REACH Regulation: Employer Obligations & Compliance Guide (2026)

TL;DR

• If you use chemicals in your workplace — even common cleaning agents, adhesives, or lubricants — you are almost certainly a “downstream user” under REACH, with legal obligations that go beyond simply reading a safety data sheet.
• If your supplier provides an extended SDS with exposure scenarios — you must verify that your actual use conditions match those scenarios, or take corrective action within 12 months.
• If a substance on ECHA’s Candidate List appears in your products above 0.1% w/w — you have communication duties to customers, consumers, and ECHA’s SCIP database.
• If you operate across both the EU and UK markets — you may now face dual compliance obligations under two diverging REACH regimes, and your supply chain role may have changed since Brexit.

REACH (Registration, Evaluation, Authorisation and Restriction of Chemicals) is the EU’s primary chemicals safety regulation (EC 1907/2006). It requires employers who use chemical substances in the workplace — known as downstream users — to follow safety data sheet instructions, verify that their use falls within registered exposure scenarios, implement recommended risk management measures, inform workers about chemical hazards, and retain all REACH-related records for at least 10 years.

What Is the REACH Regulation and Why Does It Matter to Employers?

A regulation that placed 23,000+ chemical substances under a single registration and evaluation framework was bound to reshape how industry handles chemicals. REACH — Registration, Evaluation, Authorisation and Restriction of Chemicals, formally EC 1907/2006 — entered force in June 2007 and remains the most comprehensive chemicals legislation anywhere in the world. Its central premise is a reversal of the traditional burden of proof: industry must demonstrate that a substance can be used safely before placing it on the market, rather than regulators proving harm after the fact.

The European Chemicals Agency (ECHA) administers the regulation centrally from Helsinki, while enforcement falls to national competent authorities in each EU Member State. For a detailed overview of the regulation’s architecture, ECHA’s guide to understanding REACH remains the authoritative starting point.

Here is the part most employers miss: REACH is not only for chemical manufacturers and importers. The regulation’s obligations cascade down the supply chain to every company that uses a chemical substance in an industrial or professional activity. That category — “downstream user” in REACH terminology — captures an enormous range of employers: metalworking shops using cutting fluids, vehicle workshops handling degreasers, construction firms applying adhesives and sealants, electronics assemblers using fluxes, cleaning companies using solvents. If chemicals enter your workplace in any form, REACH has something to say about how you manage them.

A persistent misconception holds that REACH is “a chemical company problem” — a matter for the manufacturers and importers who register substances, not for the workshop or facility that simply purchases and uses them. This misunderstanding has led to enforcement findings across multiple EU Member States where downstream users had no awareness of their specific REACH obligations, despite having general workplace chemical safety systems in place.

Who Does REACH Apply To? Understanding Your Role in the Supply Chain

Whether REACH applies to your company depends entirely on your role in the chemical supply chain — and that role is defined by what you do with substances, not by how you describe your business. REACH assigns four primary roles, each carrying different obligations.

The following table summarises the core distinctions:

Role	Definition	Primary REACH Obligation
Manufacturer	Produces a chemical substance within the EU/EEA	Register substances exceeding 1 tonne/year with ECHA
Importer	Brings a substance or mixture into the EU/EEA from outside	Register substances exceeding 1 tonne/year with ECHA
Downstream user	Uses a substance in industrial or professional activities	Follow SDS guidance; verify exposure scenario coverage; report unsupported uses
Distributor	Stores and supplies substances without using them industrially	Pass on SDS information to recipients

Manufacturers and importers carry the heaviest burden: they must prepare and submit registration dossiers to ECHA for every substance they produce or bring into the EU/EEA in quantities exceeding one tonne per year. The registration dossier includes hazard data, exposure scenarios, and proposed risk management measures. Without a valid registration, a substance cannot legally be placed on the EU market — the “no data, no market” principle codified in Article 5.

Downstream users do not register substances, but their obligations are more extensive than many realise. They must ensure the safety data sheets they receive are current and accessible, verify that their specific use and conditions of use are covered by the supplier’s exposure scenarios, and — if their use is not covered — take corrective action. That corrective action ranges from asking the supplier to include the use, to applying stricter conditions, to preparing their own downstream user chemical safety report and notifying ECHA within 12 months.

