1. (1) A CMTL must generate a COA containing the results from each Final Product tested, containing all the information required in paragraph (1)(a) below, and all the information required in paragraphs (1)(b) and (1)(c) below, as applicable. Additional information, analysis, or graphics not expressly required by paragraphs (1)(a) through (1)(c) may be included on any COA required by this rule. All Target Analyte concentrations must be reported on and labeled in the units specified in Rule 64-4.308, F.A.C. All COAs must be delivered to the MMTC as a portable document format (“PDF”) and must be locked to prohibit unauthorized editing.

   1. (a) COAs for Environmental Testing, Microbiological Testing, and Cannabinoid Profile testing must contain:

      1. The name of the MMTC from which the Sample was collected;

      2. The cultivation facility or facilities which cultivated the marijuana from which the Sample was collected;

      3. The processing facility or facilities which processed the marijuana from which the Sample was collected;

      4. The facility from which the Sample was collected;

      5. The Cultivar or Cultivars making up the Sample – if the Retail Batch is comprised of more than two Cultivars, the Testing Sample can be referred to as “mixed Cultivar”;

      6. The Sample’s Retail Batch and harvest batch number(s) and date the Retail Batch and harvest batch were created;

      7. The Sample’s batch number and date any Laboratory Batch was created;

      8. The total units of the Sample’s Final Product received for testing;

      9. Sample’s Total Retail Batch weight or volume;

      10. Total number of units in the Sample’s Retail Batch;

      11. The Sample’s Testing Sample Matrix as one of the following:

      a. Usable Whole Flower Marijuana;

      b. Derivative Product intended for inhalation;

      c. Derivative Product not intended for inhalation; or

      d. Edible.

      12. The internal Employee identification number of any person who performed the Sample preparation;

      13. The date and time of the Sample’s preparation;

      14. The title or number of the SOP used to prepare the Sample;

      15. The title or number of the SOP used to analyze the Sample;

      16. The date and time Sample injection occurred;

      17. The expiration date of the COA results for the retail product. The expiration date of the COA results must be one (1) year or less from the sample date. The expiration date can be increased if the Final Product has gone through a stability study conducted by a CMTL following Food and Drug Administration Guidance for Industry Q1A(R2) Stability Testing of New Drug Substances and Products (https://www.fda.gov/media/71707/download);

      18. A narrative outlining all COA changes resulting in the issuance of a revised COA for the Sample;

      19. The internal Employee identification number of any person who performed the Sample analysis; and

      20. A statement in bolded 14-point font size identifying a retested or amended COA for the Sample. All amended or corrected COAs must be reported to the department with a written narrative as indicated in subparagraph (1)(a)18. above.

      21. All failed COAs must be accompanied by a photographic image of the product label and packaging of the product being tested.

   2. (b) COAs for Environmental Testing and Cannabinoid Profile testing must contain:

      1. The type of instrument used to analyze the Sample;

      2. The initial weight or volume of the aliquot used to prepare the Testing Sample for analysis;

      3. The final weight or volume of the Analytical Sample used in the analysis;

      4. The Target Analytes measured in the test;

      5. The numerical concentration for each Target Analyte measured in the Testing Sample above the LOD and the LOQ. The LOD and LOQ must be calculated with respect to changes including but not limited to Standard Curves, dilutions, injection volume, and Analytical Sample weights. The CMTL must reflect these changes on the COA;

      6. The Target Analytes reported and qualified as follows:

      a. Analytical values reported to three (3) significant figures as <[LOD value] if the concertation falls below the LOD;

      b. Analytical values reported to three (3) significant figures and marked with a qualifier if the concentration falls between the LOQ and LOD;

      c. Analytical values reported to three (3) significant figures if the concentration falls within the Calibration Curve; or

      d. Analytical values reported to three (3) significant figures as >[highest Calibration Curve point concentration] if the concentration falls above the Calibration Curve.

      7. The Dilution Factor of each Target Analyte reported to no more than three (3) significant figures;

      8. The percentage of each cannabinoid and the total percentage of all cannabinoids within the Sample at the CMTL-tested Moisture content reported to three (3) significant figures;

      9. The total concentration in milligrams per Final Product of Total THC and Total CBD calculated at the CMTL-tested Moisture content reported to three (3) significant figures;

      10. The percent relative standard deviation measured for all Edibles reported to 3 significant figures; and

      11. The package label deviation for Total THC and Total CBD using the following formula: Percent Deviation = ((Tested Total THC or Total CBD concentration – Labeled Total THC or Total CBD)/ Labeled Total THC or Total CBD) x 100, and the packaging label deviation for cannabinoid ratio as defined in paragraph 64-4.308(6)(g), F.A.C., reported to no more than three (3) significant figures.

      12. The Acceptable Limit for the analysis conducted.

      13. A statement (i.e., “PASS” or “FAIL”) indicating whether the Sample has passed or failed any and all Acceptable Limits for individual Target Analytes. The indicator statement must be in bolded 14-point font size or larger and must be displayed in a manner that is visually distinct from the information outlined in subparagraphs (1)(b)1.-12. above.

   3. (c) COAs for Microbiological Testing must contain:

      1. The presence or absence of Microbes present in 1 gram;

      2. The Target Analytes measured in the test;

      3. The Acceptable Limit for the analysis conducted;

      4. Total Yeast and Mold numerical concentration reported as CFU per gram reported to three (3) significant figures.

      5. A statement (i.e., “PASS” or “FAIL”) indicating whether the Sample has passed or failed any and all Acceptable Limits for Microbes. The indicator statement must be in bolded 14-point font size or larger and must be displayed in a manner that is visually distinct from the information outlined in subparagraphs (1)(c)1.-4. above.

