REACH Compliance for Cosmetics Manufacturers: What SVHCs Mean for Your Formulations

One of the most common misconceptions we encounter from cosmetics brands preparing for EU market entry: they treat Regulation (EC) No 1223/2009 as their entire compliance framework. It isn’t. REACH — Regulation (EC) No 1907/2006 — operates alongside it, with different thresholds, different obligations, and a Candidate List that expands twice every year.

The ECHA Candidate List of Substances of Very High Concern (SVHCs) currently contains over 240 entries. If any of those substances appear in your finished product or its packaging at a concentration above 0.1% (w/w), you have immediate legal duties that sit entirely outside the cosmetics regulation. Missing them doesn’t just create a compliance gap — it can expose your company to market surveillance action and mandatory product withdrawal under EU enforcement provisions, regardless of how thorough your safety assessment was.

Why REACH and EU Cosmetics Regulation Don’t Cover the Same Ground

The instinct to treat these two frameworks as redundant is understandable. Both restrict hazardous substances in cosmetics. Both apply across EU member states. But the mechanics are completely different.

Regulation 1223/2009 governs the finished cosmetic product: its safety assessment, its Product Information File, its labelling, and its prohibited or restricted ingredients listed across Annexes II through VI. REACH, on the other hand, governs chemical substances and mixtures throughout the entire supply chain — from raw material manufacturer down to brand owner. Its Annex XVII contains standalone restrictions that apply to substances in any article, cosmetic or otherwise. Its Annex XIV lists substances requiring authorisation to use at all, with sunset dates that can pass without warning if you’re not watching.

The practical consequence: a substance might not appear anywhere in Annexes II–VI of the cosmetics regulation, yet still be an SVHC under REACH requiring disclosure to your B2B customers or notification to ECHA’s SCIP database. We’ve seen brands pass their Cosmetic Product Safety Report review, launch in France, and then receive a REACH information request from a retail buyer six months later that they had no internal framework to answer.

There’s a timing issue layered on top. ECHA updates the Candidate List in June and December each year. Substances that were perfectly unremarkable in your formulation three years ago may have since been listed. Your regulatory monitoring programme — if you have one — needs to track both frameworks on completely separate calendars.

Understanding SVHCs and What the Candidate List Actually Includes

SVHC stands for Substance of Very High Concern. The criteria are defined in Article 57 of REACH and cover substances that are:

• CMR category 1A or 1B — carcinogenic, mutagenic, or toxic to reproduction
• PBT or vPvB — persistent, bioaccumulative and toxic, or very persistent and very bioaccumulative
• Substances of equivalent concern — including endocrine disruptors, respiratory sensitisers, and others identified case-by-case

The Candidate List is ECHA’s public registry of SVHCs flagged through the authorisation identification process. Once a substance is added, three immediate obligations arise under Article 33 of REACH:

1. Duty to inform B2B customers if the substance is present in an article at above 0.1% (w/w), upon request and within 45 days
2. Duty to inform consumers if the substance is present at above 0.1% (w/w), upon request and within 45 days
3. Notification to the ECHA SCIP database for articles placed on the EU market after 5 January 2021

The SCIP database — Substances of Concern In articles, as such or in complex objects (Products) — was established under Article 9(1)(i) of the amended EU Waste Framework Directive and is administered by ECHA. Every importer or EU-based producer supplying articles to the market must notify ECHA of SVHCs present above 0.1% before the product reaches the customer. And cosmetics, packaged in plastic, glass, aluminium, or composite containers, qualify as articles for these purposes. The container and its components are in scope.

Separately, Article 7 of REACH requires manufacturers or importers to notify ECHA directly if an SVHC is present above 0.1% (w/w) AND the total annual quantity of that substance across all articles produced or imported exceeds 1 tonne per year. For any brand with meaningful commercial volumes, that threshold arrives faster than expected.

The SCIP Database: Where Most Cosmetics Manufacturers Are Falling Short

Since the SCIP notification requirement came into force in January 2021, ECHA has published detailed guidance and run industry outreach campaigns. Compliance in the cosmetics sector remains inconsistent. The problem is rarely intentional — it’s structural. Many brands simply don’t realise that their packaging constitutes an “article” for REACH purposes, or that the 0.1% SVHC threshold is evaluated component by component within a complex assembled article, not averaged across the whole product.

Consider a moisturiser packaged in a glass jar with an acrylonitrile butadiene styrene (ABS) plastic lid and a cardboard outer box lined with a polymeric coating. The formulation inside may be entirely REACH-clean. But if the ABS lid contains a flame retardant or a plasticiser that appears on the Candidate List at above 0.1% in that component, the assembled product — sold as a single article — requires SCIP notification before it enters EU commerce.

This calculation becomes more complicated when you’re importing finished goods from manufacturers outside the EU. As the importer, your company assumes the legal obligations. Your supplier may provide a declaration of conformity and a full materials disclosure. But verifying that declaration against the current Candidate List — not the version in circulation when the declaration was drafted — is your responsibility, not theirs.

We routinely review materials declarations referencing a Candidate List from 12 to 18 months prior. During a window that size, ECHA typically adds between two and six new substances per biannual update. If a substance added in the most recent December or June update appears in your supplier’s materials, a declaration dated before that update simply doesn’t cover it. The documentation exists. The gap in it is invisible — until a market surveillance authority makes it visible.

