For a smoke, vape, or CBD shop, hemp compliance in Texas comes down to one thing: being able to prove every third-party SKU on your shelf is within the limit and matches its label, with a current, batch-specific COA. Because you sell other companies' brands, that proof lives with your vendors — so your job is collecting it, matching it to the right lots, and keeping it from going stale.
A brand or manufacturer tests what it makes. A smoke shop sells what dozens of other companies made — Delta-9 gummies from one supplier, THCA flower from another, disposable vapes from a third, CBD tinctures from a fourth. You didn't run any of those lab tests, but you're the one standing at the counter when a DSHS inspector asks to see the paperwork. That's the core reality of smoke shop hemp compliance in Texas: the product is yours to defend, but the proof was created by someone else.
That gap is where shops get caught. It isn't usually a shady product — it's a legitimate SKU whose COA is sitting in a vendor's email, or covers a lot you sold out of two batches ago, or shows only delta-9 when Texas measures total THC. The compliance work for a retailer isn't manufacturing; it's chasing, matching, and maintaining vendor documentation across a shelf that changes every week.
The standard to hold yourself to is simple to say and hard to keep up manually: for every single SKU you sell, you should be able to produce a Certificate of Analysis that (1) comes from a named lab, (2) carries a lot or batch number that matches the product on the shelf, (3) has a recent test date, and (4) reports a total THC value, not just delta-9.
The batch match is the part retailers underestimate. A COA only covers the exact batch it was run on. Two runs of the same gummy, weeks apart, can test differently — so a certificate for last quarter's lot proves nothing about the jar in front of you today. If a customer buys a disposable from Lot 0426 and your only COA is for Lot 0119, you technically cannot prove that product at all. Our companion guide, what a hemp COA must show in Texas, walks through reading a certificate line by line so you can tell a strong one from a decorative PDF.
The single most time-consuming part of retail compliance is getting complete, current COAs out of your suppliers. Some brands publish them behind a QR code; some email a link that later 404s; some send a certificate for a different lot and hope you don't notice. A workable routine looks like this:
The reason all this rigor is worth it: on inspection day, "the distributor said it was fine" is not a record. Texas DSHS administers hemp registration and licensing, and retailers are expected to be able to produce COAs and records on request. The matched, current certificate is the only thing that answers the question.
COAs go stale, and on a smoke shop shelf they go stale constantly because inventory turns and re-orders bring new lots. A product you documented perfectly in the spring can quietly slip out of compliance simply because the batch you're now selling is different from the batch you have a certificate for — or because the test date on file is old enough that a customer or inspector no longer trusts it.
Different product types age differently, and the right cadence for re-verifying depends on the category. We cover that in detail in the guide on when a hemp COA expires. For a retailer the practical rule is: every time you re-order, treat it as a new lot that needs its own matched COA, and set yourself a reminder to review certificates before they age out — not after an inspector points at the date.
The products that move fastest in a Texas smoke shop — THCA flower, high-potency pre-rolls, dabs, some disposables — are exactly the ones most exposed to the total-THC standard. Federal law defines hemp as cannabis with no more than 0.3% delta-9 THC by dry weight, so a vendor COA that shows delta-9 at 0.2% looks clean at a glance. But Texas evaluates hemp on a total-THC basis: THCA is the acid form of THC, and when flower is smoked or vaped much of it converts to active delta-9, so the state counts that convertible THC toward the limit. This standard is currently in effect in Texas in 2026.
The consequence for your shelf is real: a THCA flower with a low delta-9 number can still exceed the limit once its THCA is added in. That's why a delta-9-only COA is not enough for these categories — you want the total THC figure spelled out. There's a second clock, too. A change to the federal definition of hemp is expected to take effect November 12, 2026, and industry groups estimate many current intoxicating-hemp products may not qualify unless Congress acts. Knowing which of your best-sellers are total-THC-sensitive now is how you avoid a shelf full of surprises later.
HempOS is a Texas hemp compliance platform built for exactly this problem: a shop full of third-party brands and a pile of vendor COAs to keep straight. It reads each certificate, pulls the lab, lot number, test date, and total THC, then flags the gaps automatically — a SKU with no COA, a certificate that doesn't match the batch on the shelf, an expired or missing test date, or a report that shows only delta-9. Instead of a Saturday-afternoon scramble through email, you get a live picture of which products are proven and which are not.
From there, every product gets a batch-accurate record, a public COA verification page, a QR link you can print on labels or post at the counter, and an inspection-ready audit packet you can export in one click. It is built to help you get inspection-ready and keep your records defensible — not to promise outcomes. Retail plans start at $600/mo with a $1,200 deposit to start (the deposit covers your first two months).
Want to see where you stand? Run a free COA check against your own products, or find and claim your business to start organizing your shelf. Retail teams can explore the retail compliance portal, and you can discover the brands you carry and pull their documentation through HempOS Radar. You can reach us any time at [email protected].
It means being able to prove, on request, that every hemp SKU on your shelf is within the legal THC limit and matches its label — with a batch-specific Certificate of Analysis from a named lab. Because you carry third-party brands, the proof lives with your vendors, so compliance for a smoke shop is largely the work of collecting, matching, and keeping current the COA for each product you stock.
The product is on your shelf, so the exposure is yours as well as the manufacturer's. Texas DSHS administers hemp registration and licensing, and retailers are expected to be able to produce COAs and records on request. Saying the distributor vouched for it is not a record — the matched, current COA for that batch is.
A Certificate of Analysis only covers the batch it was run on. Two jars of the same product from different lots can test differently, so a COA for last quarter's batch says nothing about the one on your shelf now. The lot number on the certificate must match the lot number on the product.
Ask every brand for the batch-specific COA that shows a total THC value, not just delta-9, plus the lab name, lot number, and test date. In Texas the total-THC figure decides compliance because THCA's convertible THC counts toward the limit. If a vendor can only send a delta-9 number or a certificate for a different lot, treat that SKU as unproven until they fix it.
HempOS reads each vendor COA, pulls the lab, lot, test date, and total THC, and flags SKUs that are missing a certificate, mismatched to a batch, expired, or reporting only delta-9. Every product gets a public COA page and QR link, and you can export an inspection-ready audit packet in one click. It helps you get inspection-ready rather than promising an outcome.
This is general information, not legal advice. Confirm your specific obligations with the Texas DSHS or qualified counsel.
Check every third-party SKU for a matched COA, missing total THC, and expiration risk before an inspector does. HempOS helps you get inspection-ready.
Questions? [email protected]