REACH SVHC Compliance for Cosmetic Brands: What Your Suppliers Aren't Telling You

The ECHA Candidate List crossed 240 substances in 2024. It’s updated twice a year — once in January, once in July — and each update can quietly add materials your formulations already rely on. If you’re a cosmetic brand preparing for EU market entry, or an established brand managing an evolving product portfolio, the Substances of Very High Concern (SVHC) framework under REACH deserves far more attention than it typically receives.

Most brands treat REACH as a chemical manufacturer’s problem. That assumption has a cost.

REACH Covers You, Even if You’re Not Registering Substances

Regulation EC No 1907/2006 — commonly called REACH — is primarily known for its registration requirements on chemical manufacturers and importers placing substances on the EU market. But its obligations extend well into the cosmetics supply chain in ways that regularly catch brands off guard.

Cosmetic brands typically sit in the “downstream user” or “importer of articles” category under REACH. As a downstream user of chemical substances, you must use substances only within the conditions described in your supplier’s Safety Data Sheet (SDS), and notify ECHA if you use a substance in a way not covered by those conditions. That alone requires you to actually read and verify the SDS — which, frankly, many brands delegate entirely to procurement without regulatory review.

The more immediate issue for most cosmetic brands is the article obligation. Under Article 7(2) and Article 33 of REACH, if a finished product or component contains an SVHC above 0.1% w/w, the supplier must communicate that information down the supply chain. And — here’s what often gets missed — if a consumer asks directly, you have 45 days to respond with SVHC information about your product.

That 45-day obligation applies to you as the brand. Not your supplier. You. And in France, the DGCCRF has run mystery-shopping enforcement exercises that include exactly these kinds of consumer requests.

The Candidate List Has Grown to 240+ Substances — And It Will Keep Growing

ECHA’s SVHC Candidate List currently contains over 240 substances, covering four categories of concern:

• CMR substances — carcinogenic, mutagenic, or toxic to reproduction (Category 1A or 1B under CLP Regulation EC No 1272/2008)
• PBT substances — persistent, bioaccumulative, and toxic
• vPvB substances — very persistent and very bioaccumulative
• Endocrine disruptors — substances meeting the EU scientific criteria under Article 57(f) of REACH

The list has grown from just 15 substances when REACH first took effect in 2008. The trajectory won’t reverse. ECHA’s mandate, reinforced by the EU Chemicals Strategy for Sustainability, is to accelerate SVHCs onto the Authorization List (Annex XIV) and ultimately remove them from the market — or subject them to strict restriction under Annex XVII.

For cosmetic brands, the most relevant SVHCs tend to cluster around a few ingredient categories:

• Certain phthalates — historically used as solvents or fragrance fixatives; several (DBP, DEHP, BBP) are already on Annex XIV with sunset dates that have passed, meaning they require authorisation to use
• Bisphenol A (BPA) — on the Candidate List and relevant for plastic packaging components
• Polycyclic aromatic hydrocarbons (PAHs) — an issue in mineral-oil-derived ingredients like petrolatum and paraffin
• Some UV filters — under escalating scrutiny for PBT properties and endocrine disruption
• Certain preservatives and antimicrobials — ongoing CMR reclassification of historically common ingredients is affecting formulations across the category

The practical implication: your ingredient risk assessment and your Product Information File (PIF), required under EU Cosmetics Regulation 1223/2009, should cross-reference the Candidate List as part of routine SDS review. If they don’t, the PIF is incomplete — and your Responsible Person is exposed.

Where REACH Restriction and Cosmetics Regulation Overlap (and Diverge)

This is the technical intersection that trips up regulatory teams most frequently, particularly those coming from North American or UK markets.

Annex XVII of REACH is the restriction list. It prohibits or severely limits the manufacture, use, or placing on the market of specific substances in specific applications — and cosmetic products are explicitly named as an application in several Annex XVII entries. That means a REACH restriction can independently prohibit something your cosmetics regulation advisor hasn’t flagged, and vice versa.

Fragrances are the clearest example. Certain fragrance allergens are restricted under both Annex XVII of REACH and Annex II or Annex III of Regulation 1223/2009. But the thresholds and the scope of those restrictions don’t always align. A substance might face a limit of 0.01% in a leave-on product under 1223/2009 while simultaneously facing a stricter industrial-use restriction under REACH. Checking only one framework leaves you exposed to the other.

