REACH CoC Explained: How European Cosmetics Brands Should Evaluate Supplier Declarations

Three months into a product launch, a French skincare brand we’d been advising discovered that one of their key actives — sourced from a German distributor — contained a substance that had just been added to the ECHA Candidate List. The distributor’s REACH compliance declaration, dated the previous year, made no mention of the risk. It wasn’t fraudulent. It was just outdated, poorly structured, and essentially useless as a compliance document. The brand had to reformulate a product already in late-stage packaging.

That scenario plays out more often than European cosmetics manufacturers care to admit. A REACH CoC — or Certificate of Compliance, as supplier declarations are commonly labelled — has become one of the most misunderstood documents in the EU personal care supply chain. Brands collect them, auditors tick the box, and then the documents sit in folders without anyone asking whether they’re actually fit for purpose.

What a REACH CoC Actually Is (and What It Isn’t)

Let’s be direct: there is no official “REACH Certificate of Compliance” issued by ECHA or any EU member state authority. What exists is a market convention — a supplier-generated declaration asserting that a substance, mixture, or article meets the requirements of Regulation (EC) No 1907/2006. The format is not standardised, the content requirements are not prescribed in any guidance document, and the legal burden remains entirely with the issuing supplier.

That absence of standardisation is precisely the problem.

Under REACH, obligations vary significantly depending on where your company sits in the supply chain. As a cosmetics manufacturer, you’re classified as a “downstream user.” You’re not the party registering substances with ECHA, but you carry specific duties under Articles 37 to 39 regarding use conditions, and you’re entitled to information from your suppliers under Articles 32 and 33. Article 33 is particularly critical: if a substance on the SVHC (Substances of Very High Concern) Candidate List is present in a supplied article at a concentration above 0.1% w/w, your supplier must inform you of that fact proactively for B2C articles — and upon request for B2B supply.

As of mid-2025, the SVHC Candidate List contains 241 substances. ECHA updates it twice a year, typically in June and January. A REACH declaration dated 18 months ago has potentially missed two or three rounds of additions. That’s not a minor administrative gap; that’s a live compliance liability sitting in your ingredient files.

The Five Elements of a Credible Supplier Declaration

Not all declarations are equal. When evaluating a REACH CoC from a supplier, there are five specific elements we look for before accepting it as adequate for cosmetics compliance purposes.

Substance identification with CAS and EC numbers. A declaration that references only a trade name or commercial product designation is not useful. The document must identify each substance by CAS registry number and ECHA EC number. Without those identifiers, you cannot independently cross-reference against the current Candidate List or Annex XVII restriction entries — which you should always do yourself, regardless of what the supplier claims.

An explicit SVHC status statement with a version-dated Candidate List reference. The declaration must state clearly whether any SVHC substances from the Candidate List are present at ≥0.1% w/w. And it must state which version of the Candidate List was used for the assessment — ideally the ECHA publication date. A declaration that says “no SVHC substances present” without specifying the List version used is unverifiable and, frankly, not worth accepting.

REACH registration confirmation for substances above 1 tonne per year. Substances manufactured or imported into the EU above that tonnage threshold must be registered with ECHA. Your supplier should be able to provide a registration number, or — if they’re a non-EU manufacturer — confirm that an Only Representative (OR) holds their registration. Inability to provide this is a direct signal about their own compliance posture, not just a paperwork issue.

Annex XVII compliance confirmation. Annex XVII of REACH currently lists more than 70 restriction entries covering substances and specific use contexts. Several are directly relevant to cosmetic ingredients: lead and its compounds, certain polycyclic aromatic hydrocarbons, specific azo dyes, and others. A comprehensive CoC should explicitly confirm Annex XVII compliance for the supplied substance — not just SVHC status.

A review cycle commitment. Credible suppliers include a statement committing to update the declaration at a defined interval — typically annually — and upon any Candidate List update that affects their substances. This converts a static PDF into a living compliance commitment. If a supplier won’t commit to this in writing, that tells you something about how seriously they’re monitoring their own obligations.

If a supplier’s declaration is missing two or more of these elements, return it and request a revised version. Most reputable EU ingredient suppliers — particularly those serving regulated cosmetics or pharmaceutical accounts — can produce a properly structured declaration on request. If they push back, treat that as a qualification risk signal.

Where REACH Compliance Meets EU Regulation 1223/2009

For cosmetics manufacturers, REACH compliance doesn’t operate in isolation. EU Regulation 1223/2009 has its own restrictions framework: Annex II (prohibited substances), Annex III (restricted substances with conditions of use), and Annexes IV, V, and VI governing colorants, preservatives, and UV filters respectively. A significant number of the substances addressed by these Annexes are simultaneously regulated under REACH — but the two regimes don’t mirror each other perfectly, and that asymmetry is where brands get caught.

