What a REACH CoC Actually Tells You About Your Cosmetic Ingredients — and the Gaps That Matter

Last year, a mid-sized French cosmetics brand reformulated their best-selling vitamin C serum with a new emollient sourced from a German chemical distributor. The supplier provided a REACH Certificate of Compliance without hesitation — registration confirmed, no flagged SVHCs, declaration dated three months prior. The regulatory team filed it, ticked the supplier qualification box, and moved toward launch.

Nineteen weeks later, during final CPSR review, the brand’s cosmetic product safety assessor flagged the same ingredient as a potential endocrine disruptor currently under ECHA substance evaluation — a status that had been published in ECHA’s Community Rolling Action Plan for over eight months and that would eventually affect Annex III restrictions under Regulation 1223/2009. None of that was in the CoC. None of it would ever be.

That delay cost the brand a full season’s commercial window. And it was entirely avoidable — if the team had understood what a REACH CoC is designed to tell you, and where its scope ends.

What a REACH CoC Is — and What It Isn’t

A REACH Certificate of Compliance (sometimes called a REACH CoC, or a REACH declaration of conformity) is a supplier-issued document confirming that a substance or mixture meets the requirements of EU Regulation (EC) No 1907/2006. Specifically, it confirms that the substance has been registered with the European Chemicals Agency (ECHA) at the applicable tonnage band, or that it qualifies for a recognised exemption — polymers, intermediates, R&D substances below threshold quantities, and so on.

That’s a narrower statement than most formulators assume.

REACH registration confirms that the registrant has submitted a technical dossier to ECHA covering the substance’s hazard profile, safe use conditions, physicochemical data, and exposure scenarios. It does not mean the substance has been assessed by the Scientific Committee on Consumer Safety (SCCS). It does not confirm the substance is absent from Annex II of Regulation (EC) No 1223/2009 — the EU Cosmetics Regulation’s list of prohibited substances, which currently numbers over 1,300 entries. And it does not constitute any form of approval from the European Commission’s DG GROW, which owns the cosmetics regulatory framework.

These are different regulations, maintained by different agencies, enforced through different mechanisms. ECHA manages REACH. The European Commission manages Regulation 1223/2009. A CoC from your ingredient supplier tells you something meaningful about the former. It tells you almost nothing about the latter.

This isn’t esoteric regulatory theory. In practice, across European cosmetics manufacturers of every size, the REACH CoC is the document most frequently cited as evidence of ingredient safety in supplier qualification files — often without any cross-reference to Annex II, Annex III, or the broader SVHC picture as it applies to finished product formulations.

The SVHC Candidate List: Why 0.1% Is Not a Safety Threshold for Cosmetics

REACH’s Candidate List of Substances of Very High Concern (SVHCs) is the mechanism that causes the most persistent compliance confusion for cosmetics brands. As of early 2026, the list contains over 240 substances — including CMR category 1A and 1B materials (carcinogenic, mutagenic, or toxic to reproduction), persistent bioaccumulative and toxic (PBT) substances, very persistent and very bioaccumulative (vPvB) substances, and a growing cohort of endocrine disruptors identified under the EU’s 2020 Chemicals Strategy for Sustainability.

Under Article 33 of REACH, suppliers of articles must notify customers if an SVHC is present in their product above 0.1% weight-by-weight. This notification triggers a communication obligation down the supply chain. It does not trigger a prohibition. It does not establish a maximum permitted level.

Here is where cosmetics manufacturers need to be particularly attentive: Regulation 1223/2009 applies a different and stricter standard. Many substances that appear on the SVHC Candidate List are either already prohibited under Annex II or restricted under Annex III with specific concentration limits that have nothing to do with the 0.1% REACH threshold. CMR substances of category 1A and 1B are prohibited from cosmetic products under Article 15 of Regulation 1223/2009 unless the SCCS has determined them to be safe — a specific scientific evaluation that very few substances pass.

So when a supplier’s REACH CoC states that their ingredient contains an SVHC at 0.08% w/w — technically below the Article 33 communication threshold — that information doesn’t provide reassurance. It provides a starting point. The question your regulatory team needs to answer isn’t “Is this above 0.1% per REACH?” It’s “Is this substance permitted in cosmetic products at any concentration under Regulation 1223/2009 Annex II, and if so, what are the Annex III restrictions and labelling requirements?”

We’ve seen this gap cause real problems during CPSR preparation. The CPSA asks about SVHC status; the regulatory file contains a CoC with a clean bill of health; and a false sense of compliance delays the substantive check that should have happened weeks earlier.

What a Robust REACH CoC Should Actually Contain

A properly issued, current REACH CoC should confirm, at minimum:

Registration status and number: The substance is registered with ECHA under a verifiable registration number, accessible through ECHA’s public database. If the supplier cannot provide a registration number, that’s a supplier qualification failure, not a minor administrative gap.

Tonnage band validity: REACH registration dossiers are submitted per tonnage tier — 1–10 tonnes per year, 10–100 t/yr, 100–1,000 t/yr, and so on. The registration must cover the volume actually being supplied. A supplier registered at the 1–10 t/yr band who subsequently scales supply to 50 tonnes annually has a compliance gap.

