REACH Art. 31 · Regulatory Guide
Safety Data Sheet (SDS): REACH obligations, updates, and sending to customers
The complete guide to providing, updating, resubmitting, and retaining Safety Data Sheets along the supply chain.
Updated on
The obligation in brief
In summary
The Safety Data Sheet (SDS) is the document through which a supplier of a hazardous chemical substance or mixture transmits information to customers for its safe use. It is governed by Article 31 and Annex II of the REACH Regulation (EC) No 1907/2006, has 16 mandatory sections, and must be delivered free of charge, in the language of the country, by the supply date. The most challenging obligation is not drafting it, but updating it: when information on hazards or risk management changes, the new version must be sent to all customers supplied in the previous twelve months, and the supplier must be able to prove it. Between November 2026 and May 2028, the new hazard classes of the CLP Regulation will require the revision of many sheets and, consequently, repeated submissions.
What the Safety Data Sheet is
The Safety Data Sheet (SDS) is the primary tool for communicating information on the hazards and safety measures of a substance or mixture down the supply chain: from the manufacturer or importer to the distributor, and on to the professional user and the employer who uses it in their department.
The legal basis is Regulation (EC) No 1907/2006 of the European Parliament and of the Council of 18 December 2006, known as REACH, specifically Article 31 and Annex II. The current format of Annex II was rewritten by Regulation (EU) 2020/878, applicable from 1 January 2021 and mandatory for all sheets from 1 January 2023. The hazard classification on which the sheet depends is established by Regulation (EC) No 1272/2008, known as CLP.
As European regulations, REACH and CLP apply directly in all Member States. Italy has regulated penalties through Legislative Decree No 133 of 14 September 2009.
It should not be confused with the Technical Data Sheet (TDS), which describes the product's performance and is a commercial document. The SDS is a legal requirement, has a content fixed by the regulation, and a version history that must be retained.
When the SDS is mandatory
Article 31(1) of REACH requires the supplier to provide the sheet in three cases:
- the substance or mixture meets the criteria for classification as hazardous under the CLP Regulation;
- the substance is persistent, bioaccumulable and toxic (PBT) or very persistent and very bioaccumulable (vPvB) according to Annex XIII of REACH;
- the substance is included in the candidate list of substances of very high concern for Authorisation (SVHC), for reasons other than the above.
Unclassified mixtures and products for the general public
For mixtures that are not classified as hazardous, Article 31(3) requires that an SDS be provided on request to the recipient if they contain: at least one substance hazardous to health or the environment in a concentration of 1% or more by weight (0.2% by volume for gaseous mixtures); at least one substance that is a category 2 carcinogen, toxic for reproduction, a sensitiser, PBT, vPvB, or included in the SVHC list in a concentration of 0.1% or more by weight; or a substance with a Community workplace exposure limit.
When an SDS is not required, Article 32 still mandates the transmission of essential information down the chain: registration number, any authorisation or restriction, and data useful for risk management measures.
For products sold to the public, the sheet is not necessary if the label and the information provided are sufficient to protect health and the environment (Article 31(4)), but it is still required if a downstream user or distributor requests it.
Structure and responsibilities
The 16 sections of the sheet
Article 31(6) and Annex II establish the 16 sections, always in the same order. Regulation (EU) 2020/878 added, among other things, information on nanoforms, endocrine disrupting properties, specific concentration limits, M-factors, and acute toxicity estimates.
