The COA Isn't Proof: What Third-Party Testing Reveals in European Botanical Supply Chains

A 2013 DNA barcoding study published in BMC Medicine tested 44 herbal products from 12 companies and found that 59% contained plant species not listed on the label. Substitutions, fillers, complete misidentification. Products labelled as Echinacea purpurea contained no echinacea at all. And these weren’t grey-market imports from unregulated corners of the internet — they were mainstream commercial products sitting in distributor catalogues, with clean, professional Certificates of Analysis in the compliance file.

That is the uncomfortable truth about COAs: they document what a supplier tested, in their own facility, using methods of their own choosing. They do not document what is actually in the bag.

For European botanical supplement manufacturers and finished-product brands, this distinction has moved from academic concern to active liability. Regulatory scrutiny is tightening on both sides of the Atlantic — from EU Regulation (EC) No 396/2005 pesticide MRL enforcement to FDA import alerts targeting adulterated herbs. The gap between a supplier COA and a verified product profile is a gap that regulators are increasingly walking through.

What a COA Actually Documents

A Certificate of Analysis is, at its core, a record of analytical results. It tells you what the supplier chose to measure, which methods they applied, and the numerical values they obtained. It says nothing about whether those methods were appropriate for the matrix, whether the sample tested was representative of the lot, or whether the laboratory had any independent quality oversight at all.

The best COAs come from ISO/IEC 17025-accredited laboratories. They specify validated methods — ideally referencing European Pharmacopoeia (Ph.Eur.) monographs or ISO standards — include measurement uncertainty, and cover parameters genuinely relevant to the botanical in question. The worst, and these are far from rare in European supply chains, list four or five parameters, cite “internal methods,” and carry a signature from a QC technician at the supplier’s own site.

Consider what a typical COA for dried ashwagandha root (Withania somnifera) might cover: appearance, moisture content, total microbial count, and withanolide content by HPLC. What it probably won’t cover: DNA-confirmed species identity, a heavy metals panel (lead, arsenic, cadmium, mercury by ICP-MS), a multi-residue pesticide screen against EU MRLs, or a check for the presence of Withania coagulans — a cheaper relative sometimes substituted in bulk lots. Each of those missing parameters represents a documented failure mode. And each one has generated RASFF notifications in recent years.

Three Patterns That Emerge When We Retest

In our work supporting European brands through independent laboratory verification, the same failure patterns recur. Not because every supplier is acting in bad faith — many are operating in good faith within the limits of their own testing scope — but because the standard COA scope simply isn’t designed to catch them.

Identity discrepancies that don’t survive DNA analysis

Morphological identification — evaluating colour, texture, and physical characteristics of plant material — is the traditional approach to botanical identity, and many Ph.Eur. monographs include microscopy-based identity tests as their primary method. The problem is that ground or extracted material is exceptionally difficult to identify morphologically, and sophisticated adulterants can deceive visual inspection entirely.

DNA barcoding and next-generation sequencing now provide definitive species identification even in processed materials. What these methods reveal when applied to botanicals that passed supplier identity tests: partial substitutions (a product containing 70% of the labelled species and 30% of something undisclosed), complete substitutions, and contamination with botanicals that carry independent toxicological profiles. Sambucus nigra (elderflower) cut with S. ebulus — black elder, which contains the toxic cyanogenic glycoside sambunigrin — has appeared in commercial lots. This is not a theoretical risk. It is a documented one.

Pesticide residues above EU MRLs

EU Regulation (EC) No 396/2005 sets Maximum Residue Limits for pesticides across food commodities including herbs and herbal preparations. EFSA’s 2023–2024 enforcement surveillance shows herbs and dried spices consistently among the commodity groups most frequently exceeding MRLs — in some categories, exceedance rates run above 15% of samples tested across the EU internal market.

The challenge for European botanical brands is that suppliers from South Asia, North Africa, the Middle East, and parts of Eastern Europe operate under agricultural systems with different pesticide registrations and variable enforcement of residue limits. A COA that tests for five targeted pesticide residues will not detect the 300-plus active substances that a validated multi-residue GC-MS/MS and LC-MS/MS panel can identify. When we apply full multi-residue screens to botanicals accompanied by clean supplier COAs, positive findings are not exceptional — they are routine enough to have shaped how we advise clients on risk stratification.

Heavy metal contamination in Ayurvedic and traditional botanicals

Lead, arsenic, cadmium, and mercury contamination is a well-documented problem in Ayurvedic and traditional Asian botanical raw materials. Published peer-reviewed data have found lead concentrations in commercial ashwagandha and triphala products exceeding EU guidance limits by factors of ten to fifty. The EFSA-derived guidance limit for lead in food supplements sits at 3.0 mg/kg — a level that some commercially available lots have cleared by a very uncomfortable margin indeed.

A COA that lists a heavy metals result as “within specification” immediately raises the question: whose specification? The supplier’s internal limit, or the applicable Ph.Eur. or EFSA standard? And were the samples digested and analysed by ICP-MS — the only technique with the sensitivity EU limits actually require — or by a less rigorous approach such as AAS without digestion? These are questions a COA rarely answers on its face.

