REACH Regulation Compliance for Cosmetic Ingredients: How to Audit Your Supply Chain for SVHC Restrictions

The REACH Gap Most Cosmetic Brands Don’t Know They Have

Most European cosmetic brands put considerable effort into Regulation (EC) No 1223/2009 compliance — safety assessments, Product Information Files, responsible person designation. What many don’t do, and what surfaces during third-party audits with alarming regularity, is verify that their raw material supply chain passes muster under REACH.

These are two separate legal frameworks. Both apply to cosmetics. Satisfying one does not satisfy the other.

REACH — Regulation (EC) No 1907/2006 — governs the Registration, Evaluation, Authorisation and Restriction of Chemicals across all industrial sectors in the EU. When you purchase a botanical extract, an emollient ester, or a preservative blend from a supplier, that substance is a chemical under REACH, regardless of whether it ends up in a cosmetic, a cleaning product, or an industrial coating. And if that chemical appears on ECHA’s Substances of Very High Concern (SVHC) Candidate List at a concentration above 0.1% w/w in your finished article, you have legal obligations that most cosmetic brands haven’t documented.

The gap is real, it’s common, and it rarely stays hidden once a brand faces a serious market surveillance inspection or a retailer-driven supplier audit.

What the SVHC Candidate List Actually Contains

ECHA publishes updates to the Candidate List twice a year, in June and December. As of mid-2026, the list contains over 240 substances, identified under REACH Article 57 criteria: carcinogenic, mutagenic, or reprotoxic (CMR); persistent, bioaccumulative, and toxic (PBT); very persistent and very bioaccumulative (vPvB); or endocrine disrupting.

That last category has been the primary growth driver. The EU’s Chemicals Strategy for Sustainability, launched in 2020, significantly accelerated SVHC identifications — and the pace hasn’t plateaued. Brands that screened their ingredient lists against the Candidate List in early 2023 may find 30 or more new additions they haven’t checked since. ECHA doesn’t notify you. It publishes. The onus is on you to monitor.

A number of Candidate List substances also appear in Annex II and Annex III of Regulation 1223/2009 — the prohibition and restriction lists. But the overlap is incomplete by design. The two frameworks have different scope and different criteria. Annex II of 1223/2009 prohibits over 1,300 substances from cosmetic products. REACH SVHC listing doesn’t automatically trigger a cosmetics ban; it triggers a disclosure and authorisation framework. The practical result: a substance can be on the SVHC Candidate List, legally present in a cosmetic at concentrations below the 1223/2009 threshold, and still generate mandatory REACH disclosure obligations that the brand has never considered.

Your Obligations Under REACH Article 33

REACH Article 33 is where cosmetic brands tend to get caught. It states that any supplier of an article containing a Candidate List substance above 0.1% concentration (w/w) must provide “sufficient information” to allow safe use, and must respond to consumer requests for that information within 45 days of receiving them.

For a finished cosmetic product, this means you need to know — with documented certainty — whether any of your ingredients contributes to an SVHC concentration above that threshold in the final formula. That requires three things working together:

A current SVHC screening of every raw material in your formulation, cross-referenced against the Candidate List version in force at the time of assessment. Up-to-date REACH declarations from each supplier — not one-time declarations signed at onboarding, but declarations explicitly referenced to a current Candidate List date. And a concentration calculation done at formulation level, not just at ingredient level.

That last point is where the real complexity sits. A fragrance component present at 1% in your formula may itself contain 8% of a Candidate List substance. The REACH threshold is calculated against the weight of the finished article. You need to trace the SVHC through the ingredient’s own composition, apply it to your formula percentage, and determine whether the result exceeds 0.1% in the finished product. This is not something a blanket “REACH compliant” declaration from a fragrance supplier fully resolves.

How to Build a REACH-Compliant Supplier Qualification Programme

A workable supplier qualification programme for REACH compliance doesn’t require expensive software. But it does require discipline and version control. Here are the five steps we walk clients through when they’re building this from scratch:

Step 1: Map every raw material to its CAS number. ECHA’s Candidate List is CAS-indexed. Supplier trade names are legally meaningless for this exercise. You need the exact chemical identity — and for complex ingredients like fragrance blends or botanical extracts, you need the composition, not just the mixture’s CAS reference.