| No. | Section | What it contains, in brief |
|---|---|---|
| 1 | Identification of the substance/mixture and of the company/undertaking | Product identifier, UFI code if applicable, relevant uses, supplier, emergency number |
| 2 | Hazards identification | Classification, label elements, other hazards including PBT/vPvB and endocrine disrupting properties |
| 3 | Composition/information on ingredients | Hazardous components, concentrations, specific limits, M-factors, acute toxicity estimates |
| 4 | First aid measures | Actions in case of exposure, symptoms, treatments |
| 5 | Firefighting measures | Extinguishing media, specific hazards, instructions for responders |
| 6 | Accidental release measures | Precautions, containment, clean-up |
| 7 | Handling and storage | Precautions for use, storage conditions and incompatibilities |
| 8 | Exposure controls/personal protection | Exposure limits, technical controls, protective equipment |
| 9 | Physical and chemical properties | Physical state, flammability, flash point, other properties |
| 10 | Stability and reactivity | Reactivity, conditions and materials to avoid, decomposition products |
| 11 | Toxicological information | Health effects, including endocrine disrupting properties |
| 12 | Ecological information | Toxicity, persistence, bioaccumulation, mobility, endocrine disrupting properties |
| 13 | Disposal considerations | Waste treatment methods |
| 14 | Transport information | UN number, class, packing group, environmental hazards |
| 15 | Regulatory information | Specific applicable regulations, chemical safety assessment |
| 16 | Other information | Changes from the previous version, sources, abbreviations, training |
When the supplier has prepared a chemical safety report, the relevant exposure scenarios must be attached to the sheet (Article 31(7)). This is the extended SDS (eSDS), which can run to dozens of pages for a single product.
Delivery: when, how, and in what language
By the supply date, free of charge
The SDS must be provided free of charge, on paper or electronically, by the date of supply of the substance or mixture (Article 31(8)). It is not permissible to charge a fee or wait for a customer request, except in the cases of paragraphs 3 and 4. After the first delivery, it is not necessary to resend it with every supply to the same customer, unless it has been revised.
In the language of the destination country
The sheet must be drawn up in an official language of the Member State where the product is placed on the market, unless otherwise provided by that State (Article 31(5)). For Italy, this means in Italian. Exporters must manage a version for each language, and each version has its own update cycle.
Provided, not just published
The electronic format is permitted, but the sheet must be transmitted to the recipient. The ECHA Guidance on the compilation of safety data sheets (version 4.0, December 2020, paragraph 2.13) clarifies that "to provide" is an active duty and reports the position of the ECHA Forum of enforcement authorities: merely publishing the SDS, or an update, on a website is not enough. Sending it as an email attachment is acceptable; an email with a link to a generic website, where the sheet must be searched for, is not.
For delivery via a link, most national authorities require that the link be direct to the specific sheet of the product supplied, reliable and continuously active, preferably permanent; that the customer be notified if access is temporary; that changes to the link and updates to the sheet be actively communicated; and that no login or registration be required. In practice, this means tracked delivery and the ability to prove which version which customer received.
Updating and resubmitting: the most difficult obligation
Article 31(9) obliges the supplier to update the SDS without delay in three situations:
- as soon as new information which may affect the risk management measures, or new information on hazards, becomes available;
- once an authorisation has been granted or refused;
- once a restriction has been imposed.
The twelve-month rule
The new version is dated and identified as "Revision: (date)" and must be provided free of charge, on paper or electronically, to all previous recipients to whom the substance or mixture was supplied within the preceding twelve months. After registration, updates shall include the registration number. According to Annex II, point 0.2.5, the first page indicates the version being replaced, and the changes should be indicated, usually in section 16.
Not every change requires resubmission. The ECHA guidance (paragraph 2.9) distinguishes between revisions required by Article 31(9) or by changes to Annex II, which must be provided to customers of the last twelve months, and minor corrections, for which resubmission is optional. It suggests a numbering system that makes the difference visible: version 1.1, 1.2 for minor changes, version 2.0 for those to be resubmitted.
This is where the operational problem arises. To comply with the twelve-month rule, the supplier must cross-reference, for each product and each revision, the sales history with the customer database: who bought that code in the last year, to which address the sheet should be sent, in which language. With dozens of products and hundreds of customers, a regulatory update like a new classification can generate thousands of mailings in a few weeks.
The obligation flows down the chain. A distributor who receives a revision from their supplier must, in turn, forward it to their own customers of the last twelve months. The downstream user must apply the measures indicated in the updated sheet and, if their use is not covered, trigger the obligations of Article 37.
How to prove submission and how long to retain
How to prove submission
REACH does not specify a form of proof, but in an inspection, the supplier must be able to show that they have complied. Solid proof links five elements: the product, the sheet version, the recipient, the date of sending, and the outcome of the delivery or opening. To this is added the archive of all previous versions, because the inspector's question is almost always "which sheet did this customer have on that date". An email sent from a mailbox, without a log and without confirmation, is difficult to reconstruct years later.