The category that catches most companies off guard is exactly this one. A workshop using paints, adhesives, or cleaning solvents views itself as “just a customer.” Under REACH, it is a downstream user with specific legal duties. The difference between a customer and a downstream user is the difference between simply buying a product and being legally responsible for how that product is used in the workplace.

How Non-EU Companies Are Affected

Companies based outside the EU are not directly bound by REACH — the regulation applies to the EU/EEA market, not to foreign jurisdictions. However, any non-EU company wishing to export chemical substances or mixtures into the EU must ensure those substances are registered. The mechanism for this is the Only Representative (OR): a natural or legal person established in the EU who is appointed by a non-EU manufacturer to fulfil the importer’s registration obligations on their behalf.

When an Only Representative is appointed, EU-based importers of that substance are reclassified as downstream users, since the registration obligation has shifted to the OR. This reclassification has practical consequences — it changes which entity holds the registration, who maintains the safety data sheet, and who ECHA contacts during compliance checks. Non-EU exporters, particularly US-based chemical suppliers, increasingly use the OR mechanism to maintain EU market access without requiring each individual EU customer to register independently.

Core Employer Obligations Under REACH

This is where the regulation’s impact on daily operations becomes concrete. Regardless of company size or sector, employers who use chemicals in the workplace must meet a defined set of obligations. The following requirements represent the practical minimum for any downstream user.

1. Verify registration status. Employers should confirm that substances used in the workplace are registered under REACH — or fall under a recognised exemption. ECHA’s public database allows searching by substance name, CAS number, or EC number. Using an unregistered substance that should be registered is a compliance breach, even if the employer did not import it directly.
2. Maintain current safety data sheets. Under Article 31, suppliers must provide an SDS free of charge for hazardous substances and mixtures, in the official language of the receiving Member State. Employers must ensure SDSs are current and compliant with the format requirements of Commission Regulation (EU) 2020/878, which updated Annex II. SDSs must be accessible to all workers who use or may be exposed to the substance, and to their representatives.
3. Check exposure scenario coverage. When a supplier provides an extended SDS that includes exposure scenarios, the employer must verify that their actual use — including quantities, application methods, ventilation conditions, and duration — falls within the described conditions. This is the single most common downstream-user compliance failure: receiving an extended SDS, filing it, and never checking whether the use conditions described actually match what happens on the shop floor.
4. Act on unsupported uses. If the employer’s use is not covered by the supplier’s exposure scenario, REACH provides three options: request the supplier to include the use in their next registration update; apply conditions of use that are stricter than those described, ensuring adequate control; or prepare a downstream user chemical safety report (DU CSR) and notify ECHA within 12 months. Ignoring the gap is not an option.
5. Implement risk management measures. The SDS and its exposure scenarios recommend specific controls — ventilation rates, PPE requirements, storage conditions, handling procedures, waste management. The employer must translate these into operational workplace controls. A recommendation on paper that is not reflected in actual work practice provides no protection.
6. Inform workers. Employees and their representatives have a right under REACH to information about substances they work with or may be exposed to, including hazard information and the risk management measures in place. This is separate from — and additional to — general workplace hazard communication under national OSH law.
7. Retain records for at least 10 years. Article 36 requires downstream users to keep all information they need to carry out their REACH duties for a minimum of 10 years after the substance was last used. This includes SDSs, exposure scenarios, chemical safety assessments, and any notifications sent to ECHA.

Audit Point: Enforcement inspectors testing downstream user compliance typically check three things in sequence: (1) is a current SDS available for each chemical in use? (2) has the employer checked exposure scenario coverage against actual use conditions? (3) are the SDS-recommended risk management measures actually implemented on site? Failure at step two is the most frequent finding.

How REACH and the Chemical Agents Directive Work Together

Employers handling chemicals in the EU face two overlapping legal frameworks: REACH governs the supply and availability of hazard data; the Chemical Agents Directive 98/24/EC (CAD) requires employers to use that data in workplace risk assessments. Understanding their interface is essential — they are complementary, not alternative.

REACH Article 2(4) states explicitly that the regulation applies “without prejudice” to existing EU workplace safety legislation. This means REACH does not replace the employer’s CAD obligations. It supplements them. REACH generates the hazard data — through registration dossiers, safety data sheets, exposure scenarios, and Derived No-Effect Levels (DNELs). CAD then requires the employer to take that data and integrate it into a site-specific risk assessment, considering the actual conditions under which workers are exposed.

