Why REACH Annex XVII Is Creating New Material Compliance Risks

REACH is making a number of key changes to its substance restrictions. Learn how they could affect your business, and what compliance options are available to you.

Michael Mariani

6 min read
Why REACH Annex XVII Is Creating New Material Compliance Risks

Article Highlights:

  • The EU had been planning a major regulatory overhaul that was widely known as REACH 2.0, but the plan was cancelled in April. Instead, the EU is moving forward with a raft of smaller, more targeted changes, some of which are entering into force in 2026.
  • A number of significant changes are being made to REACH Annex XVII in 2026, including new formaldehyde limits, changes to CMR substances, and phased restrictions of PFHxA.
  • Companies that want to adhere to REACH and ensure that their business is not derailed by regulatory violations need to prepare well ahead of actual implementation dates.

For manufacturers, importers, and other businesses operating in the European Union, REACH is a critical chemical regulation. The directive—which stands for the Registration, Evaluation, Authorisation, and Restriction of Chemicals—limits the use of specific chemical substances deemed to be a threat to human health and/or the environment. REACH is a fairly complex regulation, and it requires in-scope businesses to register their chemicals, maintains the Candidate List of Substances of Very High Concern, and restricts the use of specific substances through the Authorisation List.

If there's one thing that businesses covered by REACH have come to expect, it's that the regulation is constantly evolving. REACH updates the Candidate List of Substances of Very High Concern twice a year, adding a handful of chemicals annually. And while the EU had been planning a major regulatory overhaul that was widely known as REACH 2.0, that plan was cancelled in April. Instead, the EU and the European Chemicals Agency (ECHA) have opted to move forward with a raft of smaller, more targeted changes. Some of those changes are entering into force in 2026, making the year a consequential one for companies striving to maintain compliance with one of the world's foremost chemical regulations.

What Is REACH Annex XVII?

REACH maintains several chemical lists, including the Substances of Very High Concern Candidate List and Annex XVII. Annex XVII serves as a complete list of all the substances that REACH restricts or outrights bans. While both lists cover substances regulated by ECHA, Annex XVII exclusively focuses on chemicals that are strictly prohibited, limited to specific concentration thresholds, or managed through migration limits.

Some of the 79 substances covered by Annex XVII include the following (and their variations):

  • Lead
  • Cadmium
  • Mercury
  • Nickel
  • Benzene
  • Asbestos
  • Acrylamide

Major Changes to Annex XVII in 2026

While the EU and the European Commission have nixed the large-scale regulatory overhaul that would have ushered in "REACH 2.0," they're still implementing a number of significant changes to the chemical directive in 2026.

Changes to CMR Substances

One of the key categories of substances REACH regulates is chemicals deemed to be carcinogenic, mutagenic, or toxic for reproduction (CMR). Substances in this category include cadmium bromide tetrahydrate, fluoroethylene, nickel dibromide, and many others. In January, the European Commission drafted a proposal to expand Annex XVII by adding an additional 22 substances to its list of CMR chemicals. These 22 substances now classified as CMR have strict concentration thresholds ranging from 1,000 to 3,000 parts per million.

These additions, which are known as the CMR Annex, are currently working their way through the intricate EU approval process. Full compliance obligations are expected to be adopted and implemented during the second half of 2026.

Formaldehyde Restrictions

ECHA is officially adding formaldehyde and all formaldehyde-releasing substances to Annex XVII. The chemicals agency has set concentration limits for formaldehyde of .062 milligrams per cubic meter for furniture and other wood-based goods, and a slightly higher threshold of .080 milligrams per cubic meter for all other articles. This is a significant compliance development because of just how widespread the use of formaldehyde continues to be. The chemical is found in everything from cosmetics to apparel to wood varnishes and lacquers. Most importantly, arguably, it's also used in the manufacturing of building materials like fiberglass and foam insulation.

A New Era of PFAS Compliance

ECHA and the European Commission have had their eyes on PFAS for some time now, and have been intent on adding additional members of this large chemical family to Annex XVII. This year, they've added PFHxA, a chemical used in firefighting foams, fabrics and textiles, and various industrial manufacturing materials. PFHxA has a very long half-life, and is extremely persistent in the environment—making it a sensible candidate for inclusion on REACH Annex XVII.

The EU has actually planned to impose restrictions on PFHxA use since 2024, having originally adopted this legislation in the fall of that year. The staggered compliance timeline for specific industries is now entering into force.

  • April 2026: In April, PFHxA restrictions entered into force for manufacturers that use the substance in firefighting foams during training, testing, and public fire remediation.
  • October 2026: This is a key implementation date for PFHxA restrictions. On October 10, restrictions will become effective for leather and other textiles used in apparel, footwear, paper and cardboard used in food packaging, and cosmetic products.
  • October 2027: PFHxA restrictions enter into force for textiles and leather used outside of clothing, including upholstery.

What This Means for Covered Businesses

Organizations that operate in the EU shouldn't wait for substance restrictions to enter into force before they start carrying out compliance measures. Companies that want to adhere to REACH and ensure that their business isn't derailed by regulatory violations need to prepare well ahead of actual implementation dates. Effective compliance management includes:

Identifying Substances in Products

In order to understand whether they need to make changes to their manufacturing processes or product formulations, businesses first need to determine if any of their products contain the newly restricted substances. Companies can do this by obtaining full material declarations (FMDs), reaching out to suppliers for substance information, and—when necessary—carrying out materials testing.

The due diligence process can be long and complex, and compliance professionals need to give themselves ample time to gather all the necessary compliance intelligence from suppliers. Once teams collect all this information, they can establish their organization's full regulatory responsibilities.

Understand All Exemptions and Derogations

Before making any dramatic changes to achieve compliance, companies should analyze all the REACH Annex XVII derogations carefully. ECHA carves out both specific substances and use cases. In particular, the agency exempts uses in highly regulated situations where risk management is already in place and where the substances in question are already in the scope of other regulations.

Manage Regulatory Changes With Compliance Software

Manufacturers that use PFHxA or formaldehyde and sell their products in the EU need to be carrying out a comprehensive compliance analysis in 2026. Their responsibilities include determining how they use those substances and in what quantities; what changes need to be made to maintain regulatory adherence; and, finally, what their compliance options are. But many businesses with large manufacturing footprints don't have the internal resources, bandwidth, or expertise to keep up with REACH's changes or the other regulatory developments happening around them.

For organizations looking for comprehensive compliance support for REACH Annex XVII and other obligations, compliance tool Z2 provides the expertise and software capabilities to streamline their adherence process.

Z2 covers over 180 key global regulations, including the REACH, RoHS, POPs, the EUDR, and PFAS regulations. The software leverages a four-step process to achieve comprehensive compliance: data scoping and framework; supply chain due diligence; compliance risk analysis; and reports and declarations.

By partnering with Z2, businesses are able to:

  • Understand their full regulatory data requirements
  • Rely on a team of experts to carry out supply chain due diligence
  • Participate in a full risk analysis that addresses all their compliance gaps
  • Receive reports and declarations for their regulatory obligations

To learn more about Z2Data's compliance services, schedule a free trial with one of our product experts.