Retention: ten years
Article 36 of REACH requires manufacturers, importers, downstream users, and distributors to assemble and keep available all the information required to carry out their duties under this Regulation for a period of at least ten years after they last manufactured, imported, supplied, or used the substance or mixture. On request, this information must be submitted to the competent authorities or made immediately available to them.
For SDSs, this means retaining every revision, not just the latest one, along with proof of submissions. Ten years is longer than the average life of an ERP system and often of the relationship with an IT provider.
Structure and responsibilities
Who must do what
| Actor | Main SDS obligations | Reference |
|---|---|---|
| Manufacturer or importer | Classifies, drafts the SDS and exposure scenarios, provides it, updates and resubmits it to recipients of the last 12 months, retains information for 10 years | REACH Arts. 31 and 36; CLP |
| Formulator (downstream user who produces mixtures) | Drafts the SDS for the mixture using the component sheets, updates it when the received sheets change | REACH Arts. 31, 37 and 38 |
| Distributor | Transmits the received SDS to its customers, forwards revisions, retains information for 10 years | REACH Arts. 31 and 36 |
| Downstream user | Applies the indicated measures, verifies that their use is covered, reports new or inadequate information to the supplier | REACH Arts. 34 and 37 |
| Employer | Makes the SDS information accessible to workers and uses it in the chemical risk assessment | REACH Art. 35; Legislative Decree 81/2008, Title IX |
| Producer or importer of articles | Communicates the presence of SVHCs above 0.1% by weight to recipients; to consumers on request within 45 days | REACH Art. 33 |
Can you prove which SDS each customer has received?
Upload a sales list and an SDS, and we'll show you submission, revision, and logging in 30 minutes.
Request a demoRegulatory calendar
Deadlines to mark: 2025–2028
REACH does not have a single application date like the Machinery Regulation, but in the next two years, several amendments to CLP will require the revision and resubmission of many sheets.
Substances must be classified and labelled according to the new hazard classes introduced into CLP by Delegated Regulation (EU) 2023/707: endocrine disruptors for human health and the environment, PBT/vPvB, PMT/vPvM.
The same obligation applies to mixtures.
The first provisions of the CLP revision, Regulation (EU) 2024/2865, apply in stages, according to the calendar amended by Regulation (EU) 2025/2439.
Deadline for classifying and labelling according to the new classes for substances already on the market before 1 May 2025. A new classification is new information on hazards: the SDS must be updated and resubmitted to customers of the last twelve months.
Date to which Regulation (EU) 2025/2439 of 26 November 2025 postponed other rules of the CLP revision, including those on the format of labels and advertising. The postponement does not affect the new hazard classes.
Deadline for classifying and labelling according to the new classes for mixtures already on the market before 1 May 2026, with the consequent update of the SDSs.
The affected sheets will change mainly in sections 2, 3, 11, and 12, with the new statements EUH380, EUH381, EUH430, EUH431, EUH440, EUH441, EUH450, and EUH451. For a formulator, the real deadline comes before the legal one: they must receive the updated sheets from raw material suppliers, reclassify their own mixtures, and repeat the submissions.
On the REACH front, on 27 April 2026, the European Commission announced that for now it will not present a proposal for a comprehensive revision of the Regulation. Instead, it will focus on simplifications introduced by amending the annexes through the committee procedure and on more effective controls. Article 31 therefore remains unchanged, but Annex II, which defines the content of the SDS, is among the parts that can be modified by this procedure: it must be kept under observation.
Penalties in Italy
Legislative Decree No 133 of 14 September 2009 governs penalties for REACH violations. Article 10, dedicated to information in the supply chain, provides for the following administrative fines, unless the act constitutes a criminal offence:
- from €10,000 to €60,000 for a supplier who fails to comply with Article 31(1), (3), (8), and (9): SDS not provided, not provided on request, not provided on time, not updated, or not resubmitted (paragraph 2);
- from €3,000 to €18,000 for a supplier who does not provide the SDS in Italian, and for those who provide it undated, incomplete, or inaccurate (paragraph 3);
- from €10,000 to €60,000 for anyone who fails to attach the relevant exposure scenarios to the SDS (paragraph 4);
- from €10,000 to €60,000 for a supplier who, not being required to provide an SDS, fails to transmit the information of Article 32 (paragraph 5);
- from €15,000 to €90,000 for an employer who does not allow workers to access the information (paragraph 8);
- from €3,000 to €18,000 for anyone who does not retain the information for ten years as required by Article 36 (paragraph 9).
