap bill, P.L. 119-103, signed September 2, 2026, which delayed most of these new restrictions to December 11, 2026 -- buying the industry a few more months to adjust formulations and testing protocols. But that delay has a carve-out that matters: products containing cannabinoids the plant can't produce naturally on its own -- synthesized or isomerized cannabinoids, the delta-8-from-CBD category of products -- keep the original November 12, 2025 effective date. Those products are already subject to the new total THC standard right now, stopgap or no stopgap.

For anyone running a potency panel, this changes the calculation itself, not just the compliance threshold sitting on top of it. Getting labeling right going forward depends as much on labs correctly implementing total THC methodology as it does on any of the state-level enforcement crackdowns getting attention elsewhere.

What This Means for Growers Choosing Genetics

For growers producing into compliance markets, the practical lesson in all of this is about variance, not about chasing a specific number. Tight bands like New York's 90-110% window reward a crop that expresses cannabinoids consistently, plant to plant and cola to cola. A crop full of genetic variability -- some plants running hot, some running noticeably lower -- makes it mathematically harder to land a representative sample average inside a narrow band, because the five-sample pull required under New York's framework is going to catch that spread. Homogeneous genetics aren't just a quality nicety; they're a direct input into whether a batch clears potency testing at all.

This is one of the more concrete reasons to start from well-bred, stable seed lines rather than inconsistent or poorly stabilized genetics -- it's genuinely one of the places where Seedtiva's focus on quality, well-bred genetics pays off downstream, reducing the plant-to-plant variability that otherwise shows up as a failed potency test or an inconsistent COA at harvest, batch after batch.

Genetics, though, has essentially nothing to do with the other half of this equation. Contaminant risk -- mold, pesticide residue, heavy metals -- is overwhelmingly a function of cultivation and curing practice, not seed selection. A perfectly bred, genetically stable plant grown with sloppy IPM, over-fertilized with contaminated inputs, or dried too wet and cured in a humid room will still fail a compliance panel. Passing the full safety panel is a growing-discipline problem; passing potency testing within a tight variance band is substantially a genetics problem. They're separate challenges solved by separate practices, and no seed line, however well-bred, guarantees a pass on either front -- outcomes depend heavily on climate, grow setup, and curing conditions, and that variability is real no matter what's written on the seed packet.

It's worth holding onto some perspective here, too. Even amid all the potency inflation controversy making headlines this year, legal tested product consistently shows dramatically lower pesticide, mold, and heavy metal levels than illicit market cannabis. The compliance side of testing -- the unglamorous panel that never makes the news -- is largely doing exactly what it's supposed to do. The scandal is specific to potency reporting, not to the testing system as a whole.

Potency testing gets the headlines because a wrong THC number is easy to understand and easy to be angry about -- you paid for a certain strength and got noticeably less, that's a story anyone can follow. Compliance testing's contaminant screening doesn't generate the same outrage, partly because when it's working, nothing happens. No one writes an angry post about the mold that didn't make it into their jar because the water activity panel caught a batch before it shipped. But that invisible panel is the one actually standing between consumers and pesticide residue, heavy metals, and mycotoxins -- it's doing the harder, less visible job.

The regulatory fixes moving through statehouses and agencies right now are all converging on the same diagnosis. Colorado's push toward state-collected dispensary samples, California's anti-lab-shopping rulemaking, the federal shift to a total THC metric for hemp -- these are different mechanisms aimed at the same structural flaw: producers and labs that profit from an inflated number shouldn't be the ones choosing what gets tested, how it's sampled, or which lab runs it. That's not a potency-testing problem or a compliance-testing problem specifically. It's an incentive problem, and it shows up most visibly in potency because potency is where the financial upside of cheating sits.

Treat a certificate of analysis as two separate questions from now on, because that's what it actually is. Is the potency number on this label believable, given the state's variance band and the lab's track record? And, independently, did this batch actually clear the full safety panel -- pesticides, heavy metals, microbials, mycotoxins, water activity? A product can ace one of those questions and quietly fail the other, and nothing on a glossy label tells you which situation you're looking at. The only way to know is to ask both questions separately, every time.