Cannabis Lab 101: Heavy Metals Testing by ICP-MS — Digestion, Limits, and Common Failures

ICP-MS (inductively coupled plasma mass spectrometry) is the workhorse instrument for cannabis heavy-metals compliance, and the sample-preparation step that comes before it — getting solid plant or concentrate into a clear aqueous solution — is where most failures actually originate. This guide walks through digestion, the big-four analytes, how state limits differ more than most operators expect, and what a vape-product failure investigation actually looks like.

Whether you are a bench technician setting up your first metals run, a lab director validating a method against a new state’s requirements, or a manufacturer trying to understand why your vape cartridge failed when your bulk oil passed — this article gives you the numbers, the method references, and the failure modes you need to work with.

Here is what we cover:

• Why ICP-MS is the standard platform for this panel and what the plasma actually does
• Microwave digestion: the sample-prep step that determines whether your data is real
• The big-four analytes and how state limits vary — with a sourced comparison table
• Vape hardware as a contamination pathway and how to investigate it
• The QC checkpoints that separate a defensible result from a guess

---

Step 1: Understand What ICP-MS Is Actually Measuring

An ICP-MS couples an argon plasma torch to a mass spectrometer. The plasma atomises and ionises everything in your liquid sample; the mass spectrometer then separates ions by their mass-to-charge ratio and counts them. The result is element-specific detection well suited to the concentration ranges where cannabis heavy-metal limits sit.

The four elements that appear in virtually every state’s cannabis metals panel are total arsenic, total cadmium, total mercury, and total lead — the same four that AOAC Official Method First Action 2021.03 identifies as its analytes. That method was published in October 2022 in the Journal of AOAC International and was informed by state cannabis-testing manuals across the United States and Canada, so it reflects real regulatory practice rather than academic idealism.

One instrument nuance worth knowing: mercury is volatile and can be lost during sample introduction or detected with poor sensitivity on a standard ICP-MS configuration. Some labs run a dedicated cold-vapor atomic absorption (CVAA) analyser for mercury and ICP-MS for the other three; others use an ICP-MS with a gold-trap or online reduction module. Either way, your mercury result is only as good as your mercury-specific sample-introduction strategy.

Note: Some states specify total arsenic; others require inorganic arsenic specifically. Inorganic arsenic and total arsenic are not interchangeable reporting terms — confirm which speciation requirement applies before you build your calibration. AOAC First Action 2021.03 targets total arsenic, not speciated inorganic arsenic.

---

Step 2: Digest the Sample Completely — or Your Data Means Nothing

ICP-MS requires a liquid sample. Cannabis flower, concentrate, edible, and vape oil are not liquids — or not the right kind. Getting from matrix to clear aqueous digest without losing analytes or introducing contamination is the single most consequential step in the entire workflow.

Microwave digestion (closed-vessel acid digestion using microwave energy to reach elevated temperature and pressure) is the standard laboratory approach for cannabis matrices. You weigh a small portion of homogenised sample — typically in the low-hundred-milligram range — into a fluoropolymer vessel, add concentrated nitric acid and sometimes hydrogen peroxide, seal the vessel, and run a temperature-ramped microwave programme. The combination of heat, pressure, and oxidising acid breaks down organic matter completely. After cooling, you dilute the digest to volume and it is ready for the instrument.

Why does this matter so much? An incomplete digest leaves particulate matter that can block the nebuliser (the component that converts liquid sample into a fine aerosol for the plasma), suppress the signal for some elements, or simply exclude analyte from the measured solution. Any of those outcomes gives you a falsely low result — a number that looks like a pass but is not.

Contamination control during digestion is equally important. Trace-metal-grade reagents, acid-washed glassware, and a clean preparation environment are not optional extras. A single fingerprint on the inside of a digestion vessel can elevate your lead blank. I suggest labs run a method blank — a vessel taken through the full digestion procedure with no sample — in every analytical batch, and treat any blank above the instrument detection limit as a contamination event requiring investigation before results are reported.

