REACH Regulation Explained: SVHCs, Compliance & Your Supply Chain (2026)

If your products contain chemicals — in the material, the coating, the adhesive, or the packaging — the EU’s REACH regulation almost certainly reaches your supply chain. It governs more than 23,000 registered substances and controls access to a single market worth over €16 trillion. And in 2026 the picture shifted again: the EU shelved its long-planned overhaul of REACH, the list of the most dangerous substances passed 250, and a landmark restriction on “forever chemicals” moved a step closer. This guide explains what REACH regulation requires in 2026, who has to comply, and how it now sits inside your broader supply chain due diligence obligations.

What is the REACH regulation?

REACH — Registration, Evaluation, Authorisation and Restriction of Chemicals — is the European Union’s flagship chemical safety law, enacted as Regulation (EC) No 1907/2006 and in force since 2007. It applies to chemical substances manufactured, used or imported into the EU above one tonne per year, whether on their own, in mixtures, or contained in articles (finished goods) — from industrial solvents to the dyes in clothing and the additives in furniture. The European Chemicals Agency (ECHA) administers it, with tens of thousands of registered substances on record.

REACH rests on a simple principle — “no data, no market.” The burden is on companies to prove their substances are safe, not on regulators to prove they are dangerous. In practice that means four obligations working together: identifying and managing hazardous chemicals, promoting safer alternatives, communicating risk transparently across the supply chain, and controlling the highest-risk substances tightly. Each of those overlaps directly with the human-rights and environmental due diligence now required under the EU Corporate Sustainability Due Diligence Directive (CSDDD) and Germany’s LkSG.

Who needs to comply with REACH?

REACH applies broadly across industries and supply chains. The regulation covers any business that manufactures, imports, uses or distributes chemical substances in the EU — as standalone substances, in mixtures, or contained in articles. Your role determines your obligations.

Manufacturers

Companies producing chemical substances in the EU must register them with ECHA — compiling technical dossiers, testing where required, and preparing a Chemical Safety Report (CSR) for substances above 10 tonnes/year. They must also inform downstream users of safe handling and any restrictions. Under CSDDD, manufacturers in complex chains are increasingly expected to demonstrate visibility and control over hazardous-substance use across their supplier network, not just their own gate.

Importers

Importers bringing substances, mixtures or articles into the EU must ensure those substances are registered — if the non-EU manufacturer has not done so, the obligation lands on them. Non-EU manufacturers often appoint an Only Representative (OR) to carry the duties. With supply chain due diligence rules tightening, importers sourcing from outside the EU carry particular responsibility for verifying chemical safety upstream.

Downstream users

Businesses that use chemicals in production but don’t manufacture or import them — formulators making paints or adhesives, manufacturers building chemicals into finished goods — must ensure the substances they use are registered, apply the risk-management measures their suppliers specify, and report any use to ECHA that falls outside a registered use. As traceability requirements intensify, downstream users increasingly need structured data systems to prove the substances they rely on are compliant.

Which sectors are most exposed

REACH reaches electronics, automotive, cosmetics, textiles, construction and more — anywhere regulated substances end up in a product. An electronics maker using flame retardants, a textile supplier using dyes and finishes, a manufacturer using PVC and its additives: all carry REACH obligations, and all increasingly have to document that compliance for ESG disclosures. This is the same substance-and-supplier exposure captured in a supply chain regulatory risk assessment — REACH is the chemical-substance axis of that wider map.

The four pillars of REACH

REACH breaks into four core mechanisms. Understanding how each one works — and where it touches your supply chain — is the foundation of a defensible compliance program.

• Registration — Companies must register substances they manufacture or import above one tonne/year, submitting a dossier to ECHA on the substance’s properties, uses and risks. REACH follows a “one substance, one registration” principle, so registrants of the same substance submit jointly.
• Evaluation — ECHA and member states check dossier quality and assess whether a substance poses a risk, through the Community Rolling Action Plan (CoRAP). This can trigger requests for more testing or move a substance toward restriction.
• Authorisation — Substances of Very High Concern (SVHCs) are placed on the Candidate List — 253 substances as of February 2026 — and the most concerning may require authorisation for specific uses, forcing companies to justify continued use or substitute.
• Restriction — Annex XVII restricts or bans certain substances in certain uses, and is updated regularly. Recent activity centres on PFAS (“forever chemicals”) and microplastics.

What changed for REACH in 2026

For years, industry braced for a sweeping revision of REACH — the so-called “REACH 2.0.” In 2026 that changed direction. On 27 April 2026, the European Commission confirmed it would not reopen REACH for a comprehensive overhaul. High-impact reforms once on the table — a 10-year registration validity, mandatory polymer registration, wholesale changes to authorisation — are unlikely to proceed through a full rewrite in the near term. Instead, the emphasis moves to simplification, targeted technical updates, dossier quality, border controls and enforcement.

That does not mean REACH stands still. Two areas are moving fast. First, the SVHC Candidate List keeps growing — it reached 253 entries in February 2026, and every addition can create new communication and authorisation duties. Second, the universal PFAS restriction — proposed by five member states to restrict thousands of per- and polyfluoroalkyl substances — advanced significantly: ECHA’s Risk Assessment Committee adopted its final opinion on 3 March 2026, with both scientific committees’ opinions due to the Commission by the end of 2026. A separate restriction on PFAS in firefighting foams starts to apply from October 2026. For any company using fluorinated chemistries, the direction of travel is clear.

How REACH affects your supply chain

REACH compliance is rarely contained to one company — it runs the length of the supply chain, and that’s where it gets hard.

