The honest answer is: it depends on who grew it, how it was tested, and whether you can verify that testing before you buy. THCA flower from a licensed, transparent retailer with batch-specific lab results is as safe as any regulated cannabis product. THCA flower from an unlabeled bag at a gas station with a QR code that goes nowhere is a different situation entirely.
Safety in this market isn’t assumed — it’s earned through testing. This guide walks through what that testing covers, what it means on a lab report, what the real risks are when it’s absent, and how to read a Certificate of Analysis so you know what you’re actually getting. You can browse our tested inventory at the Asheville Dispensary THCA flower shop — every strain we carry has a publicly accessible, batch-specific COA before you order.
Is THCA Flower Safe to Smoke?
For healthy adults, properly tested THCA flower from a reputable source carries a risk profile similar to traditional cannabis. The THCA compound itself is non-intoxicating in its raw form. When smoked or vaporized, it decarboxylates — converting to active Delta-9 THC — which produces the effects most people associate with cannabis.
The safety question isn’t really about THCA as a molecule. It’s about what else might be in the flower. The cannabis plant is a known bioaccumulator of environmental contaminants. It pulls from whatever’s in the soil and surrounding environment — and without proper testing, those contaminants can make their way into the product you’re consuming.
The risks that laboratory testing is specifically designed to catch include:
- Pesticide residues — from agricultural applications during the grow
- Heavy metals — lead, cadmium, arsenic, and mercury, which can accumulate in plant tissue from contaminated soil
- Mold, yeast, and fungi — including Aspergillus species that produce harmful mycotoxins
- Mycotoxins — toxic secondary metabolites produced by certain molds, which can persist even when mold itself isn’t visible
- Microbial contamination — bacteria and pathogens that pose risks particularly to immunocompromised consumers
When a retailer provides a full-panel COA from an accredited, independent laboratory, you can see directly that a product has been tested against all of these categories. When they don’t — or when the COA only covers potency — you’re operating blind on the things that matter most for safety.
The Unregulated Market Problem
Here’s the context that makes this matter: the hemp market operates without a mandatory federal testing standard for contaminants. Unlike state-licensed cannabis dispensaries — where products must pass independent safety testing before reaching shelves — hemp products sold online and in smoke shops have no uniform federal requirement to test for pesticides, mold, heavy metals, or mycotoxins before they reach consumers.
The USDA’s hemp laboratory testing guidelines note that while USDA strongly encourages ISO 17025 laboratory accreditation for hemp testing, it is not federally required. Testing requirements vary by state program, and for products sold online across state lines, enforcement of any safety standard is inconsistent at best.
The practical consequence: a meaningful portion of THCA flower products available online have only been tested for Delta-9 THC compliance — the number that determines legal status — with no independent verification of what else they contain.
Research published through Arizona State University found that 16% of illicit cannabis samples tested positive for harmful mycotoxins, with Fusarium mycotoxins detected at concentrations exceeding typical agricultural safety thresholds. While that study focused on seized, unregulated product, it demonstrates what’s possible when safety testing isn’t part of the supply chain. The researchers specifically noted there are no federal or state monitoring programs for Fusarium contamination in legal cannabis, making independent lab testing the only available safeguard.
This isn’t a reason to avoid THCA flower. It’s a reason to buy from retailers who test rigorously and publish the results.
What a Full-Panel COA Covers
COA stands for Certificate of Analysis. It’s the lab report that documents what’s in a specific batch of flower. Not all COAs are created equal — the most important distinction is between a potency-only COA and a full-panel COA.
Potency-only COA covers cannabinoid percentages: THCA, Delta-9 THC, CBD, CBG, and so on. It tells you the strength of the product and confirms federal hemp compliance. It tells you nothing about safety.
Full-panel COA covers potency plus every safety category that matters for consumer protection. Here’s what a genuinely comprehensive lab report includes:
Cannabinoid Potency
The full breakdown of cannabinoids — THCA, Delta-9 THC, Delta-8 THC, CBD, CBG, CBN, and others. This is what determines both the effect profile and legal compliance. Delta-9 THC must read at or below 0.3% by dry weight for the product to qualify as legal hemp.