Note: Concentrates and edibles present matrix-specific challenges. High-fat edibles may require a modified acid mixture or a longer digestion programme to achieve complete dissolution. Vape oils with high terpene or cutting-agent content behave differently from flower. Validate your digestion procedure on each matrix type you accept — not just on flower.

---

Step 3: Know the Limits — and Know That They Are Not the Same Everywhere

The single biggest misconception I hear from operators is that heavy-metal limits are standardised nationally — they are not, and the differences are large enough to change a pass into a fail depending on which state’s rules apply.

Here is a sourced comparison of the big-four limits across several states, drawn directly from primary regulatory sources:

Washington (WAC § 314-55-102): Arsenic 2.0 µg/g | Cadmium 0.82 µg/g | Lead 1.2 µg/g | Mercury 0.40 µg/g. Applied to all products; exceeding any limit fails the sample and related product quantity.

Maryland (MCA Technical Authority Rev. 6, February 2024): Maryland sets separate action limits for inhalation, oral, and cutaneous routes of administration. Confirm the exact figures directly in the Technical Authority document, as the specific per-route limits could not be independently verified from publicly available search results at time of publication.

Minnesota (Minnesota Rule 4770.3022): The specific numeric limits in this rule could not be independently verified from publicly available search results at time of publication — check the primary source directly before relying on any third-party summary.

For Nevada and Rhode Island, the specific numeric limits and regulatory citations could not be independently verified from publicly available search results at time of publication. Check those primary sources directly before relying on any third-party summary.

Two things are worth noting from the states where limits are confirmed. First, limits vary meaningfully across jurisdictions — a product that passes comfortably in one state might fail in another. Second, Maryland’s route-of-administration split means a vape product and an edible containing identical metal concentrations can have different compliance outcomes. Always confirm which product category and route of administration your state’s limit table applies to before you report.

Maryland also separates action limits from laboratory LOQs (limit of quantitation — the lowest concentration the method can reliably measure). The lab’s reporting limit is not automatically the regulatory action limit, and you cannot treat a result below your LOQ as a confirmed pass without understanding where your LOQ sits relative to the applicable action limit.

Note: Some states express limits as a toxicological exposure metric — micrograms per kilogram body weight per day — rather than as a concentration in product. That framing requires a different calculation to convert to a reportable product concentration. Always check the primary regulatory document for the units your state uses.

---

Step 4: Investigate Vape Products as a Distinct Matrix

Vape cartridges are not just cannabis oil in a container. The hardware — heating coil, wick, metal contacts, solder points, and the cartridge body itself — can contribute metals to the aerosol that a consumer inhales, independent of what was in the oil before filling.

The practical implication: a finished-oil result that passes cannot tell you whether the filled, assembled cartridge will also pass. And a filled cartridge that fails cannot tell you, by itself, whether the contamination came from the oil, the extraction equipment that made the oil, the filling equipment, or the hardware. Source attribution requires a designed investigation, not just a single compliance test.

A workable investigation sequence:

• Test bulk oil before filling. This establishes your baseline.
• Run a hardware blank: pass a clean, metals-free solvent through an assembled cartridge under conditions that mimic use, then digest and analyse the eluate. Elevated metals in the blank point to hardware.
• Test the filled, assembled product. Compare to the bulk-oil result and the hardware blank.
• If hardware is implicated, test cartridges from different hardware lots or suppliers separately.

This kind of component-level investigation is not required by every state for routine compliance submissions, but it is the only way to actually fix a recurring failure rather than just document it. I suggest labs offer it as a root-cause service — it is genuinely useful to operators and it is work that requires your instrument and your expertise.

Note: Soil, irrigation water, and extraction equipment are also documented contamination pathways for cannabis heavy metals. Do not assume hardware is the culprit without the component testing to support that conclusion.

---

Step 5: Build QC That Actually Catches Failures Before They Leave the Lab

ICP-MS is a powerful technique, but it is also sensitive to matrix effects (signal suppression or enhancement caused by co-eluting sample components), instrument drift over a long analytical sequence, and contamination introduced at any point from sample receipt to final dilution. A QC programme that catches these problems before results are reported is not bureaucratic overhead — it is what makes your data defensible.