What “Ph.Eur. Compliance” on a COA Actually Signals

The European Pharmacopoeia is one of the most rigorous botanical standards in the world. Its monographs define identity tests, purity criteria, and assay methods for over 300 herbal substances and preparations. When a supplier writes “tested according to Ph.Eur.” on a COA, it signals intent to meet a recognised standard — and that is genuinely worth something.

But “tested according to Ph.Eur.” is not a certification. The Ph.Eur. is a reference document, not a quality scheme with audited participation. Any laboratory can reference Ph.Eur. methods. Whether those methods are being executed correctly, with properly calibrated equipment, by trained and competence-assessed analysts, operating under a documented quality management system — none of that is visible on the COA itself.

The meaningful signal is ISO/IEC 17025 accreditation, issued by a recognised national accreditation body: COFRAC in France, UKAS in the United Kingdom, DAkkS in Germany, ACCREDIA in Italy. An ISO 17025-accredited laboratory has been assessed by external auditors against internationally recognised technical competence criteria. A COA bearing that body’s accreditation mark, for the specific test methods in question, carries a fundamentally different level of confidence than one generated at a supplier’s in-house QC bench.

This distinction catches out many European brands — particularly smaller ones sourcing through ingredient brokers who sit several steps removed from the actual producer. By the time a botanical arrives at a French or German finished-product company, the COA may have changed hands two or three times. The originating laboratory’s accreditation status is often undocumented, or simply assumed.

The Stakes Rise Sharply When You’re Exporting

For European botanical brands with ambitions in the US or Canadian market — a segment growing consistently as demand for European-provenance botanical products rises — COA quality becomes a compliance issue, not just a quality preference.

Under FDA’s 21 CFR Part 111 (dietary supplement GMP regulations), manufacturers bear direct responsibility for the identity, purity, strength, and composition of their finished products. FDA’s position is explicit: a supplier COA alone does not satisfy the incoming raw material requirements of Part 111. Manufacturers must establish specifications and conduct at minimum identity testing on every incoming lot of raw material, with a science-based rationale for any decision to rely on supplier testing for other parameters. FDA’s Office of Regulatory Affairs has cited firms for insufficient incoming goods testing during inspections, and the consequences — warning letters, import alerts, consent decrees — are severe.

The Canadian market presents a parallel requirement. Health Canada’s Natural and Non-prescription Health Products Directorate (NNHPD) expects manufacturers applying for Natural Product Numbers (NPNs) to demonstrate control over raw material quality. Health Canada’s good manufacturing practices guidance is explicit that manufacturers must verify supplier COAs against their own established specifications — and for high-risk materials, conduct their own confirmatory testing. European brands who approach the Canadian market expecting to hand over supplier COAs as compliance evidence routinely encounter rejection.

The RASFF database — the EU’s Rapid Alert System for Food and Feed — provides a sobering reality check. Searching recent notifications against the categories “food supplements” and “herbs and spices” reveals a consistent flow: adulterated botanical identity, pesticide exceedances, heavy metal contamination, undeclared allergens. These are products that, at some point, had COAs filed under them.

Building a More Defensible Incoming Goods Programme

The goal here isn’t institutional distrust of every supplier. Long-term supply relationships built on shared quality expectations are a genuine commercial asset. The goal is to stop treating the COA as the terminal point of incoming goods verification and start treating it as the opening document in a conversation.

A defensible approach for European botanical brands involves:

• Supplier qualification before first purchase — verifying the originating laboratory’s ISO 17025 accreditation status, ideally with scope confirmation for the specific methods cited on the COA
• Risk stratification of your raw material list — Ayurvedic herbs, botanicals from regions with documented pesticide pressure, and species with published adulteration histories warrant more intensive incoming testing than, say, European-cultivated chamomile with a well-established supply chain
• Confirmatory identity testing by an accredited third party — at minimum for every new lot of high-risk materials, using validated molecular methods (DNA barcoding, qPCR) or chromatographic fingerprinting where Ph.Eur. monographs support it
• Multi-residue pesticide screening against EU Regulation (EC) No 396/2005 MRLs — not a targeted panel, but a validated broad-scope screen by GC-MS/MS and LC-MS/MS, for any botanical sourced from outside the EU
• Heavy metals by ICP-MS against established limits — with explicit comparison to Ph.Eur. monograph limits or EFSA guidance values, not supplier-defined internal specifications

None of this is operationally prohibitive. But it does require access to an ISO 17025-accredited laboratory with genuine botanical expertise — validated Ph.Eur. identity methods, multi-residue pesticide capability, and ICP-MS for trace element analysis. Laboratories combining all of these in a single partner relationship are genuinely rare in the European market.

That’s the problem Care Europe was built to solve. Our partner-lab network gives European botanical brands direct access to accredited testing capabilities — without having to manage three different laboratory relationships across two continents.

---

Written by Nour Abochama, Quality & Regulatory Advisor, Care Europe | VP Operations, Qalitex. Learn more about our team

Talk to our team about EU market entry and botanical raw material verification. Contact us

Related from our network

• Botanical identity and purity testing for US dietary supplement compliance — Qalitex Laboratories delivers Ph.Eur. and USP botanical identity testing, ICP-MS heavy metals analysis, and full multi-residue pesticide screening for brands exporting to the US market.
• Health Canada NHP testing and raw material qualification for European brands — Androxa supports European manufacturers through Canadian NPN applications, providing COA verification and confirmatory raw material testing aligned with Health Canada GMP expectations.