/
Traces of prohibited substances are a question a safety assessor has to be able to answer in writing. Picture a brand that has sold a cream for months, made abroad by a contract manufacturer with an ethoxylated surfactant from a supplier it trusts. During the review of the safety report someone asks about dioxane. Nobody put it in the formula, but it is on Annex II of Regulation (EC) No 1223/2009, the list of substances banned in cosmetics, and ethoxylated ingredients can carry it as a process impurity. So what now?
What Article 17 says about traces of prohibited substances
Article 17 of the Cosmetics Regulation allows the non-intended presence of a small quantity of a prohibited substance in one case: it comes from impurities in natural or synthetic ingredients, from the manufacturing process, from storage or from migration out of the packaging, and it is technically unavoidable under good manufacturing practice. The Article then adds a last condition. That presence must comply with Article 3, which means the product still has to be safe under normal or reasonably foreseeable conditions of use. These are three requirements that add up, and if one of them fails, the exception does not apply.
What the Article does not define
Article 17 sets no numerical limit for what counts as a small quantity, and it does not list the documents that show a trace is unavoidable. What does spell out the obligation is Annex I, Part A, point 4, headed impurities, traces and information about the packaging material. The safety report must state the purity of the substances and mixtures and, for traces of prohibited substances, give evidence of their technical unavoidability. It must also describe the relevant characteristics of the packaging material, in particular its purity and stability. The duty to prove is written down. The method is not, at least in the Regulation itself.
The Commission did adopt guidelines on Annex I, Implementing Decision 2013/674/EU, which are listed on its cosmetics legislation page and are the next document to read. This article does not go beyond the text of the Regulation.
When the legislator does set a number: DHHB
Sometimes the number is written into the law. Commission Regulation (EU) 2026/909 of 27 April 2026 gives a recent example with the UV filter DHHB. The new wording of entry 28 in Annex VI says that di-n-hexyl phthalate (DnHexP), which is on the Annex II list, must not exceed 10 ppm as an unavoidable trace impurity in DHHB. The recitals explain how that figure was reached. The SCCS, the Commission’s scientific committee on consumer safety, considered a trace level of 260 ppm safe and noted that it could be brought down to 1 ppm. The Commission and the Member States then agreed on 10 ppm, taking into account the economic impact on sunscreen manufacturers. From 1 January 2027, products containing DHHB that do not meet the condition can no longer be placed on the EU market, and from 1 July 2028 they can no longer be made available on it. If DHHB is in your sunscreen, you will need to be able to show, for instance with the certificate of analysis of your raw material, that it complies.
What we check when we review a safety report
When we review a safety report we look for the purity and the certificate of analysis of every raw material, we compare the impurities the supplier declares with Annex II, and, where traces of prohibited substances exist, we look for the proof of inevitability that Annex I requires. If it is missing, we say so in the report itself, as documentation the Responsible Person has to add to the file. The strongest proof is also the most demanding one: an explanation of why that trace cannot be reduced further with what is available, whether from another supplier, in another purity grade or through another process. On good manufacturing practice, Article 8 presumes conformity when manufacture follows the relevant harmonised standards published in the Official Journal, and ISO 22716 is the good-practice reference the sector uses.
Where the trace goes in the report, and why exposure matters
The Responsible Person must make sure the product has been through a safety assessment and that a report is drawn up under Annex I (Article 10.1), and must keep the product information file available for the competent authority (Article 11.3). Part B of the report is carried out by a person holding a degree in pharmacy, toxicology, medicine or a similar discipline, as Article 10.2 requires. The trace has to show up in two places: in Part A, with its proof of inevitability, and in the reasoning of Part B, because Article 17 only protects the product if it is still safe with that trace inside.
That is where exposure weighs in. Article 10.1(a) requires the intended use and the anticipated systemic exposure to the ingredients of the final formulation to be taken into account. The same trace does not weigh the same in a rinse-off gel as in a leave-on cream, in a product for children under three or in one for external intimate hygiene, for which Annex I, Part B, requires a specific assessment.
Three mistakes, and what to do if you cannot prove it
The first mistake is invoking Article 17 for a substance that was added on purpose. The exception covers what is incidental, not what is intended. The second is stating that the product is free of prohibited substances with no data behind the claim. The third is treating the proof as permanent. The Regulation requires the safety report to be kept up to date (Article 10.1(c)) and the same goes for the product information file (Article 11.2), and a change of supplier or of packaging is exactly the moment to look at the trace again.
If you cannot prove that a trace is unavoidable, Article 17 does not cover it and Article 14.1(a) applies: without prejudice to Article 3, cosmetic products must not contain substances listed in Annex II. The practical way out is to cut the trace at source, with a higher purity grade of the raw material, another supplier or a change in the process, and to document the change with new certificates. It is better to do that before the next batch is made than with the product already on the market.
If you import cosmetics from outside the EU
If you bring cosmetics into the Union from a third country, you are the Responsible Person for each product you place on the market (Article 4.5), unless you appoint, by written mandate, a person established in the Union who accepts the role in writing. The safety file, and the proof about traces of prohibited substances, is then yours or your appointee’s. Your foreign manufacturer usually holds the certificates of the raw materials, but you need to ask for them before you place the product on the market, not after the first complaint. Notifying the product in the CPNP is a step for the same person, but it does not show that the file is complete; our step-by-step guide to CPNP notification explains what it does and does not prove.
If your company makes or imports cosmetics and your safety report does not say which traces of prohibited substances your raw materials or your packaging can carry, write to us before your next production run. We quote you the review of one reference, so that you know which proof is missing, and the work is reviewed and signed by an ASC technician. You can see how we prepare the cosmetic product safety report and what the role of the Responsible Person in the EU involves, or contact us directly.