Heavy Metals in EU Cosmetics and Supplements: What Regulation 1223/2009 and REACH Actually Require

One number that tends to stop formulators mid-sentence when they see it for the first time: a single botanical ingredient can contribute between 0.01 and 15 ppm of lead depending on its geographic origin and how it was processed. Mineral pigments are more extreme. Naturally occurring impurities in kaolin, mica, and iron oxide colorants — all ubiquitous cosmetic raw materials — routinely carry arsenic, cadmium, and lead that no supplier’s raw material specification was designed to flag at meaningful thresholds.

That gap between “we didn’t add it” and “it wasn’t there” is exactly where EU regulatory exposure lives.

Under Regulation (EC) No 1223/2009, heavy metal compounds appear in Annex II as prohibited cosmetic ingredients. But Article 17 creates a critical carve-out for traces that are “technically unavoidable in good manufacturing practice” and that “do not pose a risk to human health.” The carve-out is real — but it is not a blank cheque. Demonstrating that your trace levels are both technically unavoidable and genuinely safe requires documented testing, a properly reasoned safety assessment, and increasingly, analytical data from an ISO/IEC 17025-accredited laboratory.

French DGCCRF inspectors have been asking for that documentation more insistently. If you can’t produce it, the burden of proof doesn’t simply disappear — it lands back on you.

Why “Certified Natural” and “Certified Organic” Don’t Signal Heavy Metal Safety

This is worth stating plainly because it catches even experienced product developers off guard. Certification schemes like COSMOS-standard and Ecocert assess whether ingredients were produced without synthetic pesticides and fertilisers. They do not assess elemental impurity profiles. A cold-pressed oil grown on organically managed soil still absorbs heavy metals from that soil. A hydrothermally processed mineral still carries whatever trace elements its geological origin put there.

The practical implication: organic certification cannot substitute for elemental analysis in a safety assessment. The cosmetic product safety assessor who signs off on your Product Information File (PIF) — who must hold qualifying toxicology credentials under Article 10 of 1223/2009 — will typically require quantitative analytical data, not certification documents, before concluding that heavy metals are adequately controlled.

For finished products sold in France specifically, there’s an additional layer. ANSM (Agence nationale de sécurité du médicament et des produits de santé) post-market surveillance has included targeted heavy metals monitoring campaigns in recent years, with particular attention to products marketed for children and products applied near mucous membranes — lip cosmetics, eye-area products, and baby skincare. The risk profile for those subcategories is genuinely higher, and enforcement activity reflects that. A brand that has relied on supplier CoAs for its heavy metals data in those categories is in a weaker position than it realises.

The Three-Layer Regulatory Framework: EU 1223/2009, REACH, and EFSA

European manufacturers dealing with heavy metals face three overlapping sets of requirements. Conflating them creates exactly the kind of gaps that surface during audits — and generate corrective action requests.

Layer 1 — EU Cosmetics Regulation (EC) No 1223/2009

Annex II prohibits specific heavy metal compounds as intentional cosmetic ingredients. Lead acetate has been prohibited since 2013; mercury compounds are prohibited; various arsenic, chromium(VI), and cadmium compounds appear on the list. The operative word is compounds — elemental contamination from natural raw material sources falls under Article 17’s trace-impurity provision rather than Annex II directly.

The SCCS (Scientific Committee on Consumer Safety) publishes guidance opinions on technically acceptable trace levels. These are advisory rather than hard regulatory limits, but in practice they anchor what DGCCRF inspectors regard as defensible. SCCS opinions cover lead, arsenic, cadmium, antimony, and other elements, typically expressed as maximum concentrations in finished products and anchored to specific exposure scenarios. Applying those benchmarks requires knowing both the concentration in your product and the relevant exposure assumptions — a calculation that sits squarely in the safety assessor’s remit.

Layer 2 — REACH Regulation (EC) No 1907/2006

REACH compliance operates alongside cosmetics compliance, not inside it. For ingredient suppliers, several heavy metal substances appear on the REACH SVHC Candidate List — lead and its compounds have been listed since 2018, cadmium and cadmium compounds since 2011. If a cosmetic ingredient — particularly a metal-based pigment, filler, or functional material — itself qualifies as an SVHC-containing article at concentrations above 0.1% w/w, REACH Article 33 communication obligations are triggered throughout the supply chain.

Here’s where a common misunderstanding creates real compliance gaps: asking your pigment supplier for a REACH CoC (Certificate of Compliance) is not the same as having concentration data. A CoC confirms the supplier’s belief that their Article 33 obligations don’t apply. It does not give you quantitative impurity data for your safety assessment. The two documents serve different legal functions, and a safety assessor cannot use a CoC to complete a toxicological risk characterisation.

This is not a theoretical concern. We regularly see brands presenting a folder of supplier CoCs as their heavy metals evidence during pre-market compliance reviews — and having to commission independent testing from scratch before their safety assessment can be finalised.

Layer 3 — EFSA Guidelines for Food Supplements

If your product is a food supplement sold in the EU, EFSA’s established reference values apply. EFSA’s scientific opinions on contaminants in the food chain set Tolerable Weekly Intakes (TWIs) and Benchmark Dose Lower Confidence Limit (BMDL) values that form the basis of dietary risk assessment. For cadmium, the TWI is 2.5 µg per kilogram of body weight per week. For inorganic arsenic, EFSA established a BMDL01 range of 0.3–8 µg/kg body weight per day as the reference point for cancer risk characterisation. For lead, EFSA concluded that no safe threshold can be established for certain health effects, meaning the assessment must use a margin-of-exposure approach rather than a simple below/above threshold determination.

