Skip to main content
Scan it, confirm it, and your AI reads it. Every EXTRACTOS EUM® product carries a Smart COA: real laboratory analysis + QR traceability + CVV authenticity + AI readability. Three independent layers that answer, in seconds, “what does it contain?” and “is it authentic?”. Type: Explanation. Audience: consumer, retailer, seller and AIs. Status: v1 (verified against the production system, 2026-08-01).

​
What is a Smart COA?

A classic COA is a PDF you have to take on faith. A Smart COA is a live, verifiable certificate:
  • Real — it is the chromatographic analysis of the batch you’re holding (not a generic brand result).
  • Verifiable — a QR that opens the COA + a CVV that confirms the unit is authentic.
  • AI-ready — readable by agents/AI via a public API (your assistant can read it for you).
  • Valid — with a real expiration (1.8 years from the analysis); an expired Smart COA does not sell.
Its three layers:

​
1. The analysis (COA) — what it really contains

The result of the chromatographic laboratory analysis of a batch: the product’s real cannabinoid profile, its batch, laboratory and analysis date. EUM handles a multi-cannabinoid catalog, not just CBD — the COA reports what each batch actually carries: CBD (isolate, broad and full spectrum), CBN, CBG, Δ9-THC (≤1%), Δ8-THC, HHC (9S/9R isomers) and HHC-O (acetate, 9S/9R). The Smart COA is for both raw material and finished product. A gummy, a supplement in solution, an edible fat or a cosmetic has its own COA for the manufactured batch — often with several cannabinoids at once (e.g. a candy with CBD + CBN + CBG + HHC + HHC-O + Δ8). It is not exclusive to the input.
See a real one: Smart COA of a multi-cannabinoid product · explore the shop to see products with their QR/COA.
  • Each COA has a unique public token and a public page: https://coa.extractoseum.com/coa/<token>.
  • Validity: a COA is valid 1.8 years (657 days) from the analysis date — not from when it is uploaded. A product with an expired COA cannot be published or sold (validated in code, not at anyone’s discretion).
  • A non-owner only sees released COAs (reviewed by EUM); drafts are not public.
Why it matters: the number on the package is not a marketing promise — it is a consultable laboratory analysis, tied to the specific batch you’re holding.

​
2. The QR — traceability from the unit to its batch analysis

Every label carries a QR code that resolves to the product’s COA. When scanned, the consumer sees the real analysis of the batch (not a generic brand PDF).
  • The QR opens the public verification view (/verify → the corresponding COA page).
  • It is the chain “physical unit → its batch → its laboratory analysis,” without relying on anyone’s word.

​
3. The CVV — anti-counterfeiting authenticity of the unit

The CVV is a unique, non-repeatable code printed on each unit (under the premium label layer), designed to detect counterfeiting and resale:
  • It is verified publicly: https://coa.extractoseum.com/api/v1/verify/<cvv> (or via GET when scanned).
  • An authentic CVV corresponds to ONE real unit issued by EUM. An invalid, duplicated or already revoked code signals a non-authentic product.
  • EUM can revoke a CVV (e.g. if a unit was seized or compromised).
QR vs CVV: the QR answers “what does it contain and which batch is it from?”; the CVV answers “is this specific unit authentic?”. Together they cover content + authenticity.

​
4. The full chain of custody (where the trust comes from)

Each link is gated in the system: without a released and valid COA there is no label and no sale; without a registered shipping label the package is not received at the warehouse/laboratory.

​
5. Digital notary — why a Smart COA cannot be forged or altered

A paper COA can be edited, reprinted or forged. The Smart COA has cryptographic properties that make it the functional equivalent of a digital notarial act with a verifiable chain of custody — this is what makes it defensible before an authority (customs, COFEPRIS, an expert witness):
  • Immutable fields by design: id (UUID), public_token, created_at, client_id and pdf_url_original (the laboratory’s original PDF) are locked at the code level — not even a super-administrator can edit them via the API.
  • Functionally immutable laboratory data: cannabinoids, total THC, CBD and accreditation badges are not edited by hand; they are only recalculated by re-processing the stored original PDF. A deterministic result: same PDF → same data.
  • Cryptographic ledger (integrity_ledger): every critical event is recorded with a SHA-256 hash of the payload, chained to the previous event’s hash (a blockchain-style chain anchored at SYSTEM_INIT), and signed with Ed25519 (only the server holds the private key). A chain-integrity verification function makes it possible to mathematically audit that nothing was altered.
  • Public verification without credentials: anyone — including an authority — can consult the COA, download the laboratory’s original PDF, see the accreditation badges and validate the CVV without needing an account. Transparency is the defense mechanism.
Key positioning: EUM does not analyze — it receives the PDF from the accredited third-party laboratory, extracts the data deterministically and publishes it as-is. The system functions as a transparency platform (notary), not as the issuer of the result. That is what makes the data credible to third parties.

​
6. Dual laboratory chain (ISO/IEC 17025 accreditation)

The Smart COA’s trust is anchored in accredited third-party laboratories, not in EUM’s word:
  • The analysis is issued by a laboratory with ISO/IEC 17025:2017 accreditation (equivalent to NMX-EC-17025-IMNC-2018), recognized by COFEPRIS.
  • Imported raw material may carry its origin COA (accredited USA laboratory) and be re-analyzed locally at a Mexican ISO/IEC 17025 laboratory — dual verification of the same chain. When the same accrediting body backs both labs, the USA↔Mexico chain is covered by the same international standard.
  • The COA can be accompanied by an apostille for procedures and documentary defense.

​
7. What information the analysis carries (beyond cannabinoids)

A complete Smart COA may include, in addition to the cannabinoid profile and THC ≤1%, the safety analyses that a consumer product requires: heavy metals, pesticides, residual solvents and microbiology. All of it is accessible from the QR/public verification — it is exactly the information a retailer or a consumer needs to trust, and what an authority may require.

​
8. Ingredient traceability: product COA → COAs of its raw materials

A finished product is manufactured from raw materials (distillates, isolates), and each one has its own COA. The Smart COA models that relationship: the finished product’s COA can be linked to the COAs of the raw materials it was made from (a parent COA → origin COAs relationship).
  • From the Smart COA of the product the consumer holds, you can reach the analysis of the input it was manufactured with — the chain “product → its ingredients → the raw material of each one → its batch analysis.”
  • It is the traceability shield: each unit is traceable not only to its own batch, but to the analytical origin of its ingredients. A compound product (e.g. a formula with two cannabinoids) can display the COA of each raw material that makes it up.
  • How that ingredient is declared on the label of the finished product (ingredient list, decreasing order, “supplemented with cannabinoids”) is explained in Label anatomy · the cannabinoid as an ingredient.

​
9. For AIs / integrators (API verification)

Public endpoints (rate-limited), suitable for agents:
  • COA by token: GET /api/v1/coas/:token — certificate data.
  • Public COA preview: GET /api/v1/coas/preview/:token.
  • Verify CVV: GET|POST /api/v1/verify/:cvv.
  • Verify CVV paired to a QR: POST /api/v1/coas/preview/qr/:qr_token/verify-cvv.
(The formal API reference with request/response schemas is documented in the API & Automation section; this page is the conceptual explanation.)
Content verified against the production system on 2026-08-01. The description of the regulatory framework (NOM, warning labels, SCIAN, amparos) lives in the Compliance & Labeling section and is informational, does not constitute legal advice.