REACH Compliance for Cosmetic Ingredients: The Dual Obligation European Brands Often Miss

A quality manager in Lyon runs a compliant cosmetics operation. Her Safety Data Sheets are current, her Product Information Files are in order, her Cosmetic Product Safety Report is signed off by a qualified Responsible Person. And yet, during a cross-border supplier qualification review, an undeclared Substance of Very High Concern turns up at 0.3% concentration in a fragrance blend she’s been sourcing for two years. The substance — a polycyclic aromatic compound — has been on the REACH Candidate List since early 2022. Nothing in Regulation 1223/2009 had flagged it.

That gap between two coexisting EU frameworks is something we see regularly in our advisory work. It catches otherwise well-run cosmetic businesses off guard, and the consequences range from a supplier audit finding to a formal non-conformity notice from a major retail account.

Two Regulations, One Ingredient: What Each Framework Actually Covers

Regulation (EC) No 1223/2009 — the EU Cosmetics Regulation — governs the safety of finished cosmetic products placed on the EU market. It controls prohibited and restricted substances through its Annexes (II through VI), mandates the Cosmetic Product Safety Report (CPSR), sets labelling requirements, and establishes the role of the Responsible Person. It’s a product-safety framework: its central question is whether a finished product is safe for a consumer under normal and reasonably foreseeable use.

REACH — Regulation (EC) No 1907/2006 — operates at the substance level. It governs the registration, evaluation, authorisation, and restriction of chemical substances throughout the supply chain. REACH applies to manufacturers and importers of chemical substances placed on the EU market at volumes of ≥1 tonne per year, and it imposes communication obligations regardless of volume when Substances of Very High Concern (SVHCs) are present.

The critical point: a cosmetic ingredient can be fully compliant under Regulation 1223/2009 and still create REACH compliance obligations for your business. The two frameworks overlap partially but are not interchangeable. Compliance with one does not extinguish obligations under the other.

Where the confusion typically arises: Annex II of Regulation 1223/2009 (prohibited substances) and Annex XVII of REACH (restricted substances) both target hazardous chemicals, and roughly 30% of their entries overlap in practical intent. But “overlap in intent” is not “identical in scope.” REACH Annex XVII currently contains over 72 restriction entries, several of which predate or extend beyond what 1223/2009’s annexes address. Relying exclusively on a 1223/2009 compliance check gives you an incomplete picture of your regulatory exposure.

Where REACH Compliance Goes Further Than the Cosmetics Regulation

The most underappreciated aspect of REACH for cosmetic manufacturers is Article 33. Under Article 33, any supplier of an article — which includes a finished cosmetic product — containing an SVHC above 0.1% by weight must provide sufficient information to allow safe use, automatically, and must provide that information to consumers upon request within 45 days. For a cosmetic product, the “article” could be the finished product itself, or even the primary packaging if it contains a listed substance.

As of mid-2025, ECHA’s Candidate List contains over 240 substances identified as SVHCs. That number has grown by an average of roughly 12–15 substances per year since the list was established in 2008, and ECHA’s rolling action plan continues to add substances across multiple hazard categories: endocrine disruptors, PBT compounds (persistent, bioaccumulative, and toxic), CMR substances (carcinogenic, mutagenic, or toxic for reproduction), and respiratory sensitisers.

Several Candidate List substances appear in raw material categories that cosmetic brands routinely source:

• Fragrance compounds — certain polycyclic musks and aromatic hydrocarbons used in fine fragrance and personal care
• UV filters — some benzophenone derivatives with endocrine-disrupting properties
• Preservative precursors — specific formaldehyde-releasing agents included on the Candidate List in successive ECHA updates
• Pigment dispersants — certain phthalate esters used in colorant systems

A fragrance supplier’s SDS may be fully REACH-compliant in isolation. But if your formulation brings an SVHC above that 0.1% threshold in the finished article, Article 33 obligations attach to your business as the downstream user and the entity placing the product on the market. Your safety assessor’s CPSR may pass a 1223/2009 review without any of this surfacing — because the CPSR isn’t designed to be a REACH Article 33 audit.

There’s also a timing gap around CMR substance classification that brands frequently underestimate. Annex VI to REACH establishes harmonised classification for substances, including CMR categories 1A, 1B, and 2. Under Regulation 1223/2009 Article 15, CMR 1A and 1B substances are prohibited unless the SCCS has evaluated them and the Commission has granted a specific derogation. The critical workflow issue: REACH harmonised classification updates feed into 1223/2009 compliance, but not in real time. There is typically a lag — sometimes 18 to 24 months — between a new harmonised REACH classification and an amendment to the cosmetics regulation’s annexes. During that window, a brand relying solely on their last 1223/2009 review may be unknowingly formulating with a newly reclassified CMR substance that REACH already covers.

Titanium dioxide (TiO₂) illustrated this precisely. Its classification as a Category 2 carcinogen by inhalation, confirmed through REACH harmonised classification in 2021, led to restrictions on aerosol cosmetic applications at the 1223/2009 level — but the compliance requirements for non-aerosol uses remained nuanced and continued to evolve for over two years. Brands tracking only the cosmetics regulation were perpetually one step behind.