Practical REACH Compliance Steps for Cosmetics Manufacturers

Getting REACH compliance right alongside 1223/2009 doesn’t require a dedicated in-house legal team. It does require a structured and repeatable approach. Here is how we work through it with clients:

Map your supply chain at the substance level, not the INCI level. INCI nomenclature identifies functional ingredients; REACH obligations attach to chemical substances identified by CAS number and EC number. A single INCI entry can contain multiple chemical components, some of which may independently appear on the Candidate List. Supplier Safety Data Sheets and extended SDSs under REACH are your primary documentary tools here.

Run formulation and packaging assessments separately. Formulation compliance and article compliance are distinct exercises. Request complete materials declarations from every packaging component supplier — including secondary and tertiary packaging that reaches the consumer. Don’t assume your primary packaging supplier has done this analysis for you.

Automate Candidate List monitoring. ECHA publishes every update at echa.europa.eu. Several regulatory software platforms offer automated alerts when new substances are added. At minimum, schedule a review of the full list in June and December after each biannual ECHA update, and cross-reference it against every active formulation and packaging specification you hold.

Configure your SCIP notification workflow before launch. Notifications are submitted via ECHA’s online portal or through the IUCLID format. The first submission takes time to set up: you need ECHA registered access, a mapped article structure, and supplier data in the required format. Leaving this until two weeks before launch is not a viable timeline.

Maintain dated, versioned supplier confirmations. Under Article 33, you need to respond to B2B customer information requests within 45 days. That’s only feasible if you’ve already gathered, verified, and filed the underlying supplier data with clear version dates. A folder of undated declarations won’t hold up during a market surveillance inspection or a key account onboarding audit.

Where the Two Frameworks Overlap — and Where They Diverge

Some substances restricted under REACH Annex XVII also appear in Annexes II or III of the cosmetics regulation. Lead and lead compounds, certain phthalates, and formaldehyde above defined concentration limits feature in both frameworks, sometimes with different quantitative thresholds. When limits conflict, you apply the stricter one. When only one framework addresses a substance, that framework’s rules govern independently.

The divergence becomes especially significant around downstream user obligations. If you’re formulating using a substance your supplier has registered under REACH, you need to check the substance’s Safety Data Sheet for use-specific conditions of use. Your formulation application must fall within an identified use on the registration dossier. If it doesn’t, you may need to submit a Chemical Safety Report as a downstream user — a significant undertaking that Regulation 1223/2009 has no equivalent for.

For brands scaling from France into Germany, Spain, or the Benelux markets, REACH scrutiny varies by national competent authority. Germany’s Federal Institute for Risk Assessment (BfR) and the Dutch National Institute for Public Health and the Environment (RIVM) both conduct active market surveillance in consumer products. Their enforcement projects don’t run on a coordinated EU-wide calendar, which means a product sailing through the French market can be flagged in Germany based on a national REACH enforcement initiative targeting a specific substance class.

Building a Compliance Programme That Doesn’t Stall at SVHC 241

REACH compliance failures typically surface at the worst possible moments: retailer onboarding audits, customs inspections at EU ports of entry, or a competitor notification to a national authority. By then, the reformulation or re-documentation timeline runs into months. Market access is interrupted, commercial relationships are strained, and the remediation cost is multiples of what a structured programme would have cost to operate.

The sustainable approach is to treat REACH as a living compliance programme rather than a one-time pre-launch checklist. The Candidate List changes. Your raw material supplier base evolves. Packaging specifications get revised. Each of those changes is a potential trigger for new SVHC obligations or updated SCIP notifications.

Build a review cadence: after every ECHA Candidate List update, after any formulation modification, and after any new packaging or component supplier is onboarded. Cross-reference each change against the current Candidate List, Annex XIV, and Annex XVII. Document your conclusions with dated sign-off. Keep supplier declarations current with explicit version references to the Candidate List revision they were assessed against.

If you’re bringing cosmetics into the EU from outside — from the United States, the UK post-Brexit, or Asian markets — budget for a dedicated REACH review as a discrete workstream within your market entry compliance programme. Scheduling it after your 1223/2009 safety assessment is approved means you’re potentially looking at two sequential review cycles before launch. Running them in parallel, with shared substance-level data, collapses that timeline considerably and surfaces conflicts early enough to address them.

The regulatory framework is detailed. But the exposure for non-compliance is concrete: article withdrawal, notification through RAPEX, and lasting reputational damage in markets where regulatory credibility is a genuine commercial differentiator.

---

Written by Nour Abochama, Quality & Regulatory Advisor, Care Europe | VP Operations, Qalitex. Learn more about our team

Talk to our team about EU market entry. Contact us

Related from our network

• ISO 17025-Accredited Testing for REACH Substance Identification — US-based laboratory services for CAS-level substance identification, impurity profiling, and supplier qualification supporting REACH compliance documentation
• Chemical Compliance Support for European Brands Entering Canada — Guidance on Canadian DSL/NDSL obligations and Health Canada chemical restrictions for cosmetics and NHP products