A QR code can be the fastest route to a laboratory report, or it can be decoration that lands on a homepage and leaves the reader searching. The square itself proves nothing. The useful evidence begins after the scan: where the link resolves, which product appears, how the report is identified, and how many steps separate the package from the document.
Texas turns that usability question into a specific label rule. A consumable-hemp label has to provide a conspicuous URL that reaches the certificate of analysis in no more than three steps (25 TAC §300.402(a); Executive Order GA-56). The rule describes access to evidence, not the mere presence of a QR code.
General information, not a substitute for the advice of an attorney. Jurisdiction: Texas, with United States federal law where noted. Information current as of August 2026.
What the Texas rule requires
Texas consumable-hemp labels must include a batch number, batch date, manufacturer contact information, and a conspicuous URL through which the COA can be reached in three steps or fewer (25 TAC §300.402(a); Texas State Law Library cannabis guide). The broader program requires a batch COA from an ISO/IEC 17025 accredited laboratory (25 TAC §300.301; Executive Order GA-56).
A QR code is a convenient way to encode that URL. It is not the only conceivable way to display one, and it is not the legal result by itself. A code that resolves to an unrelated page has not delivered the certificate. A code that opens a product page with no route to results has used a step without completing the job.
What counts as a step
25 TAC §300.402(a) requires a conspicuous URL through which the COA is reachable in three steps or fewer. Texas rules do not define how individual interface actions are counted, so this article does not invent one.
The four checks after a scan
A successful camera scan is only the first check.
- Resolution. The code opens a working HTTPS destination rather than an error, expired redirect, or app-only dead end.
- Relevance. The destination identifies the same product or gives an immediate route to it.
- Document identity. The report names the laboratory, sample, product, dates, and report identifier.
- Package connection. Product and batch information allow the reader to connect the document back to the package.
A code can pass the first check and fail the other three. That is why scanning alone is not verification.
A QR code is not a certificate of analysis
The code is an address. The report at the address is the evidence. Treating the code itself as a quality seal reverses those roles.
The COA still has to be read. The product and sample have to match. The laboratory has to be identifiable. The relevant panel has to appear. The units have to be understood. “ND” and reporting limits have to be read according to the report legend. Our companion guide explains how to read the document you land on.
The link also cannot create evidence that is absent. A polished landing page does not supply a missing batch identifier. A product photograph does not replace the report. A green check mark does not establish a panel the laboratory never ran.
Why product-level access and batch-level evidence are different
FireBar Labs organizes published results by consumable product name at the lab-testing page. Consumable packaging carries a QR code that opens that product’s lab results. That is product-level access.
The report itself remains sample- and batch-specific. Texas labels must carry batch number and date, and Texas requires testing per batch (25 TAC §300.301, §300.402(a); Texas State Law Library cannabis guide). The page name can get a reader to the right shelf of reports; the identifiers on the package and document create the final match.
FireBar Labs results are organized by product name rather than through a customer-facing batch-identifier lookup. No printed COA document ships inside the order, and reports are not attached to confirmation emails. The packaging QR and the public lab page are the routes.
Bag QR codes go somewhere else
FireBar Labs bags carry QR codes too, but the destination and claim are entirely different. On the FireBar Labs Essential Mini Duffle Bag, Executive Tech Crossbody, and Executive Tech Adventure Backpack, the code on the bag and hangtag opens setup instructions, including lock setup. It does not open laboratory results because the bags are not lab tested.
That distinction prevents a familiar category error. FireBar Labs consumable products are third-party lab tested. FireBar Labs bags and StealthWear apparel are field-tested in real-world conditions. A QR pattern does not transfer the testing status of one category to another.
On Executive Tech models with a USB-C pass-through, the setup information also has a precise direction: the owner’s power bank goes inside the bag, a phone connects at the outside port, and the bag stays closed. There is no built-in battery. The full explanation is in the USB-C setup guide.
What the COA has to report in Texas
Texas requires the batch COA to report percentage of delta-9 THC, total delta-9 THC, and total THC per container (25 TAC §300.301(d)(12)). Total THC per container is a disclosure in Texas, not a milligram limit. Texas uses an acceptable-hemp standard of total delta-9 at or below 0.3% dry weight, calculated THCA-inclusive under 25 TAC §300.101(1) and §300.302(b).
Federal law adds a separate per-container ceiling on 2026-11-12: §781 of P.L. 119-37 caps finished products at 0.4 mg total THC per container and changes the federal hemp test to total THC at 0.3% dry weight (Congressional Research Service IF13136). No FDA definition of “container” was published through 2026-08-17, so this article does not choose a packaging unit or assert later agency activity (CRS IF13136).
The missing federal definition does not change the Texas three-step access duty. They are separate requirements from separate instruments, operating on separate questions.
Common access failures
- The generic-homepage loop. The scan opens a homepage with no visible lab link.
- The product mismatch. The page contains a report, but the product or form differs from the package.
- The image-only report. A compressed screenshot removes identifiers or makes results unreadable.
- The old-report problem. The product name matches, but the date and batch do not establish the package being examined.
- The broken redirect. A short link or campaign URL expires while the physical package remains in circulation.
Each failure begins after the code printed successfully. Print quality matters, but destination quality is the lasting compliance and trust question.
Access without a phone camera
The Texas rule calls for a conspicuous URL, which keeps the evidence reachable beyond one scanning method (25 TAC §300.402(a)). A readable web address gives a second route when a camera cannot focus, a device blocks redirects, or a reader is already on a desktop.
FireBar Labs results can be reached directly at /pages/lab-testing without scanning. The public route matters because a lab record is more useful when it can be revisited, compared, and linked.
Frequently asked questions
Does Texas require a QR code on consumable hemp?
Texas requires a conspicuous URL that reaches the COA in three steps or fewer, together with label and batch information (25 TAC §300.402(a); Executive Order GA-56). A QR code is a common route to that URL, but the code’s presence alone does not establish that the report is accessible.
Does scanning a QR code prove the product passed testing?
No. The scan proves only that the code resolved. The report has to match the product and sample, identify the laboratory, contain the relevant panel, and report the result being claimed.
Where do FireBar Labs consumable QR codes lead?
They open that product’s lab results. The same results are organized by product name on the public lab-testing page.
What do FireBar Labs bag QR codes open?
They open setup instructions. Bags are field-tested rather than laboratory tested, so their QR codes do not route to COAs.
Does Texas have a milligram cap per container?
No. Texas requires total THC per container to be disclosed on a batch COA under 25 TAC §300.301(d)(12), but regulates potency through total delta-9 at or below 0.3% dry weight under §300.101(1) and §300.302(b). The 0.4 mg per-container ceiling is federal and takes effect 2026-11-12 under §781 of P.L. 119-37 (CRS IF13136).
About this article
This article is general information about the law, published for educational purposes. It is not a substitute for the advice of an attorney. Laws change and vary by state — consult an attorney licensed in your jurisdiction about your specific situation. Jurisdiction covered: Texas, with United States federal law where noted. Information current as of August 2026.
Sources: the Texas consumable-hemp rules at 25 TAC ch. 300; Executive Order GA-56; the Texas State Law Library cannabis guide updated 2026-08-05; §781 of P.L. 119-37; and Congressional Research Service IF13136. Published by The FireBar Labs Team.
Explore FireBar Labs
Questions about reaching a FireBar Labs lab result? Email support@firebarlabs.com.
Share:
Continue Reading
What a Buyer Must Verify in 2026: COAs, Packaging, Age Checks and the November Cliff
You Bought It Legally. Then Texas Rescheduled It.