SVHC Candidate List Monitoring: What a Practical System Looks Like

The practical challenge with REACH compliance in a cosmetics context is that most quality teams aren’t resourced to manually cross-reference 240+ SVHCs against every raw material in their formulation library. And many raw materials arrive as complex mixtures — fragrance blends, botanical extracts, emulsifier systems — where the SVHC status of individual constituents is buried in supplier-provided documentation of variable quality.

A few measures that consistently close this gap:

Request REACH Article 33 declarations proactively, not reactively. Your supplier has a legal obligation to inform you if a supplied article contains an SVHC above 0.1% by weight. But “legal obligation” and “reliable practice” are different things in a fragmented international supply chain. Make a formal REACH Article 33 declaration a standard deliverable in your supplier qualification process — alongside your SDS and COA requests — and specify that it must reference the current Candidate List by update date.

Use ECHA’s Candidate List as a direct formulation cross-check. For each raw material in a new or reformulated product, run the CAS numbers of known constituents against ECHA’s publicly maintained Candidate List database. With a structured spreadsheet, this takes roughly 20–40 minutes per formula. It surfaces candidates that a safety assessor’s standard toolset may not automatically flag, particularly for complex botanical extracts with multi-constituent profiles.

Anchor your review schedule to ECHA’s update cycle. ECHA typically publishes Candidate List additions twice per year, in approximately January/February and June/July. Registering for ECHA’s free email notification service and building those publication dates into your regulatory calendar prevents the scenario where a substance gets listed between your annual formula reviews without triggering any internal check.

Include packaging in your Article 33 assessment, not just the formula. REACH Article 33 applies to articles broadly — which means glass droppers, pump dispensers, aluminium tubes, and secondary cartons all fall within scope if they contain SVHCs at relevant concentrations. This dimension is almost universally absent from cosmetics-focused quality systems, and it’s where audit findings surface unexpectedly.

Building a Dual-Compliance Framework That Holds Up Under Scrutiny

The companies managing REACH and 1223/2009 well tend to do a few things structurally rather than reactively.

They treat REACH compliance as part of raw material qualification — not as an afterthought to the formulation safety assessment. Before a new raw material enters the approved supplier list, its REACH status (registration standing, SVHC declaration, Annex XVII restrictions) is confirmed alongside its toxicological and stability data. This keeps the information current and specific rather than relying on a general SDS check.

They maintain a regulatory watch process that covers both frameworks on a single calendar. SCCS opinions, ECHA Candidate List updates, Commission Regulation amendments to the cosmetics annexes, and ECHA restriction proposals under Annex XVII are tracked together — because a restriction proposal moving through ECHA’s process today frequently becomes a 1223/2009 annex amendment within 12 to 24 months. The brands that are never surprised by a regulatory update are the ones who saw it moving through the pipeline six months earlier.

They also audit their formulation library against the current SVHC Candidate List on a fixed cadence — at minimum annually, and ideally after each major ECHA publication. The cost of this review is a fraction of the cost of a non-conformity notice, a retail account delisting, or a product reformulation under time pressure.

For European brands with export ambitions, there’s a further layer to consider. The United Kingdom’s post-Brexit REACH system, administered by the HSE, is diverging from EU REACH as it develops its own Candidate List and restriction schedule. For the moment, alignment remains substantial, but the gap is widening with each successive update cycle. Brands managing both markets simultaneously need to monitor both systems — and should not assume that EU REACH compliance automatically satisfies UK REACH obligations.

For brands targeting North America, FDA’s expanded authority under the Modernization of Cosmetics Regulation Act (MoCRA) — which entered full effect in 2024 — adds a third distinct framework with its own ingredient safety requirements, facility registration obligations, and adverse event reporting rules. Neither EU REACH nor Regulation 1223/2009 maps cleanly onto MoCRA, and the delta between the EU and US requirements is wider than most brands anticipate before their first transatlantic market entry.

The gap this post describes isn’t usually the result of negligence. It’s the result of two perfectly rational decisions — building a 1223/2009-centred quality system, and assuming that framework covers the regulatory landscape. For most of the EU market, for most products, that assumption held reasonably well for years. But as ECHA’s Candidate List grows, as REACH restriction proposals accelerate, and as retail and B2B buyers increasingly request formal REACH declarations as part of their own compliance due diligence, the assumption is becoming an exposure.

The practical first step is straightforward: run your current formulation library against the ECHA Candidate List as it stands today, and request updated Article 33 declarations from your key fragrance and complex-mixture suppliers. Not next quarter. Before your next product launch review.

---

Written by Nour Abochama, Quality & Regulatory Advisor, Care Europe | VP Operations, Qalitex. Learn more about our team

Talk to our team about EU market entry and REACH compliance readiness. Contact us

Related from our network

• ISO 17025 Laboratory Testing for Cosmetic Raw Materials — Qalitex Laboratories provides accredited analytical testing to support EU and US cosmetic ingredient compliance programmes.
• Health Canada NHP Compliance for Cosmetic and Natural Health Products — Androxa supports European brands entering the Canadian market with NHP registration, GMP audits, and ingredient testing.