REACH Certificate of Conformity: What Cosmetics Brands Must Demand from Ingredient Suppliers

Most cosmetics brands have a folder — physical or digital — stacked with supplier REACH declarations. The problem is that a significant share of those documents, in our experience reviewing compliance files across the EU, contain errors serious enough to create genuine legal exposure: missing registration numbers, SVHC assessments that reference an outdated Candidate List, or declarations that simply restate what the regulation says without actually confirming what the supplier has done.

A REACH Certificate of Conformity (CoC) is not a bureaucratic checkbox. Under Regulation EC No 1907/2006, it’s the primary mechanism by which downstream users — your formulation and procurement teams included — can demonstrate that the substances entering your products have been properly registered, assessed, and handled throughout the supply chain. Get it wrong, and the consequences vary by member state but can be substantial: in France, deliberate REACH violations can carry fines up to €75,000 and custodial sentences under the environmental code.

So what does a legitimate REACH CoC actually contain, and how do you separate the enforceable documents from the ones that merely look convincing on paper?

What REACH Actually Requires from Your Ingredient Suppliers

REACH operates on a “no data, no market” principle. Under Article 5, substances manufactured or imported into the EU in quantities ≥ 1 tonne per year per manufacturer or importer must be registered with the European Chemicals Agency (ECHA). As of 2024, ECHA’s registry holds dossiers for more than 23,000 unique registered substances — but that number represents a fraction of the estimated 145,000 substances known to be in commercial use across Europe.

For cosmetics manufacturers specifically, REACH and Cosmetics Regulation 1223/2009 create overlapping obligations that don’t simply cancel each other out. An ingredient might pass the safety assessment under 1223/2009 and still trigger REACH obligations if it qualifies as a Substance of Very High Concern (SVHC). ECHA’s SVHC Candidate List now contains 240 substances — updated each June and December under Article 59 — and any supplier whose ingredient appears on that list must notify ECHA and communicate the SVHC presence proactively to downstream users.

The obligation that’s most frequently mishandled is Article 33. If an article containing an SVHC above 0.1% by weight is supplied, the supplier must proactively inform the recipient of that fact, along with the name of the substance. Many ingredient suppliers treat this as optional disclosure or wait for the customer to ask. Under the regulation, it’s neither optional nor reactive.

The Anatomy of a Valid REACH Certificate of Conformity

ECHA doesn’t issue a standardised CoC form. What exists in practice is a supplier declaration — ideally on company letterhead, signed by a named responsible person — that covers specific elements. When we work through supplier qualification with European brands, these are the fields we verify:

Substance identification. Every substance must be identified by name, CAS number, and EC number. For preparations and mixtures, the CoC should address each component that independently requires registration. A single-sentence declaration stating “our products comply with REACH” without substance-level identification is essentially unverifiable.

REACH registration number. For substances above the 1-tonne/year threshold, the registration number should appear in the format 01-XXXXXXXXXX-XX-XXXX. This number is publicly searchable on ECHA’s registered substances database. If a supplier can’t provide one, ask them to specify the basis for exemption in writing — and be appropriately sceptical of vague answers.

Authorisation and restriction status. The CoC should explicitly confirm whether the substance appears in Annex XIV (the Authorisation List) or Annex XVII (the Restriction List). Annex XIV currently includes approximately 59 substances requiring prior ECHA authorisation before continued use; if your ingredient is on it, your supplier must hold a valid authorisation number, and that number should appear in the document.

SVHC Candidate List assessment. This is where declarations most often fall short. An adequate CoC includes a clear affirmative statement confirming the substance does not appear on the current Candidate List — or, if it does, disclosing the concentration and the specific SVHC property (carcinogenic, mutagenic, reprotoxic, persistent bioaccumulative toxic, or endocrine-disrupting, among others).

Issue date and version. ECHA updates the SVHC Candidate List twice yearly, in June and December. A CoC with no issue date — or one issued more than 12 months ago — may be misaligned with the current list. We recommend requesting refreshed declarations on an annual cycle, timed to follow the December update.

Five Red Flags That Should Disqualify a Supplier’s REACH CoC

After reviewing supplier documentation across dozens of European cosmetics supply chains, these are the failure modes that appear most consistently:

1. “Our products are REACH compliant” — full stop. This tells you nothing actionable. Compliant with which obligation? At what tonnage band? For which substances? It’s the regulatory equivalent of a test report that lists no methods and no results. Demand specifics.

2. No REACH registration number. Some suppliers are genuinely exempt — substances below 1 tonne/year per supplier, R&D-phase substances, or naturally occurring non-hazardous substances. But the CoC should explicitly state the basis for exemption, not simply omit the number. Silence is not an exemption, and it transfers risk to you.

3. SVHC assessment acknowledged but not concluded. A declaration reading “SVHC status was checked as of [date]” without stating the outcome is incomplete. The outcome is what matters: is the substance on the Candidate List or is it not? A declaration that avoids that answer should be sent back for revision before the supplier is approved.

