New York's Hemp QR Code Rule: The COA Has to Be Downloadable
New York's cannabinoid hemp rule is short and unambiguous about the scannable code. The detail worth noticing is a single adjective: the certificate has to be downloadable. A page that renders your results on screen with no file behind it is not what the rule describes.
The rule
From 9 NYCRR § 114.9 (Packaging and labeling of cannabinoid hemp products), subsection (a): "All cannabinoid hemp products distributed or offered for retail sale in New York State shall include the following information on the product label or packaging" — and then, at (a)(7), verbatim:
"a scannable bar code or QR code linked to a downloadable certificate of analysis, or linked to a website where the certificate of analysis can be downloaded"
Note the structure. There are two permitted arrangements, and both of them end in a downloadable certificate. There is no third branch where the results are simply displayed.
Source: NY Office of Cannabis Management — Part 114, Cannabinoid Hemp, adopted express terms (PDF), cross-checked against 9 NYCRR § 114.9.
The rest of the New York label, quickly
Subsection (a) of the same section also requires:
- (a)(1) for orally consumed products, compliance with 21 CFR Part 101 and a nutritional or supplement fact panel based on the servings in the container
- (a)(2) all ingredients in descending order of predominance by weight
- (a)(3) servings per package with milligrams per serving of CBD, "Total THC" or "THC", and any other marketed cannabinoid (with carve-outs for flower, topicals, and concentrates intended for inhalation)
- (a)(4) an expiration or best-by date if applicable
- (a)(5) a lot or batch number
- (a)(6) the name of the cannabinoid hemp processor, or of the out-of-state manufacturer, packer or distributor
- (a)(8) the state or country of origin of the hemp used
- (a)(9) a means for reporting serious adverse events or side effects
The two questions to check on your own label
- Does the scan end at a file a person can download? Embedded viewers, dashboards, and "results" pages that only display numbers are the common way this quietly fails. If there is no certificate to save, the rule's own wording is not satisfied.
- Does it reach the certificate for the lot number printed beside it? Subsection (a)(5) puts the lot or batch number on the same label. A code that lands on a general lab-results index leaves the buyer to match those up themselves, and leaves you unable to say which certificate the label pointed at.
The practical failure mode
Most brands satisfy "downloadable" on day one without thinking about it — they upload a PDF somewhere convenient and print the code. What breaks later is the address: a Drive link that gets tidied, a file in the site media library, a page reorganized during a redesign. By then the label is printed and on shelves, and the scan lands on a 404 or on last year's report for a similar product. There is no cheap remedy for that; the fix is a relabel.
The structural answer is one permanent address per batch, holding the downloadable report, with the batch number displayed next to it — so the printed lot number and the scanned certificate agree, and stay agreeing when the certificate is later corrected.
A permanent link, with a downloadable report behind it
BatchLink gives each batch a permanent URL plus a printable QR code. The lab report is downloadable from the page, the batch number sits beside it, and you can swap the certificate later without reprinting. Free for your first two batches, no card.
Create a free batch pageRelated reading
- State-by-state hemp QR/COA label requirements
- Georgia's "direct access" rule · Florida's 90-day clause · Texas's URL requirement
- What is a COA?
Sources reviewed August 2026, against the primary sources linked above rather than a secondary summary. Rules in this space change — confirm the current text with the agency before a print run. This is general information, not legal advice.