REACH CoC for Cosmetics Ingredients: What the Document Must Contain and How to Spot a Deficient One

The document arrives as a PDF attachment — company letterhead, an ink stamp, a signature, and somewhere near the bottom: “This product complies with REACH Regulation (EC) No 1907/2006.” For most European cosmetics buyers, that’s enough to tick the supplier-documentation box and move on. For a DGCCRF inspector reviewing your Product Information File, it rarely is.

A REACH Certificate of Conformance (CoC) is one of the most routinely requested and least critically reviewed documents in European ingredient sourcing. Brands assume the existence of the document equals compliance with the regulation. It doesn’t. The format is unregulated, the content is unverified, and in many cases the information is already outdated by the time it reaches your quality team.

Here’s what the document actually needs to say — and why a significant proportion of supplier CoCs don’t say it.

What REACH Actually Requires (And Why the CoC Format Is Unregulated)

REACH — Regulation (EC) No 1907/2006 on the Registration, Evaluation, Authorisation and Restriction of Chemicals — doesn’t contain the phrase “Certificate of Conformance” anywhere in its 849 articles. What it mandates is a set of specific obligations: Article 31 requires suppliers to provide Safety Data Sheets (SDS) for hazardous substances and mixtures; Article 33 requires suppliers to inform downstream recipients if an article contains a Substance of Very High Concern (SVHC) above 0.1% w/w; and Annex XIV and Annex XVII establish which substances require authorisation or are subject to restriction for specific uses.

The CoC is industry shorthand for a supplier’s summary declaration that these obligations have been assessed and the material is compliant. Because no EU regulation specifies its format, required content, or minimum standards, a supplier can issue a document that says “REACH compliant” with no further detail. It’s technically a CoC. It’s also practically useless.

For cosmetics brands, this matters in a specific and very operational way. EU Cosmetics Regulation 1223/2009 requires a thorough safety assessment for every ingredient used in a finished product. Your Product Information File (PIF) is only as strong as the raw-material documentation behind it. A vague REACH CoC creates a gap that a competent authority review — or an internal audit ahead of launch — will surface.

The Six Elements That Make a REACH CoC Defensible

Most supplier CoCs contain between two and four of these. A document you can actually rely on contains all six.

1. Substance identification by CAS and EC number. The CoC must identify the substance being assessed — not just the commercial product name. Complex ingredients, botanical extracts, and multi-component blends need to enumerate each constituent for which REACH status was evaluated. A product name tells you nothing about which regulated substances may be present within it.

2. A dated Candidate List reference. The ECHA SVHC Candidate List currently contains over 240 substances. ECHA updates it twice per year — typically in June and December. A CoC that doesn’t specify which version of the Candidate List was reviewed is, for practical purposes, undated. If your supplier issued the document 18 months ago, there may have been three separate Candidate List updates since — any one of which could have added a substance present in your ingredient above the 0.1% w/w threshold.

3. An explicit Article 33 SVHC declaration. This is the element most commonly omitted. The declaration must state clearly whether any SVHC from the current Candidate List is present above 0.1% w/w concentration in the supplied article. “No SVHCs above threshold as of [Candidate List version, date]” is adequate. “This product is REACH compliant” is not — it tells you nothing about what was actually assessed.

4. Confirmation of Annex XIV and Annex XVII status. Annex XIV lists substances subject to authorisation — approximately 60 entries as of 2025, covering uses that are only permitted under a specific authorisation granted by ECHA. Annex XVII contains over 70 restriction entries, many of which set concentration limits or prohibit specific uses in consumer products, including cosmetics. Your CoC must confirm the substance’s status against both annexes for the intended cosmetic application.

5. SCIP database notification status. Since January 2021, under the amended Waste Framework Directive (2008/98/EC), suppliers placing articles on the EU market that contain SVHCs above 0.1% w/w must submit a notification to ECHA’s SCIP database (Substances of Concern In articles as such or in Complex objects Products). If your ingredient supplier is providing an article rather than a substance or mixture, ask explicitly whether a SCIP notification has been submitted and request the reference number.