A substance might be permitted under Cosmetics Regulation Annex III at a defined maximum concentration, while simultaneously appearing as an SVHC under REACH and subject to Annex XVII conditions in other use contexts. Your Cosmetic Product Safety Report (CPSR), required under Article 10 of Regulation 1223/2009, must account for REACH classification and status when documenting ingredient safety. A Responsible Person who signs off a CPSR without verifying the current REACH status of each ingredient is creating documentation gaps that auditors and market surveillance authorities are increasingly trained to find.

The SCCS (Scientific Committee on Consumer Safety) has been cross-referencing ECHA classification data in its opinions with growing frequency. When the SCCS restricted oxybenzone (benzophenone-3) in 2021 to 2.2% in face products and 6% in body products, the decision drew substantially on REACH registration dossiers submitted to ECHA. The two regulatory systems are converging in practice, even if they remain legally separate instruments. Treating them as entirely distinct compliance tracks is a strategic mistake.

Red Flags to Watch for in Supplier CoC Documents

Reviewing supplier declarations across multiple categories of cosmetic ingredients reveals certain patterns that signal a document isn’t providing genuine compliance assurance.

Generic, undated templates. A declaration with no date — or a date more than 18 months old — tells you the supplier is not actively monitoring Candidate List updates. Given that ECHA adds substances twice annually, a declaration from early 2024 may already be two or three rounds out of date. File it, note the gap, and request a current version before using the ingredient in new formulations.

Statements about “raw materials” rather than identified substances. Some suppliers write declarations for complex mixtures or finished ingredient blends by asserting compliance at the “raw material” level without identifying which constituent substances are in scope. This shifts the assessment burden to you — without giving you the information you need to actually perform that assessment. It’s effectively a non-declaration dressed up as compliance.

Circular distributor declarations. We’ve encountered cases where a multi-tier supply chain produces a CoC where each level simply references the tier above’s declaration, with no independent verification performed. A distributor’s REACH CoC that says “based on information from our supplier” offers you precisely the compliance value of that underlying declaration — which you haven’t seen and can’t evaluate.

Non-current Safety Data Sheets. Under REACH Annex II, as amended by Commission Regulation (EU) 2020/878 — which entered into force on 1 January 2023 — SDS documents for hazardous mixtures must now include a Unique Formula Identifier (UFI). If the SDS accompanying a declaration still uses the pre-2023 format without UFI information, the supplier’s documentation is not current. That’s a direct indicator that their REACH monitoring processes may not be current either.

Unsubstantiated exemption claims. Some suppliers assert their substance is “exempt from REACH” on vague grounds — it’s natural, it’s a polymer, it’s used in low volumes. Exemptions under REACH are specific and narrow. Polymers are generally exempt from registration, but constituent monomers above 1 tonne per year may still require it. Natural substances are not categorically exempt. Ask for the precise legal basis — Article number and Annex reference — for any claimed exemption. If they can’t provide it, the claim may be unfounded.

Building a Supplier Qualification Process That Actually Holds Up

The solution isn’t to wait for better-looking declarations and hope for the best — it’s to treat REACH CoC documents as living records within a structured supplier qualification process, not one-time checkbox items.

In practice, this means three operational commitments. First, request a fresh declaration at least annually from every active ingredient supplier, and always when ECHA publishes a Candidate List update. Second, cross-reference received declarations against the current ECHA Candidate List independently — ECHA’s online database takes less than five minutes per substance to query, and that independent check is something you can document. Third, record your verification process in a format that can be shown to authorities. In the event of a market surveillance inquiry or a RAPEX notification, you need to demonstrate not just that you received a declaration, but that you assessed it against a specific version of the Candidate List on a specific date.

For brands sourcing ingredients from outside the EU — from India, China, the US, or elsewhere — REACH registration obligations fall on the EU importer or on the manufacturer’s Only Representative. Make sure your supply agreements define that responsibility explicitly. Ambiguity in this area is routinely exploited when something goes wrong, and “our supplier said they were compliant” is not a defence that satisfies market surveillance authorities.

Our team works with European cosmetics and personal care brands across France, Germany, Italy, Belgium, and the Netherlands to build supplier qualification frameworks that satisfy both REACH and Regulation 1223/2009 simultaneously. The process is more structured than most brands realise going in — and considerably less painful than a reformulation at late packaging stage.

---

Written by Nour Abochama, Quality & Regulatory Advisor, Care Europe | VP Operations, Qalitex. Learn more about our team

Talk to our team about EU market entry Contact us

Related from our network

• ISO 17025-Accredited Ingredient Testing for EU Brands Entering the US Market — Qalitex Laboratories provides FDA-aligned analytical testing for European cosmetic ingredients and finished products seeking US distribution.
• Supplier Qualification and Raw Material Testing for Canadian Market Entry — Androxa supports European NHP and personal care brands navigating Health Canada’s ingredient compliance requirements.