Does a Texas COA Need a QR Code?

Short answer: yes. A QR code verifying the authenticity of testing at an accredited laboratory is one of the twelve fields that 25 TAC §300.301(d) requires on a certificate of analysis, as a condition of sale in Texas.

Source: 25 TAC §300.301(d), adopted rules filed with the Secretary of State March 2, 2026 (TRD-202601066). In effect March 31, 2026.

Why the opposite answer is circulating

Guidance is going around saying a QR code is not required and a URL is enough. That statement is not invented — it is about the wrong rule.

There are two separate requirements here, and they are being answered with each other:

• What the label must carry. A distinct labelling requirement, about the outside of the product.
• What the certificate must contain. 25 TAC §300.301(d), about the document itself.

Advice about the first is being applied to the second. If you read "a URL is enough" and conclude your certificates do not need a QR code, you have taken a label answer and used it on a COA question.

What we will and will not tell you

The COA field set is verified. Our review confirmed the twelve-field list against two independent official publications — the DSHS adopted-rule text and the Texas Register adoption notice (TRD-202601066) — and the HempDash compliance team ratified the interpretation on 17 August 2026. The QR code is in that list.

The label requirements are not. We have no reviewed record for them. Our Texas Rule Center publishes a source boundary on that topic rather than a checklist, precisely so nobody does what the circulating guidance just did — publish an unverified list confidently enough that people act on it.

So this page will tell you what the certificate must contain. It will not tell you what your label must carry, because we have not confirmed that against the primary source, and a plausible-sounding answer is worse than an acknowledged gap.

What the QR field is actually for

The function is to close the loop back to the issuing laboratory. A PDF is trivially editable. A verifiable route back to an accredited source is what separates a certificate from a document that resembles one.

That is also why "a URL somewhere in the chain" is not obviously equivalent. The requirement names a QR code verifying authenticity of testing at an accredited laboratory. Whether some other mechanism satisfies it is an interpretation question, and this page does not answer interpretation questions it has not had reviewed.

What to do with this

Pull one certificate off your shelf and check for the QR code specifically. It sits alongside the other fields that go missing most often — the expiration date, the limits of detection and quantitation, and the measurement-of-uncertainty parameters.

If it is absent, that is a certificate defect to take back to the laboratory or the vendor. It is not something you can fix by adding a URL to your label, because those are two different rules.