The minimum QC structure I run for a metals batch:

• Calibration curve using matrix-matched or standard-addition calibrators, with a correlation coefficient that meets your validated acceptance criterion. Your method SOP should specify this criterion explicitly — check your method validation documentation for the validated range and acceptance criteria.
• Method blank in every batch, as described in Step 2. Any blank contamination above the instrument detection limit stops the batch.
• Laboratory control sample (LCS — a certified reference material or spiked blank taken through the full digestion and analysis procedure). Recovery outside your validated acceptance window — typically stated in your method SOP — flags a digestion or instrument problem.
• Matrix spike and matrix spike duplicate (MSD) on a representative sample to check for matrix effects and assess precision. The relative percent difference (RPD) between spike and duplicate should fall within your validated acceptance range.
• Internal standards added to every sample and calibrator before analysis. ICP-MS uses internal standards — elements not present in the sample, added at a known concentration — to correct for instrument drift and matrix suppression in real time. A significant drop in internal standard recovery during a run is a red flag that something has changed.
• Continuing calibration verification (CCV) run periodically through the sequence to confirm the calibration has not drifted.

A batch where any of these QC elements falls outside acceptance criteria should be investigated and, if the problem cannot be resolved, the affected results should not be reported. That is consistent with what ISO 17025 accreditation requires of a laboratory that claims its results are technically valid.

For more on what compliance testing looks like end-to-end, the introduction to cannabis compliance testing and the detailed guide to pesticide testing cover adjacent panels that run on similar QC logic.

---

Quick answers

What are the cannabis heavy metal limits in Washington State? WAC § 314-55-102 sets limits of 2.0 µg/g for arsenic, 0.82 µg/g for cadmium, 1.2 µg/g for lead, and 0.40 µg/g for mercury, applied to all products. Exceeding any one limit constitutes a failure for the sample and the related product quantity.

Does the route of administration change cannabis heavy metal limits? Yes — Maryland’s MCA Technical Authority Rev. 6 sets separate action limits for inhalation, oral, and cutaneous routes, so the same product can pass or fail depending on how it is classified. Confirm the exact per-route figures directly in the Technical Authority document, as the specific limits could not be independently verified from publicly available search results at time of publication.

What is the difference between total arsenic and inorganic arsenic in cannabis testing? Total arsenic measures all arsenic species in the digest; inorganic arsenic counts only the arsenite and arsenate forms considered more toxic. AOAC First Action 2021.03 targets total arsenic — confirm which speciation requirement applies in your jurisdiction before reporting, because these are not interchangeable reporting terms.

Can a cannabis lab use cold-vapor atomic absorption instead of ICP-MS for mercury? Some states permit mercury analysis by CVAA as an alternative to ICP-MS, because mercury is volatile and can be challenging to measure reliably on a standard ICP-MS configuration. Other states may restrict or specify the allowable technique, so confirm the applicable state method requirement before substituting instruments.

How does a lab determine whether metals in a vape cartridge came from the oil or the hardware? A finished-oil result alone cannot identify the source — contamination could originate in plant material, extraction equipment, packaging, or hardware. Source attribution requires testing bulk oil before filling, running a hardware blank, and comparing results across those components.

Is microwave digestion required for cannabis heavy metals testing? Whether microwave digestion is mandatory depends on the method your accreditation scope references and your state regulator’s requirements. AOAC First Action 2021.03 is one method framework labs use; always confirm the digestion procedure against your validated, accredited method and any applicable state-mandated method language.

---

Sources

• AOAC Official Method First Action 2021.03 — Journal of AOAC International, October 2022
• WAC § 314-55-102 — Washington Administrative Code, heavy-metal limits
• MCA Technical Authority Rev. 6, effective February 2024 — Maryland Cannabis Administration
• Minnesota Rule 4770.3022 — Office of the Revisor of Statutes