REACH Regulation and the Digital Product Passport: Which Substance Data Actually Goes In
The full REACH revision was dropped in April 2026 - changes now arrive as annex amendments instead. What REACH (EC) 1907/2006 actually requires from a manufacturer of finished goods, how the four substance lists differ, how the ESPR definition of a substance of concern is wider than the REACH Candidate List, and which substance fields belong in the Digital Product Passport.
REACH Regulation and the Digital Product Passport: Which Substance Data Actually Goes In
Key takeaways
REACH is Regulation (EC) No 1907/2006 on the Registration, Evaluation, Authorisation and Restriction of Chemicals. Most companies that read this are not chemical manufacturers - they make finished goods. That does not put them outside REACH: producers and importers of articles carry a notification duty, a communication duty down the supply chain, and full liability for the restrictions in Annex XVII.
Two things changed the picture in 2026. First, on 27 April 2026 the Commission confirmed that the long-promised full revision of REACH will not go ahead - the framework will be modernised through annex amendments in comitology instead. Second, the Ecodesign for Sustainable Products Regulation (ESPR) put substance data on a new footing: the substance of concern it expects in the Digital Product Passport is defined more broadly than the REACH Candidate List, and by default all such substances are tracked.
If you want the fundamentals of the passport itself first, start with Digital Product Passport in 15 Minutes.
What REACH actually requires from a manufacturer of finished goods
REACH separates three things, and almost every misunderstanding starts here:
- a substance - a chemical element or compound,
- a mixture - two or more substances,
- an article - an object whose shape, surface or design determines its function more than its chemical composition does.
A chair, a cable, a pump, a jacket and a bottle are articles. If you place articles on the EU market, the registration duty in Article 6 normally does not reach you - your suppliers of substances carry it. Four other duties do reach you:
1. Notification of substances in articles (Article 7(2)). If a Candidate List substance is present in your articles above 0.1 percent by weight and you place more than one tonne of that substance per year on the market in those articles, you must notify ECHA. The exemption in Article 7(3) applies only where exposure can be excluded under normal conditions of use and disposal - which is a demanding claim to document, not a default.
2. Communication down the chain (Article 33(1)). A supplier of an article containing a Candidate List substance above 0.1 percent by weight must give the recipient enough information to allow safe use, as a minimum the name of that substance. This is owed automatically, not on request, and it travels with every business-to-business delivery.
3. Communication to consumers (Article 33(2)). A consumer who asks gets the same information free of charge within 45 days. The obligation exists whether or not you have the data ready - which is why the answer often has to be assembled retroactively under time pressure.
4. Restrictions (Annex XVII). Restrictions apply directly. There is no notification, no permission, no transition unless the entry grants one: above the limit, the product may not be placed on the market at all.
Article 33 is the legal ancestor of the passport idea: the same information, pushed down the chain in a document today, is what the DPP is meant to make retrievable at the product itself.
The four lists that get confused with each other
| List | Legal basis | What it means for you | Size |
|---|---|---|---|
| Candidate List (SVHC) | REACH Art. 59 | Triggers Art. 7(2) notification, Art. 33 communication and the SCIP notification | 253 entries since 4 February 2026 |
| Authorisation List (Annex XIV) | REACH Art. 58 | Use in the EU requires an individual authorisation after the sunset date | Subset of the Candidate List |
| Restrictions (Annex XVII) | REACH Art. 67 | Direct ban or limit value for defined substances and uses | Grows by amending regulation |
| POPs | Regulation (EU) 2019/1021 | Not REACH at all - separate regime, stricter, near-total bans | Separate annexes |
The last Candidate List update was on 4 February 2026: ECHA added n-hexane and BPAF and its salts, taking the list from 251 to 253 entries. n-hexane is worth noting on its own - it is the first entry admitted on an equivalent level of concern basis for neurotoxicity, rather than through the classic carcinogenic, mutagenic or reprotoxic route. The practical reading: the criteria for getting onto the list are still widening, so a substance being “not on the list today” is a statement with a short shelf life.
Each new Candidate List entry starts a six-month clock for the SCIP notification - for the February 2026 additions the date was 4 August 2026. SCIP is a separate database with a separate legal basis; see SCIP Database: Reporting SVHC Substances.
What changed in April 2026: the REACH revision was abandoned
The revision of REACH had been announced under the Chemicals Strategy for Sustainability, originally due in February 2025, then postponed repeatedly - the Regulatory Scrutiny Board rejected the impact assessment in September 2025. On 27 April 2026, Commissioner Jessica Roswall told the European Parliament’s ENVI committee that the full overhaul will not be tabled. The stated approach instead: improve effectiveness inside the existing framework through simplification and modernisation adopted in comitology - that is, by amending the REACH annexes - together with a push on enforcement.