   4. (d) If a Final Product can be administered through multiple routes of administration, the CMTL must use the more stringent Acceptable Limits.
   5. (e) COAs generated by the CMTL must be delivered to the MMTC and the department within 14 days of the Sample departure date noted on the chain of custody documentation. A CMTL may withhold testing results if payment for services has not been received.

   6. (f) The following actions performed by a CMTL constitute an invalidation of the COA:

      1. Using a method not covered in Rule 64-4.306, F.A.C., or approved by the department;

      2. Sampling not in accordance with Rule 64-4.307, F.A.C.;

      3. Generating Quality Control Sample results not in accordance with Rule 64-4.309, F.A.C.;

      4. Generating standard curve results not in accordance with Rule 64-4.310, F.A.C.;

      5. Performing Manual Integrations not in accordance with Rule 64-4.312, F.A.C; and

      6. Using an SOP for analysis and preparation of samples not included in the CMTL’s ISO/IEC 17025:2017 accreditation.

2. (2) Data Packages. All Target Analyte concentrations must be labeled. CMTLs must create and maintain Data Packages for every analyzed Laboratory Batch. Data Packages must contain:

   1. (a) All COAs for the Retail Batch as required by subsection (1);
   2. (b) Laboratory Batch Quality Control Sample reports;
   3. (c) Unique instrument identifier;
   4. (d) Raw data for each Sample with analysis date stamp. If the failure is for Filth and Foreign Material, the CMTL must include a photograph of the Testing Sample. If the failure is for a Microbial analyte using plating, the CMTL must include a photograph of the plates;
   5. (e) Instrument raw data with injection date and time stamp, if any;
   6. (f) All Standard Curve, Quality Control, and Analytical Sample chromatographic raw data including clear depictions of integrations, if any;
   7. (g) Instrument test method with parameters;
   8. (h) Instrument tune reports, where applicable;
   9. (i) All instrument Calibration and/or tune data;
   10. (j) Internal Standard report;
   11. (k) ICV Report;
   12. (l) CCV Report;
   13. (m) Sample preparation worksheets;
   14. (n) Employee workbook sheets relevant to the analysis run;
   15. (o) Analytical Batch Sample sequence;
   16. (p) Internal laboratory sample chain of custody documentation as described in Rule 64-4.301, F.A.C.; and
   17. (q) Chain of custody documentation as described in Rule 64-4.307, F.A.C.

3. (3) Prior to the dissemination of any documentation contemplated by subsections (1) and (2) to the department or an MMTC, the CMTL’s Laboratory Director, or designee, must:

   1. (a) Review the quantitative analytical results for technical correctness, clarity, and completeness;
   2. (b) Verify that the results of each analysis are accurately reported, and that the results can be traced back to the specific Laboratory Batch; and
   3. (c) Approve the results by signing and dating the Data Package.
4. (4) CMTLs must maintain Data Packages for three (3) years from the date created. Chain of custody documentation, IDOC documentation, CMTL audit reports, and CMTL on-site inspection reports must be retained for a minimum of three (3) years from the date created. Quality Control reports and Proficiency Testing results must be retained for a minimum of two (2) years from the date of receipt by the CMTL. Video surveillance recordings must be maintained for a minimum of 45 days or longer upon the request of a law enforcement agency, the department, or as ordered by any court of competent jurisdiction.

5. (5) Supporting documentation. Upon request by the department, a CMTL must provide the department with copies of the following within two (2) business days of the department’s request:

   1. (a) Proof of accreditation required by department rules;
   2. (b) All materials and documents submitted for the most recent ISO/IEC 17025:2017 accreditation audit;
   3. (c) SOPs;
   4. (d) Analytical Methods;
   5. (e) Equipment logs;
   6. (f) Raw analytical data;
   7. (g) Initial Display of Competency documentation;
   8. (h) Chain of custody documentation;
   9. (i) Sample rejection logs;
   10. (j) Quality Assurance reports;
   11. (k) Proficiency Testing results;
   12. (l) Quality Assurance Manual;
   13. (m) Personnel qualification, training, and competency documentation;
   14. (n) Purchasing and supply records;
   15. (o) Method verification and validation records;
   16. (p) Quality Assurance and Quality Control records;
   17. (q) Equipment service records;
   18. (r) Non-conforming work and corrective action records;
   19. (s) Internal and external audit records;
   20. (t) Testing Facility and Secure Storage area security records;
   21. (u) Data Packages;
   22. (v) Data backup records;
   23. (w) Data reports, data review, and data approval records;
   24. (x) Any report or COA created for an MMTC;
   25. (y) Any analytical testing data:
   26. (z) Traceability records;
   27. (aa) Standards records;
   28. (bb) Calibration records;
   29. (cc) Extraction logs and Certified Reference Materials records;
   30. (dd) Analyst notebooks and logbooks;
   31. (ee) Sample analysis reports;
   32. (ff) Contamination records;
   33. (gg) Cleaning records;
   34. (hh) Safety and chemical-hygiene records;
   35. (ii) R&D testing results;
   36. (jj) Any other generated report related to the testing of marijuana;
   37. (kk) Any other generated report related to the audit or on-site inspection of MMTCs, to include any materials used in the creation of such report; and
   38. (ll) Any other document or record necessary to substantiate compliance with sections 381.986 and 381.988, F.S., and department rules.
6. (6) A CMTL must provide the requested records to the department electronically in an accessible format. If the CMTL provides such records in a protected format (i.e., a locked PDF), the CMTL must simultaneously provide the department with a password to unlock the record for access and analysis.

Rulemaking Authority Art. X, § 29, Fla. Const., 381.988(3), 381.988(9) FS. Law Implemented Art. X, § 29, Fla. Const., 381.988 FS. History–New 5-28-26.