The EU-OSHA guidance on the CAD/REACH workplace interface addresses an important tension: REACH exposure scenarios are modelled — they describe generic use conditions under which risk is considered controlled. Workplace risk assessments under CAD must account for actual site conditions: ventilation effectiveness, temperature, shift duration, multi-substance exposures, vulnerable workers. Where the REACH exposure scenario and the workplace risk assessment reach different conclusions about the adequacy of controls, the stricter requirement applies.

Watch For: REACH’s DNELs and national Occupational Exposure Limits (OELs) set under workplace legislation may specify different thresholds for the same substance. Where both exist, the more protective value should govern the workplace risk assessment. Assuming that REACH compliance alone satisfies workplace safety law is a common — and consequential — error.

Substances of Very High Concern (SVHCs) and the Candidate List

REACH identifies certain chemicals as Substances of Very High Concern — substances whose properties are so hazardous that their use requires special attention and, ultimately, may require explicit authorisation from the European Commission. SVHCs include carcinogenic, mutagenic, or reprotoxic (CMR) substances; persistent, bioaccumulative, and toxic (PBT) substances; very persistent and very bioaccumulative (vPvB) substances; and endocrine disruptors with equivalent levels of concern.

The pathway from identification to restriction follows a defined progression. First, a substance is placed on the Candidate List — a publicly available register of identified SVHCs maintained by ECHA. As of November 2025, the Candidate List contains 251 entries (ECHA, 2025), with nine new substances added during 2025 across three separate updates in January, June, and November. From the Candidate List, substances may be recommended for the Authorisation List (Annex XIV), after which companies must apply for — and receive — authorisation from the Commission before continuing to use them. Separately, substances may also be subject to restriction under Annex XVII, which can ban or limit specific uses entirely.

For employers, the Candidate List triggers immediate obligations. Under Article 33, any supplier of an article containing a Candidate List SVHC above 0.1% weight by weight must provide recipients with sufficient information for safe use. Consumers who inquire have the right to receive this information within 45 days. Producers and importers of articles must also notify ECHA via the SCIP (Substances of Concern In Products) database within six months of a substance’s inclusion on the Candidate List. The current SVHC Candidate List is searchable on ECHA’s website.

Field Test: Review your workplace chemical inventory against the current Candidate List at least after every biannual update. If you discover a Candidate List substance in articles you produce or supply, the clock for SCIP notification and customer communication starts from the date of inclusion — not from the date you became aware.

Treating Candidate List compliance as a one-off exercise is a structural error. The list expands regularly, and substances already in use may be added at any update. Companies need a systematic screening process — tied to their procurement and incoming-goods systems — that flags each new addition against their substance inventory and triggers the appropriate compliance actions.

What Happens If You Don’t Comply? Enforcement and Penalties

REACH enforcement is decentralised — each EU Member State designates its own national competent authority and sets its own penalties, which must be “effective, proportionate and dissuasive” under the regulation. This creates a patchwork of enforcement regimes, but the direction of travel across Europe is consistently toward stricter scrutiny and heavier consequences.

Penalties across Member States include administrative fines reaching up to €1 million in some jurisdictions, seizure of non-compliant products at borders, mandatory market withdrawal, and criminal prosecution. In the most severe cases — particularly involving deliberate falsification of registration data or continued use of restricted substances — imprisonment of up to eight years has been imposed. In the UK, the REACH Enforcement Regulations 2008 establish separate penalties: Magistrates’ Court proceedings can result in fines up to £5,000 and/or three months’ imprisonment, while Crown Court prosecution carries unlimited fines and/or up to two years’ imprisonment.

ECHA coordinates enforcement across Member States through its Forum for Exchange of Information on Enforcement, which runs the REACH-EN-FORCE (REF) series of harmonised enforcement projects. These projects target specific compliance areas in coordinated inspections across multiple countries simultaneously. The latest of these — REF-15, announced in June 2025 — will specifically target safe use of chemicals in workplaces, inspecting SDS implementation, authorisation conditions, and the use of restricted substances including diisocyanates, NMP, and DMF (ECHA, 2025). This represents a notable shift: previous REF projects focused primarily on registration compliance and supply chain communication, whereas REF-15 is directed squarely at the workplace level.