4. A single portfolio-wide CoC. Some suppliers issue one document covering their full product range. This approach is almost never adequate because each substance has its own registration number, its own SVHC profile, and its own position relative to Annex XIV and XVII. A blanket declaration provides no substance-level assurance.

5. No named responsible party. Under REACH, the registration obligation rests with the legal entity placing the substance on the EU market. The CoC should identify the registrant by full legal name and, where applicable, ECHA registration number. An anonymous or company-branded-only declaration creates no traceable accountability and will not satisfy an auditor.

How to Cross-Check REACH Registration Numbers with ECHA

Verifying a supplier’s registration number takes under two minutes. Navigate to echa.europa.eu, go to “Information on Chemicals,” and search the registered substances database by CAS number or substance name. The results display the registration dossier, including the registered tonnage band and, in many cases, the registrant identity.

Two things to verify once you locate the entry. First, confirm that the legal entity named on the dossier matches the company on your supplier’s CoC. A legitimate EU importer should appear as a co-registrant or hold a Letter of Access to the lead registrant’s dossier — either is acceptable, but it should be traceable. Second, check the substance flags in the results: ECHA marks substances under the Community Rolling Action Plan (CoRAP), proposed SVHCs, and authorised or restricted substances with distinct labels. Those flags update in near real-time and reflect the current regulatory position.

One practical nuance: many substances are registered through joint submission consortia. Individual co-registrants don’t always appear by name in the public database. In those cases, ask your supplier for their REACH-IT reference number — this is separate from the registration number and confirms their membership in the relevant Substance Information Exchange Forum (SIEF). It’s a reasonable request, and suppliers with nothing to hide will provide it readily.

When Your REACH Obligations Go Beyond the Supplier’s Document

Here’s something that catches even experienced regulatory teams off guard: a REACH CoC from your supplier satisfies the supplier’s obligation to communicate. It doesn’t automatically discharge your obligations as a downstream user.

Under Article 37 of REACH, downstream users who use a substance in a way not covered by the supplier’s Chemical Safety Report (CSR) must either prepare their own Chemical Safety Report or submit a use notification to ECHA. In the cosmetics sector, this matters when a brand uses an ingredient at concentrations higher than those assessed in the supplier’s extended Safety Data Sheet (eSDS), or in an application type the supplier didn’t anticipate when preparing their exposure scenarios.

Practically, this means your regulatory team must cross-reference the exposure scenarios included in the eSDS against your actual use conditions — concentration in the finished product, product category, intended user population. If your use case falls outside the supplier’s assessed scenarios, you have a documentation obligation of your own.

It’s also worth being explicit about the relationship between REACH and Cosmetics Regulation 1223/2009: they are parallel frameworks, not substitutes. Annex II of Regulation 1223/2009 prohibits 1,637 substances in cosmetics; Annex XVII of REACH restricts many of the same substances for broader industrial applications, often at different concentration limits or for different product forms. An ingredient cleared under 1223/2009’s Annex III as permitted with conditions may still trigger an Annex XVII restriction depending on concentration and product format. Running both checklists is not over-caution — it’s baseline practice in any GMP-compliant quality system.

Building a Supplier Qualification Cycle Around REACH CoC Requirements

Rather than treating REACH CoC collection as a one-time onboarding event, the most audit-ready approach is embedding it in an annual supplier qualification cycle. A practical three-step process:

1. Initial qualification: At onboarding, collect a full REACH CoC with registration numbers and a current SVHC statement. Verify each registration number against ECHA’s database before approving the supplier for ingredient use.
2. Annual refresh: Request updated CoCs each January, following ECHA’s December Candidate List update. Compare to the previous version — any newly listed SVHCs or new Annex XVII entries relevant to your ingredients should trigger an immediate formulation review.
3. Change notification clause: Include a contractual clause requiring suppliers to notify you within 30 days if their substance’s REACH status changes — new SVHC designation, new restriction, modification to an existing authorisation, or loss of authorisation. This mirrors the supplier communication obligations embedded in ISO 22716-compliant quality management frameworks and creates the upstream visibility that regulatory inspections expect to see.

The brands that accumulate risk aren’t always the ones who ignored REACH from the beginning. More often, they’re the ones who collected the right documents in 2019 or 2022 and never revisited them. The SVHC Candidate List stood at 59 substances when it launched in 2011. It’s at 240 now. That’s 181 additions — 181 opportunities for an outdated supplier declaration to leave your formulation in a position you didn’t intend.

---

Written by Nour Abochama, Quality & Regulatory Advisor, Care Europe | VP Operations, Qalitex. Learn more about our team

Talk to our team about EU market entry and REACH compliance support. Contact us

Related from our network

• REACH compliance for cosmetic raw materials — supplier audit approach — Qalitex Laboratories provides ISO 17025-accredited ingredient testing and documentation support for EU brands entering the US market.
• Canadian cosmetic ingredient compliance and Health Canada notification — Androxa covers REACH-adjacent Canadian obligations for European brands expanding into the Canadian market.