• Traceability — you must trace and document the substances used across your chain, often collaborating with tier 1, 2 and 3 suppliers to get accurate data. This overlaps directly with due-diligence mandates under LkSG and CSDDD.
• Process change — substituting a restricted substance can mean reformulating a product or requalifying a supplier, with lead times measured in months.
• Market access — non-compliance can mean losing access to the EU single market, plus product withdrawals and lost contracts, particularly from customers with their own CSDDD or LkSG obligations.
• Cost & credibility — registration, testing and monitoring carry real cost, but proactive compliance reduces risk exposure and strengthens the ESG credentials buyers and investors now check.

How to achieve REACH compliance, step by step

REACH compliance becomes manageable when you break it into a repeatable process rather than an annual scramble.

1. Identify the substances in scope

Catalogue every chemical substance you make, import or use, then check them against ECHA’s database and the SVHC Candidate List to flag anything requiring disclosure, authorisation or restriction.

2. Determine your role and duties

Establish whether you’re a manufacturer, importer or downstream user for each substance — obligations differ, and one entity can hold several roles at once.

3. Assess risk and document safe use

Analyse each substance’s hazards, document safe-use practices, and prepare a Chemical Safety Report where required (above 10 tonnes/year). Align this with your CSDDD and LkSG risk mapping so the same evidence serves both.

4. Register through ECHA

Prepare dossiers in IUCLID, join the relevant Substance Information Exchange Forum (SIEF) to share data and avoid duplicate testing, and submit jointly via the REACH-IT portal under a lead registrant. Fees vary by company size and volume, with SME reductions available.

5. Monitor the Candidate List and Annex XVII

ECHA updates the Candidate List roughly twice a year and amends Annex XVII restrictions regularly. Continuous monitoring — not an annual check — is what keeps you ahead of a new SVHC or restriction affecting your products.

6. Engage suppliers and evidence it

Collect substance data from suppliers with standardised requests, verify it, and keep an audit-ready record. Recurring supplier audits and assessments turn fragmented supplier declarations into a defensible compliance trail — the same infrastructure your supply chain due diligence program needs.

Common REACH compliance challenges — and how to solve them

• Regulatory complexity — break the process into defined steps and use ECHA guidance; integrate REACH tracking with your wider ESG and due-diligence workflows so the work isn’t duplicated.
• Keeping up with updates — the Candidate List and Annex XVII change frequently; automate regulatory monitoring rather than relying on manual checks.
• Supplier data gaps — standardise supplier data requests and verify across tiers; this is the hardest part, and the one where structured tools pay off most.
• Cost — join SIEFs and industry consortia to share testing and registration costs, and use SME support from ECHA where eligible.

Exemptions to REACH

Not everything falls under the full weight of REACH. Some substances are fully exempt — radioactive substances, substances under customs supervision in transit, defence-specific substances, waste, and non-isolated intermediates. Others are partly exempt: substances used in scientific research and development, in food and feed, or as medicinal products are exempt from registration and authorisation, while Annex IV substances (68 low-risk substances such as nitrogen and corn oil), Annex V categories, unmodified naturally occurring substances, polymers (though their monomers must be registered), and already-registered recycled substances are exempt from registration. Even where an exemption applies, other REACH duties — and broader CSDDD environmental due diligence — may still bite.

How Certainty supports REACH compliance

Certainty makes REACH compliance sustainable by simplifying how you collect, manage and report chemical safety data across your supply chain. Custom forms, automated multi-stage workflows, configurable dashboards and audit-ready reporting give you control over your REACH program — while building the supplier data infrastructure you need for CSDDD, LkSG and CSRD at the same time. The point isn’t just to register substances once. It’s to trace them, monitor them against the Candidate List, and improve control cycle after cycle — with the evidence to prove it.

You might also be interested in

Frequently Asked Questions (FAQs)

What is the REACH regulation in simple terms?

REACH is the EU’s chemical safety regulation (Regulation (EC) No 1907/2006). It requires companies that make, import or use chemicals in the EU above one tonne per year to register them, prove they can be used safely, and control or replace the most hazardous ones. Its guiding principle is “no data, no market.”

What are Substances of Very High Concern (SVHCs)?

SVHCs are substances that pose serious, often irreversible risks to health or the environment — carcinogenic, mutagenic or reproductive-toxic (CMR) substances, persistent bioaccumulative and toxic (PBT) substances, and endocrine disruptors. ECHA lists them on the Candidate List, which reached 253 entries in February 2026, and their presence must be communicated down the supply chain when above 0.1% by weight in an article.

Is REACH being revised in 2026?

Not comprehensively. On 27 April 2026 the European Commission confirmed it would not reopen REACH for a full overhaul. Instead, changes are expected through simplification, targeted technical updates, stronger enforcement, and specific restrictions — most notably on PFAS — rather than a wholesale “REACH 2.0” rewrite.

How does REACH relate to CSDDD and CSRD?

REACH is a product-level chemical safety regulation; CSDDD and CSRD are broader due-diligence and reporting frameworks. REACH compliance data — substance hazard profiles, substitution actions, supplier chemical transparency — feeds directly into CSDDD environmental due diligence and CSRD/ESRS disclosures. Companies with strong REACH records are better placed to satisfy both.

What are the penalties for REACH non-compliance?

Penalties are set by individual EU member states and vary, but can include significant fines, mandatory product withdrawal from the EU market, and in serious cases criminal liability for directors. Beyond legal penalties, non-compliance can trigger supply chain disruption, loss of major contracts, and reputational damage.

How can compliance software help with REACH?

Platforms like Certainty centralise substance data, automate SVHC monitoring against the ECHA Candidate List, run and document supplier chemical audits, and generate audit-ready reports for both REACH and broader ESG disclosures. That reduces manual effort, closes compliance gaps, and strengthens supply chain transparency.