How the REACH Restriction Process Works: SVHC, Candidate List, and PFAS

REACH is the backbone of EU chemicals regulation, and also one of the hardest regimes to track, because the lists move constantly and a single substance can sit at several different stages at once. This guide explains how the REACH restriction and authorisation process actually works, from SVHC identification to the Candidate List, Annex XIV, and Annex XVII, and uses PFAS as the case study everyone is watching.

The substance examples and statuses here are drawn from Obsidian's verified regulatory dataset, the same tier-0 data our MCP server serves to AI assistants.

What REACH is

REACH is Regulation (EC) No 1907/2006, governing the Registration, Evaluation, Authorisation and Restriction of Chemicals placed on the EU market. It is administered by the European Chemicals Agency (ECHA) together with the European Commission and Member State authorities. Its companion, the CLP Regulation, handles classification, labelling, and packaging of hazardous substances.

The core idea is "no data, no market": companies must register substances and demonstrate they can be used safely, and the most hazardous substances are progressively identified, restricted, or made subject to authorisation.

The restriction and authorisation pipeline

A substance of concern typically moves through stages. Understanding these stages is the key to knowing what an obligation actually is at any moment.

• SVHC identification. A substance is proposed as a Substance of Very High Concern (for example, carcinogenic, mutagenic, toxic to reproduction, persistent, or an endocrine disruptor).
• Candidate List. Confirmed SVHCs are added to the Candidate List, which triggers immediate communication and notification duties along the supply chain, even before any ban.
• Annex XIV (Authorisation). Priority SVHCs move to the Authorisation List, after which they cannot be used past a "sunset date" without a specific authorisation.
• Annex XVII (Restriction). Separately, substances can be restricted outright, with conditions or bans on specific uses, the route the broad PFAS measure is following.

The same substance can be a registered chemical, a Candidate List SVHC, and the subject of a pending restriction at the same time. Status, not identity, is the answer to "what must I do."

PFAS: the case study

PFAS (per- and polyfluoroalkyl substances) are a large family of persistent "forever chemicals." In 2023, five national authorities (Germany, Denmark, the Netherlands, Norway, and Sweden) submitted a proposal to ECHA for a broad universal PFAS restriction under Annex XVII, one of the widest restriction dossiers ever filed. It is being assessed by ECHA's scientific committees, the Committee for Risk Assessment (RAC) and the Committee for Socio-economic Analysis (SEAC), a multi-year process given the thousands of substances and uses involved.

For a compliance team, the difficulty is that "the PFAS restriction" is not one event. It is a proposal under committee review, alongside narrower measures already in force on specific PFAS, plus parallel activity on Candidate List additions. Knowing which is which, and on what date each stands, is the whole job.

Why a verified dataset matters here

Obsidian tracks 452 regulated substances with their CAS and EC numbers, hazard classes, and per-jurisdiction regulatory status (EU and beyond). That structure is the point: a question like "is this substance on the Candidate List, and is it restricted in the EU and the US" has a precise, sourced answer, not a guess.

This is exactly where a general AI model fails. Asked about a substance, it will produce a confident, plausible status that may be months out of date or simply wrong, with no way to tell a proposal from a ban. Grounding the model in a verified substances dataset turns that guess into a citable answer, the difference we cover in what tier-0 regulatory data means.

What to track in practice

For chemicals teams, the live signals that matter are: new Candidate List entries (twice-yearly updates), Annex XIV authorisation decisions and sunset dates, Annex XVII restriction proposals and their committee progress, and CLP classification changes. Each is a different stage with a different obligation and a different clock.

The takeaway

REACH is not a static rulebook, it is a set of moving lists, and PFAS is the clearest example of why stage and date matter more than the substance name. Tracking it reliably means working from data that knows a substance's exact status, in each jurisdiction, as of today. For the bigger picture of letting your AI do that tracking, see agentic regulatory intelligence.