Pesticides
A reputable lab tests for dozens of individual pesticide compounds — organophosphates, pyrethroids, carbamates, and others — each with a specific action limit measured in parts per million or parts per billion. A passing result means each individual compound came in below its allowable threshold. A failing result on any one compound means the batch should not reach consumers.
Heavy Metals
The four metals tested as standard are lead (Pb), cadmium (Cd), arsenic (As), and mercury (Hg). Cannabis is a documented bioaccumulator — its root system actively draws compounds from the soil, including heavy metals if they’re present. A 2019 FDA comment period submission analyzing hemp and cannabis products for heavy metal contamination, filed with the agency via regulations.gov, specifically identified cannabis plants as potential bioaccumulators of heavy metals, with concentration risks increasing during extraction processes. For flower, the risk is lower than for concentrates, but it’s real — and only testing confirms the result.
Microbial Contaminants
Standard microbial testing checks for total yeast and mold count, Aspergillus species (A. fumigatus, A. flavus, A. niger, A. terreus), E. coli, and Salmonella. Aspergillus is the primary concern for cannabis consumers — particularly immunocompromised individuals — because certain species produce aflatoxins, a class of potent mycotoxins. A peer-reviewed review in Frontiers in Microbiology (University of Tennessee, Arizona State University, Simon Fraser University) found that the fungal mycobiome of cannabis and hemp consists of over 100 species, including several capable of producing toxic secondary metabolites and initiating opportunistic infections in vulnerable patients. Microbial testing is the only way to know whether a given batch carries this risk.
Mycotoxins
Mycotoxin testing, typically covering aflatoxins B1, B2, G1, G2 and ochratoxin A, is distinct from microbial testing. Even when mold has been killed or is not visibly detectable, its toxic byproducts can persist in plant tissue. A batch can pass microbial count limits and still carry mycotoxin residue. Full-panel testing addresses both.
Terpene Profile
Terpene testing isn’t a safety panel — it’s a quality and transparency panel. It tells you the actual aromatic and flavor compounds present in a specific batch, which is how you know whether the aroma and effect profile matches what’s described on the product page. Retailers who publish terpene data are giving you information you can verify; retailers who only describe their flower in marketing language are not.
What ISO 17025 Accreditation Means
When a COA comes from an ISO 17025-accredited laboratory, it means the testing facility has been independently evaluated and certified to meet international standards for technical competence, impartiality, and accuracy.
ISO 17025 is the global benchmark for testing and calibration laboratories. Accreditation under this standard means the lab has:
- Validated and documented testing methods
- Properly calibrated equipment with traceable standards
- Quality management systems that govern how samples are handled and results are reported
- Regular third-party audits to confirm continued compliance
- No financial relationship with the producers whose samples they test
The American Association for Laboratory Accreditation (A2LA) and other recognized bodies provide this accreditation specifically for cannabis and hemp testing labs. When a COA lists an ISO 17025-accredited lab, the results carry demonstrably more weight than results from a non-accredited facility.
Non-accredited labs are not automatically fraudulent — but they’re not independently verified, and their results can’t be compared to an objective external standard. In a market where lab shopping (sending samples to multiple labs until one produces a favorable result) has been a documented problem, accreditation matters.
Red Flags When Reviewing a COA
Knowing how to read a COA is half the work. The other half is knowing what should raise concern. Here’s what to watch for:
No COA at all. Any retailer who can’t produce a lab report for a product they’re selling is asking you to take their word for it. Don’t.
Potency only, no safety panels. A COA that shows cannabinoids but nothing about pesticides, metals, or microbials is not a safety document. It’s a potency claim.
Old test dates. A COA from 12–18 months ago doesn’t reflect the batch currently in inventory. Look for test dates within 6 months of your order, ideally tied to a specific harvest or batch number.
No batch number. A COA without a batch ID that matches what’s on your product packaging cannot be verified as belonging to what you actually received.
Non-accredited lab. Check whether the lab is ISO 17025 accredited. Lab name alone tells you nothing without that credential.
Results right at the legal limit. A Delta-9 THC reading of exactly 0.29% on every batch from a given retailer is statistically improbable. It may indicate result manipulation or selective reporting.
