Maryland Cannabis POS Guide to COA QR Code Validation
A Certificate of Analysis, or COA, helps Maryland cannabis retailers connect a packaged product with laboratory testing information. When that COA is delivered through a QR code, the process becomes convenient for customers and staff—but only if the code opens reliably and matches the product being sold.
For operators using IndicaOnline POS Maryland, COA QR validation can become part of a controlled retail workflow. The strongest process confirms that the QR code, product, package, testing record, and POS item all refer to the same regulated product before checkout.
Maryland Cannabis Administration guidance allows a QR code or other link to provide access to a product’s Certificate of Analysis, provided that the code is unique and links directly to that product’s COA. MCA also requires the COA from a registered independent testing laboratory to be available on the package through a link or QR code.
What COA QR Code Validation Means
COA QR validation means confirming that a code on cannabis packaging opens the correct laboratory report and that the report belongs to the product in hand.
A practical check should confirm that the code scans, opens the expected COA directly, matches the product and package, reflects current testing details, and agrees with the POS product identity.
A working QR code is not enough if it opens the wrong COA.
Know Maryland’s QR Code Rules
Maryland distinguishes the COA link from other information that may be provided digitally. MCA guidance states that a QR code used for a COA must be unique and link directly to that product’s COA. A code used for nutrition facts, non-cannabis ingredients, cannabinoid or terpene itemization, or allergens must be separate from the COA code.
Do Not Assume Every QR Code Is the COA
A package may contain:
- a COA QR code;
- a marketing QR code;
- a Retail ID code;
- a link to ingredients or nutrition data.
Staff should know which code is intended to provide the Certificate of Analysis.
Validate the COA During Receiving
Receiving is one of the best control points because the product has not yet reached the sales floor.
A Maryland dispensary POS platform can pair physical packaging with digital inventory. Verify:
- product name;
- package or lot identifier;
- manufacturer or processor;
- COA QR code;
- testing information;
- potency data where relevant;
- expiration or best-used-by information;
- POS product mapping.
A mismatch caught at receiving is easier to correct than one discovered after the product has been sold.
Match the COA to the Correct Product
Two products with the same retail name may come from different lots or packages. Potency, test dates, and other analytical results can differ.
A Metrc-compliant POS for Maryland should help staff connect the retail SKU with the correct regulated package, while the COA provides testing evidence for that product.
Useful comparison fields include:
- finished product lot number;
- product type;
- testing laboratory;
- testing date;
- potency values;
- final test status.
Check That the Link Opens Directly
MCA guidance says the COA code should link directly to the product’s Certificate of Analysis. Retailers should periodically scan sample inventory and confirm the customer does not encounter:
- a dead page;
- a generic brand homepage;
- a login screen;
- an unrelated laboratory report;
- an expired link.
If a customer cannot reach the intended COA, the code is not doing its job.
Compare COA Data With the POS Record
If the package displays potency values and the POS catalog includes the same information, those values should be consistent with the correct COA.
A cannabis POS for Maryland dispensaries can help managers compare:
- package label;
- COA;
- POS product record;
- ecommerce listing.
A mismatch may indicate that the wrong batch was mapped to the SKU or that catalog information was copied from an older package.
Keep COA Validation Separate From Retail ID
Metrc Retail ID uses serialized QR codes and can provide access to origin, test results, COA, potency, cannabinoid and terpene information. Maryland is one of the markets where Retail ID has launched.
That does not mean every COA QR code and Retail ID code are operationally identical.
Retailers should understand:
- which code provides COA access;
- which code identifies the retail unit;
- what the POS integration reads;
- whether multiple codes appear on the package.
Clear code roles prevent employees from scanning the right-looking code for the wrong purpose.
Create Controls for Broken or Incorrect Codes
A QR code may be damaged, printed incorrectly, or linked to the wrong document. A compliant cannabis POS in Maryland should support an exception workflow rather than encouraging employees to ignore the problem.
Possible statuses include:
- QR unreadable;
- COA link broken;
- wrong COA;
- product mismatch;
- package mismatch;
- manager review required.
Use a Controlled Resolution Process
When validation fails:
- Stop the item from sale if the issue affects compliance confidence.
- Check the package and lot information.
- Review the regulated inventory record.
- Contact the supplier when necessary.
- Document the resolution.
- Restore sale eligibility only after the problem is resolved.
A failed validation should lead to investigation, not an informal bypass.
Test After Integration Changes
Labeling or POS updates can create new failure points. After a major change, scan a sample product, open the COA, verify the lot, confirm POS mapping, and test checkout.
End-to-end testing is more useful than checking each system in isolation.
Build a COA QR Audit Routine
During Receiving
- scan sample packages;
- verify direct COA access;
- confirm product match;
- investigate unreadable codes.
Weekly
- sample products across different brands;
- look for recurring broken links;
- review exception logs;
- compare COA data with POS records.
After a Supplier Change
- check new packaging;
- verify QR readability;
- confirm COA links;
- validate package-to-SKU mapping.
Train Budtenders on What to Escalate
Budtenders do not need to interpret every laboratory analyte. They do need to recognize when something looks wrong.
Training should cover:
- which QR code is the COA code;
- what a valid destination looks like;
- when a mismatch requires manager review;
- why a broken link should not be ignored;
- how to document an exception.
A point-of-sale for Maryland dispensaries can make the process easier by giving staff a clear status and escalation path.
Use Official Maryland Guidance as the Baseline
The Maryland Cannabis Administration states that a COA completed by a registered independent testing laboratory must be available on the package through a link or QR code. Its policy FAQs further explain that the COA code must be unique and link directly to the product’s COA.
Retailers can review the Maryland Cannabis Administration laws and regulations for current packaging, labeling, testing, and dispensary guidance.
Final Takeaway
COA QR code validation is a small retail control with a large data-quality role. Maryland dispensaries should confirm that the code works, opens the right Certificate of Analysis, matches the physical product and regulated package, and remains consistent with POS and ecommerce records.
The best COA QR workflow makes the testing evidence easy to reach and difficult to mismatch. Receiving checks, direct-link validation, package mapping, exception controls, and routine sampling help Maryland cannabis retailers keep product information trustworthy from inventory intake through checkout.