Introduction

As the UK market for CBD matures, so too do the tools available to confirm product authenticity. In 2026, savvy shoppers can use three complementary methods — QR codes, batch-specific Certificates of Analysis (COAs) and blockchain-backed traceability — to make informed purchases. This guide explains what each tool does, what to look for on lab reports, how UK regulatory checks work, and practical steps to verify a product before you buy.

Key concepts at a glance

• FSA novel food listing: the Food Standards Agency (FSA) still treats CBD as a novel food; a brand listed or engaged with the FSA indicates regulatory engagement.
• Batch-specific COA: must come from an independent ISO/IEC 17025-accredited laboratory and match the product batch number.
• THC compliance: in the UK, THC is assessed at the product/container level — COAs should state an exact THC figure (commonly referenced as under 1 mg per container) rather than vague claims.
• Traceability: blockchain tools and certification platforms can provide ‘shelf-to-seed’ provenance and link directly to lab results.
• QR codes: dynamic QR codes on packaging are the fastest consumer tool to access up-to-date, batch-specific documentation.

Why the FSA novel food submissions matter

The FSA continues to treat CBD as a novel food. A listing or submission on the FSA register does not make medical claims credible, but it does show a brand has engaged with the regulator and supplied safety data. When verifying a product, look for a clear statement from the brand confirming their FSA status or check the FSA register yourself — absence of any engagement is a legitimate cause for further questioning.

Understanding batch-specific COAs: what must be on them

A legitimate COA is the cornerstone of authenticity. Look for the following:

• ISO/IEC 17025 accreditation: the testing lab should be independent and accredited; the COA should state the lab name and accreditation.
• Batch number match: the COA must reference the exact batch or lot number on the product packaging.
• Cannabinoid profile: a full breakdown of cannabinoids (CBD, CBDA, CBDV, CBG, THC etc.), with quantities given in mg/g or mg per container.
• Precise THC figure: UK compliance is assessed at the container level, so the COA should state the exact THC amount rather than vague terms like “non-detectable”. Many brands report the exact mg of THC per container — this is the figure to check.
• Contaminant screens: heavy metals, pesticides, residual solvents and microbial testing should be shown with pass/fail results and detection limits.
• Date and signature: COAs should be recent and signed or digitally validated. Industry guidance flags COAs older than ~12 months or generic company-level reports as a red flag.

Red flags on COAs

• Batch number on the product does not match the COA.
• COA is generic (company-level) rather than batch-specific.
• Lab is unnamed or lacks ISO/IEC 17025 accreditation details.
• THC reported only as “trace” or “non-detectable” without a numeric figure.
• Report is older than about 12 months without valid explanation.

QR codes: the consumer’s fastest check

QR codes on packaging are the easiest way to access batch COAs and provenance information. There are two types to understand:

• Static QR codes: link to a fixed URL or PDF. Useful, but can become outdated if the brand updates documentation.
• Dynamic QR codes: can be updated centrally without reprinting packaging. These are preferable because they can point to the current batch COA, show time-stamped access logs, and reduce the risk of falsified PDFs.

When scanning a QR code, check that the resulting page is served over HTTPS, displays the batch ID that matches your product, and links to a dated COA or live blockchain entry. Avoid sites that redirect to generic marketing pages or require you to download an unsigned PDF whose metadata looks altered.

Blockchain traceability and provenance

Blockchain tools now allow brands to attach immutable records to batches. Platforms such as the Cannabis Accreditation Network’s CanCheck (for example, CanCheck.org) offer shelf-to-seed traceability: growers, processors and labs can anchor records to a chain so consumers can verify origin, processing steps and the linked lab result. Some CAN-certified suppliers — including certain HempFlax and Jacob Hooy lines — are already live in UK retail. A blockchain entry typically includes timestamps, participants and a hash that links to the COA. While blockchain does not replace an accredited lab report, it strengthens provenance and helps detect tampering.

A practical consumer checklist (in-store or online)

1. Scan the product QR code: confirm it is dynamic (updateable), served over HTTPS, and displays the exact batch number.
2. Open the COA: check the lab is ISO/IEC 17025-accredited, the date is recent (<12 months), and the batch number matches.
3. Confirm the cannabinoid profile and the exact THC amount per container — avoid vague statements.
4. Look for contaminant screens (heavy metals, pesticides, solvents, microbes) and clear pass/fail thresholds.
5. Search for FSA novel food submission or confirmation that the brand has engaged the FSA.
6. When available, check blockchain provenance or CanCheck-style entries to validate supply-chain steps and linked lab results.

Examples of formats to check

Whether you’re buying an oil, edible, tincture or vape cartridge, the same principles apply. For example, check the batch COA and provenance if you pick up a bottle such as the Wylde Natural Cold-Pressed Drops 1000mg, a gummy product like Wylde CBD Gummy Bears, an isolate or 0‑THC option such as CBD Living 0‑THC Tincture or a vape cartridge like the Blue Cheese Canavape CBD Cartridge. Different formats may raise different questions (e.g. container THC totals for edibles), so always check the batch COA.

Conclusion

Verification in 2026 is more accessible than ever. A robust approach combines: (1) confirming FSA engagement, (2) inspecting a batch-specific ISO/IEC 17025 COA with an explicit THC figure and contaminant screens, and (3) using QR-linked documentation and blockchain provenance to validate origin. Retailers and premium brands increasingly present these elements together — QR-accessible COAs plus blockchain-backed records are fast becoming best practice. By following the checklist above you can shop with greater confidence and spot red flags before you buy.

Note: this article is informational and not medical or legal advice. Always exercise judgement when buying CBD products and ask the retailer for clarification if something is unclear.