ECHA’s evaluation data underscores how seriously non-compliance is treated. In 2025, ECHA conducted 214 compliance checks covering approximately 1,200 registrations and 196 substances (ECHA, 2026). Cumulatively, 16,100 registration dossiers covering 2,380 substances — roughly 23.5% of all submitted dossiers — have been checked between 2009 and 2025 (ECHA, 2026). When registrants were asked for additional hazard data and failed to provide it, 30% of follow-up cases were referred to national authorities for enforcement action (ECHA, 2026).

The practical interpretation here is clear: ignorance of REACH is not a defence, and the regulation provides no “due diligence” exemption in the sense that good intentions without actual compliance offer protection. However, enforcement authorities do generally consider the documented efforts a company has made to comply when determining the severity of their response — the difference between a genuine compliance gap discovered in good faith and a systematic failure to engage with the regulation at all.

EU REACH vs UK REACH: What Changed After Brexit?

Since 1 January 2021, the United Kingdom has operated its own standalone chemicals regulation — UK REACH — implemented under the European Union (Withdrawal) Act 2018. The UK retained REACH’s structure almost entirely, but administration transferred from ECHA in Helsinki to the UK’s Health and Safety Executive (HSE). For employers operating in both markets, or with supply chains that cross the English Channel, this created a set of practical complications that remain partially unresolved.

The following comparison captures the key divergences:

The most consequential practical impact for employers lies in supply chain reclassification. Companies that previously purchased chemicals from Great Britain–based suppliers as downstream users under EU REACH may now be classified as importers under EU REACH — because GB is no longer part of the EU single market. This reclassification carries registration obligations that the company did not previously hold. Many smaller businesses, particularly those purchasing speciality chemicals in modest quantities from GB suppliers, have not yet recognised this change in their legal status.

UK REACH’s transitional registration deadlines have been extended multiple times. The REACH (Amendment) Regulations 2023 pushed the phased deadlines to October 2026, 2028, and 2030, reflecting the cost and complexity of re-registering substances with the UK’s own system. A second consultation on further deadline adjustments closed in September 2025, and employers in the UK should monitor HSE announcements for any further changes.

Northern Ireland occupies a unique position: it remains subject to EU REACH under the Windsor Framework, meaning businesses in Northern Ireland must comply with EU requirements and maintain access to ECHA’s systems, while the rest of the UK follows UK REACH. For companies operating across both jurisdictions within the UK, this creates a dual compliance requirement that demands careful supply chain mapping.

Jurisdiction Note: The SVHC Candidate Lists under EU REACH and UK REACH are currently substantially aligned, but they are maintained independently and have already begun to show minor divergences. Companies operating in both markets should track both lists separately rather than assuming automatic alignment.

How to Build a REACH Compliance System in Your Workplace

The most resilient REACH compliance systems treat the regulation as a continuous process woven into procurement, incoming goods inspection, and workplace risk assessment — not as a standalone project managed in isolation by one compliance officer. The following steps provide a practical roadmap, particularly for downstream users building a system from scratch.

1. Conduct a comprehensive chemical inventory. Identify every chemical substance and mixture used anywhere in the workplace. This means going beyond the obvious — production chemicals, reagents, solvents — to include cleaning agents, adhesives, lubricants, coatings, maintenance sprays, and any other products containing chemical substances. Record substance names, CAS numbers, suppliers, quantities, and intended uses.
2. Verify registration status. Cross-reference your inventory against ECHA’s public database. Confirm that each substance is registered and that your intended use is covered. If a substance appears unregistered and does not fall under a recognised exemption, raise this with your supplier immediately — continued use of an unregistered substance exposes you to enforcement action.
3. Review and operationalise safety data sheets. Ensure you hold a current SDS for every chemical substance and mixture, compliant with Regulation (EU) 2020/878. “Current” means reflecting the latest available hazard and risk management information — SDSs are living documents that suppliers must update. For extended SDSs containing exposure scenarios, conduct a systematic comparison between the described conditions of use and your actual operations.
4. Implement the specified risk management measures. Translate SDS and exposure scenario recommendations into physical workplace controls. Ventilation rates, PPE specifications, storage separation requirements, handling procedures, and waste management instructions all need to be operational — not just documented.
5. Establish Candidate List monitoring. Build a process to screen ECHA’s biannual Candidate List updates — and any ad-hoc additions — against your substance inventory. When a new SVHC appears in your inventory, trigger the Article 33 communication duties and SCIP notification within the required timeframes.
6. Train workers. Workers and their representatives have a right to information about the chemicals they handle. Training should cover the specific hazards of substances in their work area, the controls in place, the meaning of SDS pictograms and hazard statements, and the procedures for reporting problems.
7. Document and retain records. Maintain REACH-related documentation — SDSs, exposure scenario assessments, chemical safety reports, ECHA notifications, training records — for the mandatory minimum of 10 years after the last use of each substance. Auditors will ask for these records; their absence is a compliance finding in itself.