SVHC Candidate List status: A statement that the substance itself is not listed as an SVHC, or — if it is listed — at what concentration it appears in the supplied material, with a declaration date that reflects the most recent Candidate List update. ECHA publishes updates to the Candidate List twice per year, typically in January and June.

Annex XVII restriction compliance: A statement that the substance is not subject to use restrictions under REACH Annex XVII for the intended application, or that any applicable restrictions are met.

Declaration date: This is not optional. A CoC issued 18 months ago may not reflect additions to the Candidate List that occurred in the intervening period. Any CoC older than 12 months without a supplier-issued re-confirmation letter should be treated as potentially outdated.

What a CoC does not contain — and what cosmetics brands often assume it covers:

• Any assessment under Regulation 1223/2009 Annexes II through VI
• Microbiological specification compliance
• Residual solvent or process-related impurity data (unless specifically registered)
• Heavy metals profiling beyond any REACH-specific requirements for the substance
• Traceability data for botanical raw materials
• IFRA compliance for fragrance ingredients

For finished cosmetics, that second list often matters more than the first.

The Four-Document Review That Holds Up Under Inspection

A REACH CoC treated as a standalone compliance checkpoint is the most common supplier qualification gap we encounter when working with European cosmetics brands. A review that will hold up under a Responsible Person audit — or, in France, under a DGCCRF inspection where the Product Information File is examined — needs to bring together four documents in combination.

Step 1 — Obtain a current-dated REACH CoC. Reject any CoC older than 12 months without a written re-confirmation from the supplier. Request the ECHA registration number and verify it independently via the ECHA substance database. This takes under five minutes and eliminates the most common supplier documentation fraud.

Step 2 — Review the SDS under Regulation (EC) No 1272/2008 (CLP). The Safety Data Sheet is a different document from the CoC, and they serve different regulatory purposes. Section 15 of the SDS should reference both REACH status and any applicable national regulations. Section 3 provides composition data for mixtures — relevant if you’re sourcing a formulated ingredient rather than a pure substance. The SDS won’t tell you whether an ingredient is cosmetically compliant, but it will tell you whether your supplier has classified any component as a CMR substance — which is an immediate further-investigation trigger.

Step 3 — Pull the CoA for the supplied lot and cross-reference against your CPSR specifications. A Certificate of Analysis for the actual batch confirms that the physical material you received meets the registered substance identity and the purity parameters referenced in your cosmetic product safety assessment. A discrepancy between the CoA’s heavy metals data and the limits assumed in your safety assessment is a product safety issue, not a paperwork issue.

Step 4 — Run an internal Annex II/III/VI cross-reference. Search the substance’s INCI name, CAS number, and any synonyms against Regulation 1223/2009’s current consolidated Annexes. This is the step most brands skip — partly because it’s time-consuming, partly because they assume the supplier would have flagged anything prohibited. But under Article 5 of Regulation 1223/2009, it’s the Responsible Person who bears legal accountability for placing a compliant product on the EU market. That obligation doesn’t transfer to the ingredient supplier because the supplier provided a REACH CoC.

Running all four isn’t bureaucratic excess. It’s the minimum defensible position if a market surveillance authority ever requests your PIF.

The Evaluation Pipeline Your CoC Doesn’t Reflect

Some SVHC designations and eventual cosmetic restrictions don’t arrive without warning — they move through a pipeline that’s publicly visible years before a restriction enters force.

ECHA publishes a Community Rolling Action Plan (CoRAP), updated annually, listing substances under ongoing substance evaluation by Member State competent authorities. ECHA’s Committee for Risk Assessment (RAC) and Committee for Socioeconomic Analysis (SEAC) adopt opinions on substances proposed for Annex XIV authorisation requirements or Annex XVII restrictions. The SCCS adopts safety opinions on individual cosmetic ingredients on a case-by-case basis, triggered by the European Commission or by industry dossier submissions. None of these processes are reflected in a REACH CoC — because a CoC reports current compliance status, not forward-looking regulatory risk.

For product lines with a commercial horizon of two to four years or longer, monitoring CoRAP updates and SCCS opinion publications is part of a proactive regulatory strategy, not an optional extra. ECHA typically adds 5–15 new substances to CoRAP annually, and a substance entering formal restriction procedures can reach an Annex XV dossier within 18 to 30 months of initial identification. Reformulation timelines in cosmetics are rarely under six months from decision to validated commercial batch.

Catching a regulatory signal early — when it’s still a CoRAP entry and not yet an Annex II prohibition — is the difference between a planned line extension and an unplanned market withdrawal.

---

Written by Nour Abochama, Quality & Regulatory Advisor, Care Europe | VP Operations, Qalitex. Learn more about our team

Talk to our team about EU market entry and REACH compliance review for your cosmetic formulations. Contact us

Related from our network

• REACH CoC Verification and ISO 17025-Accredited Cosmetic Ingredient Testing — Qalitex Laboratories provides accredited analytical testing and supplier qualification support for cosmetic ingredient compliance.
• Health Canada NHP Ingredient Compliance for Cosmetics Entering Canada — Androxa supports European brands navigating Health Canada requirements for natural health and cosmetic products sold in the Canadian market.