REACH Candidate List Updates: Why Supplier Declarations Become Outdated Overnight

The compliance file that ages in the dark

A supplier declaration is a snapshot. It captures what was true on the day it was signed against the Candidate List that existed on that day. The problem is that compliance teams treat it as a permanent record. It sits in a folder, attached to a part number, marked "compliant," and nobody looks at it again until something breaks.

Then ECHA updates the Candidate List. Two new substances are added. The declaration in your folder still says "no SVHC present" — and technically, against the list it was assessed under, that statement is still true. But against today's list, it's silent on substances you're now legally obligated to track, communicate, and potentially notify.

This is how compliance teams discover, mid-audit, that a third of their supplier declarations have quietly gone stale.

The February 4, 2026 update brought the list to 253 SVHC entries with the addition of n-Hexane and Bisphenol AF (BPAF). For any article placed on the EU market containing either substance above 0.1% w/w, an Article 7(2) notification is due to ECHA by August 4, 2026. Every supplier declaration issued before February 4 is now, by default, incomplete on these substances. The next update is already in the Member State Committee pipeline.

This article unpacks why the Candidate List creates this recurring blind spot, what each update actually triggers in your obligations, and how to architect a process that doesn't require panic re-canvassing every six months.

How the Candidate List update cycle actually works

ECHA updates the Candidate List on a roughly twice-yearly cadence typically January/February and June/July. Each update is small in volume (usually 1–7 substances of Very High Concern, or SVHCs) but large in operational impact. Three things happen the moment a substance is added:

1. Article 33 communication obligations apply immediately. Suppliers of articles containing the new SVHC above 0.1% w/w must inform recipients down the chain. Consumers can request the same information and must receive it within 45 days.
2. SCIP notification obligations apply immediately. Any article containing the SVHC above the 0.1% threshold must be notified to ECHA's SCIP database — there is no grace period.
3. Article 7(2) notification clock starts. Producers and importers placing more than one tonne per year of articles containing the SVHC above 0.1% w/w must notify ECHA within six months of the inclusion date.

The substance doesn't have to be banned and most never reach the Authorisation List (Annex XIV). Inclusion on the Candidate List does not restrict use; it triggers information and notification obligations only. The Candidate List is purely about transparency and information flow. But the obligations it triggers are immediate and enforceable.

Why supplier declarations go stale faster than teams realize

1. Declarations are pinned to the wrong reference

Most supplier declarations state compliance "with the REACH SVHC Candidate List" without naming the version. A declaration signed in November 2025 was assessed against a 251-entry list. After February 2026, it's silent on two new substances — but nothing in the document itself flags this. The declaration looks valid until someone manually cross-checks the dates.

2. The "no SVHC present" answer is structurally fragile

A supplier who declares blanket compliance without disclosing the substances actually present in the article gives compliance teams nothing to re-evaluate. When the Candidate List expands, the only option is to re-issue the request and wait for a fresh response. With supplier response rates routinely below 60%, that means each Candidate List update creates a backlog that never fully clears before the next update arrives.

3. Group entries multiply the scope of every update

Several Candidate List entries cover groups of substances rather than single CAS numbers. The BPAF entry added in February 2026 covers nine related substances. A supplier declaration that lists CAS numbers individually may not flag any of them as SVHCs because none match the headline substance — even though they fall within the group entry. This is one of the most common false-negative patterns in REACH validation.

4. The supply chain doesn't update at the same speed

A Tier-1 supplier may update their declaration within weeks of a Candidate List change. A Tier-3 chemical supplier feeding into that Tier-1's process may take months or never get the request at all. By the time the data flows up, the next Candidate List update has already arrived. Most compliance teams are perpetually working against a list that's one cycle behind reality.

5.  Customer systems flag it before regulators do

Large OEMs and retailers now run automated SVHC validation against supplier-submitted declarations. When a Candidate List update arrives, their systems re-screen the entire supplier base against the new entries — and flag non-responsive declarations immediately. Your outdated declaration can trigger a customer hold, a failed supplier portal submission, or a disqualification from a sourcing programme before any regulator gets involved. The commercial consequence often arrives faster than the compliance one.