Inspections and workplace safety
In the workplace, the obligations and penalties of Legislative Decree 81/2008 on the assessment of chemical risk also apply. In Italy, the Competent Authority for REACH is the Ministry of Health; inspections in the territory are carried out by the Regions and the Local Health Authorities (ASL).
Action plan
Checklist: what to do by 2026
- 01List all products for which an SDS is required, language by language, with the current version and the date of the last revision.
- 02Verify that all sheets are in the format of Regulation (EU) 2020/878.
- 03Ask raw material suppliers for sheets revised according to the new hazard classes and plan the reclassification of your own substances by 1 November 2026.
- 04Plan the reclassification of mixtures by 1 May 2028, starting with the products with the most customers.
- 05Connect the product database to the sales history to know at any time who has purchased each code in the last twelve months.
- 06Define the delivery channel: email attachment or direct link to the sheet, always active and without login, with a delivery trace. Not just publication on the website.
- 07Set up the submission log: product, version, recipient, date, outcome. Adopt a numbering system that distinguishes revisions to be resubmitted from minor ones.
- 08Retain all revisions and the log for at least ten years from the last supply.
- 09Establish who in the company decides that new information triggers a revision and in how many days the resubmission is completed.
- 10For distributors: formalise with suppliers the automatic receipt of revisions and forward them to your own customers with the same log.
From regulation to practice
How Certiblok supports SDS compliance
Certiblok is the secure compliance and document management platform for companies and professional firms, certified ISO/IEC 27001:2024. For manufacturers and distributors of chemical products, it covers the points where REACH requires submission, updating, proof, and retention.
SDS Manager
A CSV file with the customer's email, purchase date, and product code is exported from the ERP system (SAP, Zucchetti, Excel, or others), without complex integrations. The system analyses the dates and sends each customer on the list an email with a direct link to their product's sheet: no login required and no expiration, as requested by control authorities. When a new version is uploaded, it is automatically sent to those who have purchased the product, and inactive customers (over twelve months) are removed from the list: this is the twelve-month rule of Article 31(9), applied automatically.
Discover SDS ManagerSubmission Log
Every submission is logged, and a dashboard shows the status of submissions, errors, and delivery confirmation for each email. This is the proof to show in an inspection: which version, to which customer, on which date, with the delivery outcome.
DRM® Archive on a decentralized network
The sheets and all their revisions are divided into 80 AES-256 encrypted fragments and distributed over a network of 26,000 nodes, European for European customers: no single node contains the complete file. The archive remains available for the ten years required by Article 36 even if suppliers, servers, and ERP systems change.
Discover DRM®Versioning with complete history
Each SDS maintains all its revisions, accessible with a click. Together with the log, it allows you to show which version was in force and which one each customer received on a certain date.
Tracked Sharing
Sheets and exposure scenarios can be shared with customers and distributors without them needing to register, knowing who viewed the file and when; recipients are notified when a new version is released. For SDSs, it is advisable not to set an expiration date for the link: authorities require it to remain continuously active.
Discover sharingAudit Room
In the event of a REACH inspection or a customer audit, the sheets, revisions, and submission log for a product are collected in a dedicated room. The inspector accesses it with permissions and duration decided by the company, without becoming a user and without receiving copies of the files, and every access is tracked.
Discover Audit RoomFrequently Asked Questions about SDS and REACH
When is a Safety Data Sheet mandatory?
By when and in what language must the SDS be delivered?
When must the Safety Data Sheet be updated?
Do I have to resend the updated SDS to customers I have already supplied?
How do I prove that I have sent the updated SDS to customers?
Is it enough to publish the safety data sheets on the company website?
For how long must SDSs and related information be kept?
What are the penalties in Italy for SDSs?
What changes for SDSs with the new CLP hazard classes?
Automate your SDS compliance
Connect products, versions, and customers, automate resubmissions, and maintain complete proof of every delivery.