Two consequences are easy to get backwards.
This is not deregulation. Article 33, the Article 7(2) notification and the SCIP duty are untouched. Nothing about the abandoned revision removes a single existing obligation.
It makes planning harder, not easier. A single reform with one transposition date is something a compliance roadmap can absorb. A rolling stream of annex amendments cannot be planned for the same way: each one arrives on its own schedule, with its own scope and its own transition, and each one can invalidate a supplier declaration you obtained last year. Substance data held as a stack of PDF declarations is expensive to re-check against a moving list. Substance data held as structured records against CAS numbers can be re-queried in an afternoon.
The chemicals Omnibus VI package proposed in July 2025 is often mixed up with this. It does not amend REACH: it targets the CLP Regulation, the Cosmetics Regulation and the Fertilising Products Regulation.
What ESPR means by “substance of concern”
This is the definition that decides what your passport has to carry, and it is not a synonym for the Candidate List. Article 2(27) of Regulation (EU) 2024/1781 groups substances of concern in four categories:
(a) REACH-based - Candidate List substances of very high concern, present above 0.1 percent by weight.
(b) CLP-based - substances falling into the hazard classes and categories that the ESPR itself lists by reference to Annex VI of the CLP Regulation. This is the group most often missed, because a substance can be here without ever appearing on the Candidate List.
(c) POP-based - substances regulated under Regulation (EU) 2019/1021 on persistent organic pollutants.
(d) Circularity-based - substances that negatively affect the reuse or recycling of materials in the product. There is no list for this group. It is a functional test, and it is the one that will surprise design teams: a substance can be entirely legal, entirely safe in use, and still be a substance of concern because it makes the material unrecyclable.
The Commission’s stated baseline is that by default all substances of concern are tracked, with the aim of moving that information business-to-business, to consumers and to waste operators. The methodology behind it is public: on 21 November 2025 the Joint Research Centre published its report on a method for the identification and tracking of substances of concern in products and for the preparation of restriction measures - the working basis for how the Commission will decide what to track and what to restrict next under the ESPR.
Which substance fields belong in the passport
The exact list is set per product group in the ESPR delegated acts, so what follows is the data model to build against rather than a finished legal specification. Every version of it needs the same five things per substance:
- Identity - name plus a machine-readable identifier: CAS number, EC number, or both. A trade name is not an identifier.
- Location - which component or material the substance sits in. “Present somewhere in the product” is useless to a repairer and to a recycler, and it is the answer most existing supplier declarations give.
- Concentration - as a value or a declared range. The 0.1 percent threshold only means something if you know which side of it you are on.
- Safe-use information - what a handler, repairer or waste operator has to know.
- Granularity - whether the statement holds for the model, the batch or the individual item. Recycled input makes batch-level the honest answer more often than manufacturers expect.
Note what the passport does not do: it is decentralised. The European registry stores the identifier and a cryptographic hash of the passport version, not the substance data itself - see EU Digital Product Passport Registry. The substance record stays with you, which means it also stays your responsibility to keep current.
REACH, SCIP, RoHS and PPWR Article 5 - who owes what
One substance can trigger four different duties with four different thresholds and four different addressees. This is where compliance work usually leaks.
| Instrument | Who it addresses | Trigger | Where the data goes |
|---|---|---|---|
| REACH Art. 33 | Supplier of an article | Candidate List substance > 0.1 % w/w | To your customer, and to consumers on request within 45 days |
| SCIP | Supplier of an article on the EU market | Same trigger | To ECHA, published |
| RoHS | Producer of electrical and electronic equipment | Ten restricted substances, own limits | Technical documentation, EU declaration of conformity |
| PPWR Art. 5 | Packaging manufacturer | Heavy metals, PFAS in food-contact packaging | Packaging declaration of conformity |
The overlaps have their own articles: RoHS Directive and PPWR Article 5 - PFAS limits and heavy metals. The point of the table is only this: “we are REACH compliant” answers none of the other three.
The dates that matter between now and 2029
4 February 2026 - Candidate List expanded to 253 entries. SCIP notifications for the two new substances were due by 4 August 2026.
6 August 2026 - Annex XVII entry 77, introduced by Regulation (EU) 2023/1464, applies: formaldehyde released from articles is limited to 0.062 mg/m³. That is roughly half the E1 limit of 0.124 mg/m³ from EN 13986, and it is measured on the finished article in a chamber test to EN 16516, not on the board. An E1 certificate for the panel is therefore no longer proof for the product. Vehicle interiors follow at 0.080 mg/m³ from 6 August 2027. This is the single most underestimated REACH date for furniture, interiors and wood-based products - see Digital Product Passport for furniture.