Running those calculations requires quantitative analytical data. A qualitative declaration that “heavy metals are within acceptable limits” is not a risk characterisation — it’s a phrase that will prompt a follow-up question from any competent authority reviewer.

What ICP-MS Testing Reveals — and What It Doesn’t

Inductively Coupled Plasma Mass Spectrometry (ICP-MS) is the reference method for multi-element trace analysis in cosmetics and supplements. A single run typically screens 20 to 30 elements simultaneously with detection limits in the low parts-per-billion range — well below the concentration thresholds of concern for most applications. Accredited laboratories use validated ICP-MS methods that meet the specificity, precision, and recovery criteria your safety assessor needs in order to cite the data with confidence.

But ICP-MS total-element results don’t always tell the complete story. Three areas where additional speciation work changes the interpretation significantly:

Arsenic speciation. Total arsenic includes inorganic arsenic (the regulated, toxic form) and organic arsenic species such as arsenobetaine and arsenocholine, which are considered essentially non-toxic. Seaweed-derived ingredients — spirulina, chlorella, kelp, and various marine botanicals — tend to carry high total arsenic that is predominantly organic in form. A total arsenic result of 2.5 ppm in a spirulina powder sounds alarming until speciation reveals that inorganic arsenic represents a small fraction of that total. Without the speciation step, you either reject a technically compliant material or, worse, you accept a result at face value without understanding what it represents toxicologically.

Mercury speciation. Methylmercury — the neurotoxic form found in some marine-derived ingredients — carries a substantially different risk profile from inorganic mercury. A total mercury figure of 0.1 ppm means something different in a fish collagen ingredient than in a non-marine botanical extract. Your safety assessor needs to know which form is present.

Matrix-matched method validation. Testing a complex emulsion or powder matrix requires a validated method specific to that matrix type. Results produced using an aqueous standard curve without appropriate matrix-matched recovery data may not meet the analytical quality requirements referenced in SCCS guidance. This matters especially when results are close to a benchmark value — the uncertainty range around an unvalidated result can encompass the threshold you’re trying to demonstrate compliance against.

These are details that only become visible once you’re working with a laboratory that understands the regulatory context — not just the analytical method.

Building a Heavy Metals Testing Strategy That Holds Up to DGCCRF Scrutiny

The practical question for most EU manufacturers is not whether to test, but how to build a programme that is proportionate, risk-based, and generates data your safety assessor can actually use. Testing everything to the same depth makes no regulatory sense and adds cost without adding insight.

Tier your raw materials by inherent risk. Mineral-derived ingredients (pigments, fillers, absorbents, clay-based actives), botanical extracts from soil-intensive or high-pollution growing regions, and marine-derived materials carry elevated elemental risk. Synthetic organic actives and well-characterised fermentation-derived ingredients carry lower risk. Your testing frequency and analytical depth should follow that risk tier — not be applied uniformly across the entire bill of materials.

Calculate limits from the exposure scenario, not from generic industry benchmarks. Rather than adopting an arbitrary internal limit from a supplier’s specification, work backwards from the exposure scenario documented in your safety assessment. What is the daily skin exposure, or the daily ingested dose for your supplement? What does that imply for an acceptable finished-product concentration, given the relevant SCCS or EFSA reference values? A product-specific, exposure-anchored limit is far more defensible than a generic “below 10 ppm” threshold that appeared in a technical bulletin fifteen years ago.

Document incoming material testing in your ISO 22716 quality system. Catching a high-arsenic botanical extract before it enters your formulation batch is considerably less disruptive than discovering it in a finished product that has already been manufactured. Incoming material testing with documented specification limits is standard practice under ISO 22716 GMP — and inspectors will look for it. If your quality system shows a supplier qualification process with defined acceptance criteria for elemental impurities, your compliance position is materially stronger than if heavy metals appear nowhere in your raw material procedures.

Use ISO/IEC 17025-accredited data throughout. Accreditation is not merely a quality signal — it is what allows a safety assessor to cite results as analytically reliable in a PIF that may face regulatory scrutiny in any EU member state. Our partner laboratories in France, the US, and Canada all operate under ISO 17025 accreditation for elemental analysis, which means results transfer cleanly between safety dossiers regardless of the target market.

One pattern that appears regularly in our consulting engagements: European brands that relied on supplier CoAs for heavy metals data — rather than commissioning independent verification — typically discover discrepancies when they prepare a safety dossier for US FDA or Health Canada NHP submission, where requirements are more prescriptive and independent verification is effectively mandatory. The gaps are rarely catastrophic, but they add weeks to a market-entry timeline and remove the element of choice about when to address them.

The cleaner path is to build a testing programme that generates defensible data for the EU market first — and that happens to satisfy North American requirements when you’re ready to expand.

---

Written by Nour Abochama, Quality & Regulatory Advisor, Care Europe | VP Operations, Qalitex. Learn more about our team

Talk to our team about EU market entry, heavy metals testing strategy, or safety assessment support. Contact us

Related from our network

• ISO 17025-accredited heavy metals and elemental analysis testing — Qalitex Laboratories provides ICP-MS testing for cosmetics, supplements, and raw materials under full ISO 17025 accreditation, with results suitable for EU, US, and Canadian regulatory submissions.
• Heavy metals testing for Canadian NHP submissions — Androxa supports Health Canada Natural Health Product dossiers with elemental impurity testing calibrated to EFSA and Health Canada contaminant guidance values.