What the February 2026 update specifically requires

For the two substances added on February 4, 2026:

n-Hexane (CAS 110-54-3) A widely used industrial solvent — formulations, polymer processing, coatings, adhesives, cleaning agents. Added under Article 57(f) for specific target organ toxicity from repeated exposure. Notable as the first substance added based on equivalent level of concern for neurotoxicity rather than CMR, PBT, or vPvB criteria.

Bisphenol AF (BPAF) and its salts A group entry covering nine related substances. Used in process regulators, cross-linking additives, and fluoropolymer manufacturing. Added under Article 57(c) for reproductive toxicity.

Immediate obligations triggered:

●      Article 33 communication to downstream recipients (immediate)

●      SCIP notification for affected articles (immediate)

●      Article 7(2) notification to ECHA by August 4, 2026 (where >0.1% w/w and >1 tonne/year)

●      Safety Data Sheet updates for substances and mixtures (immediate)

If your last supplier outreach predates February 4, 2026, your data is silent on both substances. The audit-defensible question is not "do my suppliers comply with REACH?" — it's "have my suppliers been re-assessed against the 253-entry list?"

Building a process that doesn't break every six months

The teams that handle Candidate List updates without crisis don't have better suppliers they have a different architecture. Five practices separate them from the rest:

1. Collect substance-level data, not compliance attestations. A Full Material Declaration (FMD) lists every substance in the article with CAS numbers and concentrations. When the Candidate List expands, you can re-evaluate existing data instantly — no supplier outreach required for substances already disclosed.

2. Pin every declaration to the Candidate List version it was assessed against. Store the list version (e.g., "240 entries, July 2024") alongside the declaration. The system can then flag, the moment ECHA updates, exactly which declarations are now stale and against which substances.

3. Differentiate "stale" from "non-compliant." A stale declaration is silent on new substances; it isn't proof of non-compliance. The first response should be a targeted re-evaluation against the new substances only — not a blanket re-canvassing that exhausts both your team and your suppliers.

4. Treat group entries as expanded CAS lists. Maintain a mapping from each group entry on the Candidate List to the full set of CAS numbers it covers. Validate supplier-disclosed CAS numbers against this expanded list, not just the headline substance name.

5. Start the Article 7(2) clock on day one. The six-month notification window is short. Set the deadline against the inclusion date the moment the update is announced, identify candidate articles based on existing FMD data, and begin tonnage assessment immediately rather than after supplier responses return.

A self-check for your current process

If a Candidate List update landed tomorrow, could you answer these four questions within 48 hours?

●      Coverage: Which of my supplier declarations have substance-level data against the new SVHCs, and which are silent?

●      Exposure: Which of my parts and articles contain the new substances above 0.1% w/w based on existing FMD data?

●      Tonnage: For exposed articles, do I exceed the one-tonne-per-year threshold that triggers Article 7(2) notification?

●      Deadline: What's my Article 7(2) notification deadline, and what's the gap between today and that date?

If any of those questions requires weeks of supplier outreach to answer, the process is reactive rather than current.

Where Regilient fits in

Candidate List updates aren't a surprise, ECHA signals them months in advance through the Member State Committee. What catches compliance teams off-guard is the operational scramble each update creates. Regilient's agentic sustainability platform handles the parts of the cycle that don't scale manually:

●      Automated regulatory monitoring that flags Candidate List changes and identifies affected suppliers and articles the moment ECHA publishes

●      Substance-level FMD validation against the current Candidate List, including expanded group entries

●      Version-pinned audit trails that record which Candidate List version each declaration was assessed against

●      Targeted supplier re-canvassing focused only on suppliers and substances where existing data is genuinely silent

●      Article 7(2) and SCIP workflow automation that tracks deadlines and pre-fills notifications from existing product data

The Candidate List moved to 253 entries in February. The next update is already in the Member State Committee pipeline. Compliance teams that treat each update as a fire drill will spend the next decade catching up. The teams that treat it as a continuous process will spend that time building competitive advantage.

Book a Regilient demo to see how agentic regulatory monitoring keeps your supplier data current against every Candidate List update without re-canvassing your entire base every six months.

Regilient provides agentic sustainability software for product compliance, supplier engagement, and regulatory intelligence across REACH, RoHS, PFAS, CMRT, SCIP, and global chemical regulations.