16 July 2026 - ECHA circulated a consultation letter on the draft list of candidate substances of concern under the PPWR: 731 substances across plastics, paper, metal, glass and ceramics, including PFAS, phthalates and bisphenol A. Feedback closed on 24 August 2026, and ECHA is to deliver its final report to the Commission by 21 September 2026, feeding the recyclability work under PPWR Article 6. Important caveat: appearing on a research list creates no restriction, no testing requirement and no remediation deadline by itself.
PFAS universal restriction - the Risk Assessment Committee adopted its opinion on 3 March 2026 and ECHA published the Socio-Economic Assessment Committee’s draft opinion on 26 March 2026; both recommend cutting back many of the derogations in the original proposal. Consultation closed 25 May 2026, SEAC’s final opinion is due by the end of 2026, after which the file goes to the Commission. Realistically: no Commission decision before the third quarter of 2027 and no application before 2029. Long enough to plan a substitution, short enough that starting after the final opinion is late.
Per product group - each ESPR delegated act sets the substance information its passport must carry. The dates follow the 2025-2030 working plan, product group by product group.
Five steps to prepare
1. Build the inventory at component level
Not “which substances are in our portfolio” but bill of materials × material × substance, with CAS numbers. Anything coarser cannot answer the location field in the passport, and cannot answer a consumer request under Article 33(2) either.
2. Fix what you ask suppliers for
A signed statement that a component is “REACH compliant” carries no information: it does not say which lists were checked, on what date, at what threshold, or whether the check covered the article or the substances that went into it. Ask for substance identity, concentration range and the version date of the list checked against. Put it in the purchasing terms, not in an email.
3. Screen against all four lists, and re-screen on every update
Candidate List, Annex XIV, Annex XVII, POPs. The Candidate List typically moves once or twice a year; Annex XVII moves whenever an amending regulation is published, and after April 2026 that is the main channel through which REACH will change at all.
4. Decide the data model before the delegated act arrives
Concentration ranges or point values, model or batch granularity, how you express “component X of assembly Y”. Retrofitting granularity into a populated product database is the expensive version of this decision.
5. Make it a standing task with an owner
Candidate List updates, the six-month SCIP clock, Annex XVII amendments, supplier re-declarations. This is recurring maintenance, not a project with an end date. The DPP implementation checklist covers where it fits in the wider rollout.
Frequently asked questions (FAQ)
Does a supplier’s “REACH compliant” declaration protect me?
No. It is not a defined legal status, and it does not transfer your obligations. You remain the supplier of the article towards your own customers under Article 33, and you remain liable for Annex XVII limits in the finished product. Ask what was checked, against which list version, and at what level of the assembly.
Do we have to register under REACH if we manufacture finished products?
Normally no. Registration applies to manufacturers and importers of substances at one tonne per year or more. Producers of articles are caught by Article 7(2) notification, Article 33 communication and the restrictions - not by registration. Importing articles from outside the EU changes the calculation, because duties that sat with an EU supplier now sit with you.
Is the ESPR substance of concern list the same as the Candidate List?
No, and this is the most consequential misreading in this area. The Candidate List is only limb (a) of Article 2(27). Limbs (b), (c) and (d) add CLP hazard classes, POPs, and substances that impair reuse or recycling. A product can be entirely free of Candidate List substances and still have substances of concern to declare.
Does the abandoned revision mean fewer obligations?
No. It means the same obligations, changing through a larger number of smaller annex amendments rather than one reform. For anyone maintaining substance data, that is a harder pattern to track, not an easier one.
Can myDPP tell us whether a substance is a substance of concern?
No - and no software should claim to. Classification is a legal and toxicological assessment that belongs with your regulatory function or an external chemicals specialist. What a passport platform does is hold the resulting records in a structured, versioned form, keep them tied to the right product, batch or item, and publish exactly the subset each audience is entitled to see. The determination is yours; the traceability is ours.
Read more
- Digital Product Passport in 15 Minutes: What DPP Is and Why the EU Introduces It
- SCIP Database: Reporting SVHC Substances and the Link to the DPP
- RoHS Directive - Restricted Substances in Electronics and the DPP
- PPWR Article 5 - PFAS Limits and Heavy Metals in Packaging
- ESPR Regulation: Ecodesign Requirements for Sustainable Products
- How to Implement the DPP: The Checklist
Sources
- Regulation (EC) No 1907/2006 (REACH, consolidated text)
- Regulation (EU) 2024/1781 (ESPR)
- ECHA: Candidate List of substances of very high concern
- ECHA: Substances restricted under REACH (Annex XVII)
- ECHA: PFAS restriction - committees’ opinions and next steps
- Regulation (EU) 2023/1464 (formaldehyde, Annex XVII entry 77)
- Regulation (EU) 2019/1021 on persistent organic pollutants
- European Parliament: legislative train - revision of the REACH Regulation