Pro Tip: Integrate REACH compliance checks into your procurement process. Before a new chemical enters the workplace, verify its registration status, obtain its SDS, check exposure scenario coverage against your intended use, and screen it against the current Candidate List. Catching gaps at procurement is orders of magnitude easier than discovering them during an enforcement inspection.

What Is Changing? REACH Developments Employers Should Watch

The regulatory landscape around REACH is moving faster than at any point since the regulation’s original implementation. Several developments in 2025–2026 directly affect employer obligations, and treating current compliance as static would be a mistake.

The most significant forthcoming change is the REACH Recast — a targeted revision under the EU Chemicals Strategy for Sustainability, which the European Commission is expected to publish in late 2025 or 2026. The recast may alter registration requirements, introduce new restriction processes, expand the scope of substances requiring authorisation, and strengthen enforcement mechanisms. While the final text is not yet available, employers should be preparing for a regulatory environment that demands more data, stricter controls, and faster compliance timelines.

On restrictions, Commission Regulation (EU) 2025/1988 has already added an Annex XVII entry restricting PFAS (per- and polyfluoroalkyl substances) in firefighting foams. A broader PFAS restriction proposal — potentially one of the largest single restrictions in REACH history — is under ECHA consultation, with a second public consultation expected in 2026. Employers using PFAS-containing products in any application should be mapping their exposure now.

New CLP (Classification, Labelling and Packaging) labelling rules taking effect from July 2026 will require updated hazard communication on product labels, which will flow through into updated SDSs that employers must manage.

The REF-15 enforcement project announced in June 2025 marks a deliberate pivot toward workplace-level enforcement. Previous REF projects focused upstream — on registration completeness, supply chain SDS transmission, and import compliance. REF-15 targets how employers actually implement REACH at the point of use: are SDS risk management measures operational? Are authorisation conditions being followed? Are restricted substances being used within their conditions of restriction? Employers whose compliance exists primarily on paper should expect this distinction to matter.

The pace of SVHC identification is also accelerating. Nine substances were added to the Candidate List during 2025 alone, across three separate updates. Annex XVII restrictions are expanding into sectors — textiles, electronics, firefighting — that previously had limited direct REACH exposure. The direction is clear: more substances under tighter control, with enforcement attention shifting from upstream registration to downstream implementation.

Frequently Asked Questions

Conclusion

The regulatory momentum behind REACH is accelerating, not plateauing. Nine new SVHCs added to the Candidate List in a single year, a forthcoming REACH Recast that may fundamentally alter registration and restriction processes, PFAS restrictions expanding into sectors that previously had minimal REACH exposure, and REF-15 pivoting enforcement attention directly to workplace implementation — these are not distant signals. They are operational realities that downstream users need to prepare for now.

For most employers, the critical shift is recognising that REACH compliance is not a supply chain problem that someone upstream has already solved. The registration belongs to the manufacturer or importer. The obligation to verify, implement, monitor, and document belongs to the downstream user. The gap between receiving a safety data sheet and actually operationalising its exposure scenarios against your real working conditions is where most compliance failures occur — and it is precisely where REF-15 inspectors will be looking.

Employers who build REACH into their procurement decisions, their incoming goods checks, their workplace risk assessments, and their ongoing Candidate List monitoring will find compliance manageable and auditable. Those who treat it as a one-time filing exercise, or worse, as someone else’s problem, will find the regulation has a way of becoming very personal — one enforcement inspection at a time.