6. An identified EU Responsible Party and a validity period. Non-EU manufacturers must appoint an Only Representative (OR) under Article 8 of REACH to fulfil registration and downstream communication obligations. The CoC should identify who carries legal responsibility within the EU — and it should include either a stated validity period or a documented commitment to re-issue the document following each Candidate List update.

The Article 33 Obligation That Falls on You, Not Your Supplier

Here’s where the conversation usually surprises brands: even a fully compliant, six-element CoC from your supplier doesn’t discharge your own downstream obligations under Article 33 of REACH.

If you incorporate an ingredient into a cosmetic product, and that finished product constitutes or contains an article with an SVHC above 0.1% w/w, you have an independent obligation to communicate that information to your B2B customers. And since 2021, EU consumers can request SVHC information about any article placed on the EU market — you must respond within 45 days.

This isn’t a remote regulatory edge case. Fragrance compounds, certain preservative systems, and an increasing range of botanically-derived constituents have appeared on — or moved closer to — the SVHC Candidate List over the past five years. A brand that hasn’t mapped its own ingredient portfolio against each biannual Candidate List update is carrying exposure it may not be aware of, and a supplier CoC alone won’t reveal it.

The practical implication is this: a solid CoC review process is necessary but not sufficient. You also need an internal SVHC tracking procedure that runs at least twice per year, aligned with ECHA’s June and December update cycle, and a mechanism for passing Article 33 notifications downstream when one is triggered.

Getting Better Documentation from Your Supplier

Most suppliers aren’t deliberately issuing deficient CoCs. They’re working from templates written years ago — often originally designed for industrial chemical supply chains where cosmetics PIF requirements weren’t a consideration. A direct conversation, backed by specific contractual language, usually resolves this quickly.

When updating supplier agreements or purchase specifications, consider requiring the following language:

• Explicit Article 33 SVHC declaration with reference to the specific Candidate List version and date reviewed
• CAS and EC numbers for all relevant substances within the supplied material
• A commitment to notify you within 30 days if any update to the ECHA Candidate List affects the SVHC status of the supplied material
• Confirmation of Annex XIV and Annex XVII status for the intended cosmetic use
• SCIP database reference number where an article is supplied containing SVHCs above threshold

Getting this language into the supply agreement — rather than requesting it on an ad hoc, lot-by-lot basis — is far more reliable. It also creates a documented trail of due diligence if you’re ever asked to demonstrate supplier qualification by a notified body, a retail customer, or a competent authority.

When the CoC Isn’t the Whole Story

A REACH CoC attests to what a supplier declares. It doesn’t verify what’s actually in the material. For ingredients sourced from supply chains with limited traceability, for botanical extracts with known adulteration or substitution risks, or for ingredients used at concentrations close to relevant thresholds, third-party analytical verification is the appropriate next layer of assurance.

ICP-MS screening for heavy metals against the concentration limits in Annex II and Annex III of EU Cosmetics Regulation 1223/2009 delivers measurement-based confidence that no supplier document can replicate. For complex botanical extracts, HPTLC identity testing confirms species identity and flags substitution or dilution. These aren’t redundant checks relative to REACH documentation — they answer a fundamentally different question.

Our team at Care Europe works specifically with European cosmetics brands navigating this layered compliance picture. Through our cross-continental partner-lab network, we connect EU regulatory advisory expertise with ISO 17025-accredited analytical capabilities for exactly the testing that supplier documentation alone doesn’t cover.

A REACH CoC is a starting point. For brands serious about PIF integrity and supplier qualification, it’s never the finishing line.

---

Written by Nour Abochama, Quality & Regulatory Advisor, Care Europe | VP Operations, Qalitex. Learn more about our team

Talk to our team about EU market entry Contact us

Related from our network

• ISO 17025-accredited cosmetics ingredient and raw material testing — Qalitex Laboratories provides accredited analytical testing for heavy metals, identity, and purity for European brands building US-standard supplier documentation.
• Supplier qualification and raw material compliance for the Canadian NHP market — Androxa supports European natural health brands meeting Health Canada’s ingredient documentation requirements, which parallel many REACH supplier-qualification principles.