QR codes that don’t work or redirect to a generic page. The QR code on the packaging should link directly to the batch-specific test results, not a homepage.
What Makes THCA Flower Safe to Buy
Safety in this category comes down to four things working together:
- Clean soil and controlled growing conditions. Heavy metal contamination starts at the cultivation level. Indoor growing in controlled environments with clean, tested growing media eliminates the primary pathway for soil-based heavy metal uptake. Sun-grown and greenhouse flower on verified clean land can also produce safe results — but the starting conditions need to be known and documented.
- Pesticide-free or approved-pesticide cultivation. The safest grows either use no pesticides at all or use only compounds cleared for cannabis cultivation with established safety limits. Either way, independent testing confirms the result.
- Proper drying and curing to prevent mold. Mold contamination happens post-harvest when flower is dried too quickly, stored at excess humidity, or improperly handled during processing. Proper cure under controlled temperature and humidity conditions, followed by airtight packaging with humidity management, prevents the conditions that allow Aspergillus and other molds to establish.
- Full-panel, batch-specific testing from an ISO 17025-accredited lab. All of the above controls help — but testing is the independent verification that they worked. A COA from an accredited lab confirms what cultivation practices can only claim.
How Asheville Dispensary Approaches Testing
Every strain we carry at Asheville Dispensary comes with a batch-specific Certificate of Analysis from an independent, accredited laboratory. We publish these COAs on each product page so you can review them before you place an order — not after.
Our catalog spans four product tiers — Private Reserve, Exotic, Greenhouse, and Small Buds — and regardless of tier, the testing standard is the same. We don’t list a strain that we can’t back with documentation.
We look for full-panel coverage, not potency-only reports. We check lab accreditation. We verify test dates match current inventory. And we don’t carry products from sources we can’t trace. That’s the baseline, and it’s non-negotiable.
Frequently Asked Questions
Can THCA flower contain mold?
Yes, if it’s grown, dried, or stored improperly. Cannabis flower is susceptible to Aspergillus and other mold species, particularly during the drying and curing phase. Full-panel COAs that include microbial testing are the only way to confirm a batch is clean.
Is THCA flower safe for people with compromised immune systems?
The microbial risk — particularly Aspergillus species — is a meaningful concern for immunocompromised consumers. Peer-reviewed research has specifically flagged this population as being at elevated risk from cannabis-associated fungal contamination. If you fall into this category, you should verify that any flower you use has been tested for microbial contaminants and Aspergillus specifically, and consult your healthcare provider.
Are heavy metals in THCA flower a real concern?
Cannabis is a documented bioaccumulator, meaning it pulls from the soil. If the growing medium or soil contains elevated lead, cadmium, arsenic, or mercury, those compounds can appear in plant tissue. The risk is higher in concentrates than in flower — but it exists for flower, and it’s only confirmed absent by a heavy metals panel on the COA.
Does THCA flower have pesticides?
It can, if the grow used pesticides and wasn’t tested. Clean COAs show each pesticide compound at non-detect or below action limits. If the COA doesn’t include a pesticide panel, there’s no verification either way.
Is THCA the same safety risk as THC?
THCA converts to Delta-9 THC when heated. Once consumed by smoking or vaporizing, the physiological effects and associated risks are the same as traditional high-THC cannabis. The safety distinction between THCA flower and dispensary cannabis is about testing standards, not about the compound itself.
What’s the difference between a “passing” and “failing” COA?
A passing COA means every compound tested came in below its established action limit. A failing COA means one or more compounds exceeded the limit. A product with a failed COA should not be sold to consumers — and a retailer who sells it anyway is making a deliberate choice about your safety.
Buy With Confidence
THCA flower is safe when it’s properly grown, properly tested, and sold by a retailer who makes those results accessible. The testing isn’t complicated to understand — and it’s the one thing that separates a product you can trust from one you’re taking on faith.
Browse our full THCA flower catalog at Asheville Dispensary — every strain includes a full COA so you can check the lab results before anything ships to your door. If you have questions about what you’re reading on a lab report, reach out. We’re here to help you make sense of it.