The 2023 update to the Cosmetics Regulation’s fragrance allergen labelling requirements — expanding required declarations from 26 allergens to over 56 — compounds this further. Several of the newly added allergens are also SVHC candidates or are under active REACH restriction review. Tracking them requires monitoring two separate regulatory pipelines simultaneously, not one.

Preservatives tell a similar story. Methylisothiazolinone (MI) is restricted under Annex III of the Cosmetics Regulation — banned from leave-on products, permitted only at ≤0.0015% in rinse-off — and it also faces EU workplace exposure limits under REACH. If you’re formulating a product that straddles cosmetic and biocidal claims, you may be navigating three frameworks at once: Regulation 1223/2009, REACH, and the Biocidal Products Regulation (EU) No 528/2012.

We see this multi-framework problem regularly with brands entering from the US and Canada, and increasingly with UK companies adjusting to post-Brexit divergence. The assumption that “if it passes the cosmetics safety assessment, it’s fine” simply doesn’t hold in the EU.

Building a REACH-Ready Supply Chain: Where Brands Fall Short

The compliance framework is genuinely manageable — if approached systematically. Here’s what a REACH-ready supply chain actually looks like in practice:

1. Audit every SDS in your ingredient inventory. Current SDSs (issued or updated within 36 months) should include REACH registration numbers in Section 1 and explicit SVHC disclosures in Section 15. An SDS missing these fields is a red flag — not necessarily evidence of non-compliance, but a clear sign your supplier hasn’t done the work. Request an updated version immediately.

2. Monitor the Candidate List actively. Assign someone — internally or through a regulatory service — to review ECHA’s Candidate List updates each January and July. When a new substance overlaps with your ingredient inventory, request updated documentation from your supplier within 30 days. Don’t wait for your supplier to contact you. In our experience, they rarely do.

3. Build SVHC declarations into supplier onboarding. A standard REACH Declaration of Conformity (DoC) should be part of your supplier qualification package alongside the SDS and Certificate of Analysis, not an afterthought requested during an audit. Make it a contractual requirement from day one.

4. Maintain a substance inventory. Map each raw material to its CAS number, REACH registration status, and Candidate List status. This is the operational backbone of your REACH compliance file and is essential if you face an ECHA inquiry, a major retailer audit, or a French DGCCRF inspection.

5. Be ready to respond to consumers within 45 days. Test this internally. If your team can’t answer a consumer SVHC query for a specific product without scrambling through supplier files, that gap needs closing before someone asks officially.

What Changes When You’re Targeting the French Market

France adds a specific dimension worth understanding. ANSES (Agence nationale de sécurité sanitaire de l’alimentation, de l’environnement et du travail) is one of the most active Member State bodies in identifying and proposing new SVHCs to ECHA. Substances that appear in ANSES risk assessments or public consultation dossiers frequently reach the ECHA Candidate List within 12 to 18 months.

Monitoring ANSES substance dossiers alongside ECHA’s formal Candidate List updates gives you meaningful lead time — often enough to reformulate, qualify an alternative supplier, or prepare a compliant transition plan before official listing triggers your obligations. That’s a genuine competitive advantage for brands that build it into their regulatory intelligence process.

The DGCCRF, which enforces REACH and Cosmetics Regulation compliance at the national level in France, has been active on SVHC communication obligations specifically. Brands found unable to respond to consumer SVHC requests have received formal warnings. Repeat failures have carried financial consequences. It’s not a theoretical risk.

The Practical Takeaway

Run your full ingredient inventory against the current ECHA Candidate List — not last year’s version, today’s. Then do it again in July when ECHA’s next scheduled update lands. Request explicit SVHC declarations from every supplier where you don’t have current documentation. If your formulations include fragrance complexes, UV filters, or mineral-oil-derived materials, prioritise those reviews first.

REACH compliance isn’t a box you check before product launch. It’s a live obligation that moves on a fixed schedule twice a year, every year. The brands that manage it well build it into their quarterly operational rhythm. The ones that don’t tend to discover the gap at the worst possible moment — during a retailer audit, an enforcement inquiry, or a product recall.

---

Written by Nour Abochama, Quality & Regulatory Advisor, Care Europe | VP Operations, Qalitex. Learn more about our team

Talk to our team about EU market entry Contact us

Related from our network

• ISO 17025 Raw Material and Chemical Testing — Qalitex Laboratories provides third-party analytical testing to support REACH substance registration, supplier qualification, and SDS verification.
• Ingredient and Cosmetic Testing for Canadian Market Entry — Androxa offers GMP-compliant lab services for brands managing North American compliance alongside EU regulatory requirements.