Colorado cannabis testing requirements

Required tests

• Potency
• Pesticides
• Residual solvents
• Heavy metals
• Microbials
• Mycotoxins
• Water activity
• Homogeneity

ISO/IEC 17025 accreditation

Required within a set period. Labs must hold ISO/IEC 17025 accreditation whose scope covers each MED-certified testing category; after initial license approval MED may grant provisional certification for up to 12 months while accreditation is obtained (1 CCR 212-3 Rules 5-415(C)(2)(a) and 6-415(C)(2)(a)).

Notes

• Rules in force: 1 CCR 212-3, version effective Jan 5, 2026. Testing program is Part 4 (Rules 4-205 to 4-245); lab certification and ISO rules are 5-415 (medical) and 6-415 (retail).
• Potency (Rule 4-210): must cover D8-THC, D9-THC, D10-THC, exo-THC, THCA, CBD, CBDA and CBN. Flower is tested per strain (4 initial batches, then at least quarterly); every production batch of concentrate, product, pre-roll and infused pre-roll is tested unless a Reduced Testing Allowance applies.
• Homogeneity (Rule 4-210(E)): products fail if the relative standard deviation across four servings is 10% or more for a labeled cannabinoid; potency variance is ±15% above 2.5 mg per serving.
• Microbials (Rule 4-215(E)(1), (J)(3)): STEC, Salmonella and Aspergillus (A. fumigatus, flavus, niger, terreus) absent in 1 g; total yeast and mold under 10^4 CFU/g. Oral and skin products are exempt from Aspergillus. Audited products (nasal, rectal, vaginal) add total aerobic count, S. aureus, P. aeruginosa, bile-tolerant gram-negatives and Candida albicans.
• Water activity (Rule 4-215(E)(2), (J)(4)): flower, shake, trim and pre-rolls; limit 0.65 aW.
• Pesticides (Rule 4-215(E)(5), (J)(8)): flower, wet whole plant, all concentrates, pre-rolls and hemp products, against a long analyte list with action limits. Not required on edibles or topicals.
• Heavy metals, called elemental impurities (Rule 4-215(E)(6), (J)(7)): arsenic, cadmium, lead and mercury on flower, concentrates, products, pre-rolls and hemp products. Limits vary by intended use (inhaled, oral, topical). Vaporizer devices get emissions testing.
• Residual solvents (Rule 4-215(E)(3), (J)(6)): only solvent-based concentrates, audited products containing them, and hemp products. The expanded 31-solvent table (in rule from July 1, 2026) is enforced from Sept 28, 2026 (Industry Bulletin 26-09). Triethylamine is enforced later, with at least 72 hours' notice.
• Mycotoxins (Rule 4-215(E)(4), (J)(5)): aflatoxins B1+B2+G1+G2 under 20 ppb total and ochratoxin A under 20 ppb. Required only for decontaminated flower and pre-rolls, solvent-based concentrate remediated from flower that failed microbials, and concentrate from wet whole plant not tested for microbials.
• Reduced Testing Allowance (Rule 4-230): after a run of passing batches, contaminant testing frequency can drop. Mycotoxin tests generally cannot be reduced. MED can still order random, risk-based or for-cause testing at any time (Rule 4-205).
• Hemp products received by MED licensees must pass microbial, residual solvent, pesticide and elemental impurity testing at an MED-licensed testing facility (Rule 4-215(D)-(E); Industry Bulletin 25-16).
• Vitamin E acetate, PEG and MCT oil are banned ingredients in inhaled concentrates and products (Rule 3-335(K)). They are not a required lab test. Terpene and moisture testing are not required.
• CDPHE's role: its State Lab inspects testing facilities and sends a certification recommendation to MED. It also receives proficiency-testing results and method-change and nonconformance notices, and runs a reference lab used in MED's 2025-26 surveillance testing program (Industry Bulletin 25-11). MED approves proficiency-testing vendors for contaminants; CDPHE is the potency proficiency-testing contact.
• Pending: rule revisions adopted in September 2026 take effect November 1, 2026 (SOS tracking 2026-00310). Among other changes, homogeneity becomes serving 'uniformity', and any cannabinoid making up 10% or more of total cannabinoids becomes subject to potency testing.