Step 2: Request a current REACH Declaration of Compliance, not just an SDS. Safety Data Sheets must flag SVHC presence above 0.1% in Section 15, but many suppliers don’t update their SDS proactively when new Candidate List entries are published. A dedicated REACH Declaration of Compliance, explicitly cross-referencing the Candidate List date it was checked against, is what you actually need. Insist on declarations dated within the last 12 months.

Step 3: Run the cross-reference at formulation level. Once you have per-ingredient declarations, the real assessment is what the SVHC contribution is at your specified use levels. Build a simple spreadsheet: CAS number, Candidate List status, supplier-declared concentration in the raw material, percentage of raw material in your formula, resulting SVHC concentration in finished product. Flag anything approaching 0.1%.

Step 4: Document the outcome in your Product Information File. The PIF already requires a cosmetic product safety assessment under 1223/2009. Your REACH screening conclusions should sit as an appendix to that file — not buried in a procurement folder that a safety assessor or auditor will never open. REACH obligations and cosmetic safety obligations connect at the raw material level; the documentation should too.

Step 5: Set a calendar trigger for ECHA update cycles. Every June and December, when ECHA publishes Candidate List updates, your regulatory team should re-run the cross-reference for active formulations. This is non-negotiable: Article 33 obligations are triggered by the current Candidate List, not the one that was current when you last reviewed.

The Annex XVII Restriction Problem Few Brands Check Separately

Beyond the SVHC Candidate List, REACH Annex XVII contains binding restrictions on specific substance uses — including several with direct relevance to cosmetic formulations.

Formaldehyde releasers are the most cited example. REACH Annex XVII, Entry 61 restricts formaldehyde in cosmetic products to a maximum concentration of 0.1% (0.2% for oral hygiene products). This overlaps with Annex III, Entry 5 of Regulation 1223/2009 — but the REACH restriction carries its own legal standing and its own enforcement pathway, completely separate from the cosmetics regulation. A brand that has correctly assessed a formaldehyde-releasing preservative under 1223/2009 hasn’t automatically satisfied REACH Annex XVII.

Certain lead compounds used historically in cosmetic colorants are another intersection point. Where Annex II of 1223/2009 prohibits them in cosmetic products, REACH Annex XVII restrictions apply more broadly to the substance itself. Enforcement can originate from either framework depending on which authority is conducting the inspection.

The practical implication is this: a brand with a complete 1223/2009 compliance file can still carry material REACH exposure through Annex XVII overlaps it hasn’t explicitly addressed. Treating them as the same analysis is a mistake that auditors notice quickly.

What a REACH Gap Looks Like in Practice

France’s DGCCRF focuses its market surveillance primarily on 1223/2009 obligations. But when a cosmetic product is flagged and the Responsible Person cannot produce documented SVHC screening, the absence of REACH documentation creates a credibility problem that affects the entire regulatory file — not just the REACH portion.

We’ve seen this pattern with brands entering the French market from outside the EU. Their 1223/2009 documentation is complete, their PIF is properly structured, but they’ve never had a substantive REACH conversation with their ingredient suppliers. When a lab check identifies an SVHC substance in the formulation, the brand has no documented threshold calculation, no current REACH declarations on file, and an Article 33 consumer response obligation they didn’t know existed. The formal enforcement exposure varies depending on the substance and concentration. The reputational exposure — with a retail buyer or private label partner who discovers the gap — is often more immediate.

Getting this right before market entry costs substantially less than correcting it after an inspection, a product listing suspension, or a major retailer’s supplier audit triggers a non-conformity.

The Actionable Starting Point

If you haven’t reviewed your full ingredient list against the current SVHC Candidate List in the last six months, do it now. Export every CAS number from your formulation system. Download the current Candidate List from ECHA’s website — it’s freely available and machine-readable. Run the cross-reference. Request updated REACH declarations from any supplier whose ingredient appears on the list.

For a typical portfolio of 10–20 cosmetic SKUs, this is roughly three days of dedicated regulatory work. That’s a proportionate investment compared to the cost of discovering the gap at the wrong moment.

---

Written by Nour Abochama, Quality & Regulatory Advisor, Care Europe | VP Operations, Qalitex. Learn more about our team

Talk to our team about EU market entry. Contact us

Related from our network

• Raw material supplier qualification and REACH SDS review for US-market products — Qalitex Laboratories provides ingredient-level testing and supplier qualification support for brands preparing cross-border documentation.
• Health Canada cosmetics notification and ingredient compliance for European brands entering Canada — Androxa covers NHPD and Canadian cosmetics notification requirements for European exporters expanding into North America.