How to check if supplier meets RoHS and REACH compliance

Compliance files are where smooth sourcing programs quietly fail. I have reviewed RoHS and REACH paperwork for metal parts going into European products for well over a decade, and the same gap shows up every year: a buyer collects a one-page certificate, files it, and finds out during a customs hold or a customer audit that the paper proved nothing. Here is how I check whether a supplier actually meets RoHS and REACH, in the order I do it.

Why metal parts get pulled into RoHS and REACH

RoHS 2, Directive 2011/65/EU, restricts ten substances in electrical and electronic equipment. A bare steel bracket is not electrical equipment, but nobody buys a bracket to keep it. The requirement rides down the supply chain in the customer's purchase order, because the finished product declares against upstream paperwork. If your parts end up inside electronics sold in the EU, expect the question in the RFQ.

REACH is different. Regulation (EC) 1907/2006 applies to articles directly. When a substance of very high concern, an SVHC, sits above 0.1 percent by weight, Article 33 obliges the supplier to pass safe-use information down the chain, and EU importers must notify ECHA's SCIP database. The candidate list grows twice a year, so old declarations answer old questions.

What the two rules actually restrict

RoHS caps ten substances in every homogeneous material. Lead, mercury, hexavalent chromium, PBB, PBDE, and the four phthalates added in 2015 sit at 0.1 percent by weight, which is 1,000 ppm. Cadmium sits at 0.01 percent, 100 ppm, ten times tighter. The phrase that matters is homogeneous material: a zinc-plated steel bracket is at least three of them, the steel, the plating, and the passivation layer, and each is measured separately.

Hexavalent chromium deserves a note. It was the workhorse of conversion coatings on zinc plating and on aluminum 6061 parts for decades; the industry has since moved to trivalent passivation, but old drawings still specify the hexavalent process. Cadmium plating on steel fasteners is the other classic trap. Passivated 316L is the easy case: the oxide layer is not a hexavalent coating, and the alloy is not restricted.

The file grows or shrinks with how the part is made. A turned part from CNC machining is alloy plus coating. A part from powder metallurgy is porous, so oils count as layers. A metal injection molding part carries feedstock residues before sintering. Same rules, more or fewer boxes on the test matrix.

The documents I request, and what each one proves

A usable file has four pieces. The anchor is a declaration of conformity signed by the supplier, naming Directive 2011/65/EU as amended. On top sit third-party test reports, one per homogeneous material, run under the IEC 62321 series: ICP for the metals, a colorimetric method for hexavalent chromium, GC-MS for the phthalates, from a lab accredited to ISO/IEC 17025. Then an SVHC declaration that names the version of the candidate list it was checked against. Close a complex stack with a full material disclosure.

None of this is exotic. Our quality page lists what we issue with each shipment. The logic is the same one I described in how to vet a Chinese metal parts manufacturer before ordering: ask for evidence a stranger could check, because a customs officer will be that stranger someday.

How to verify the report before you trust it

A test report is only as good as its weakest line. I read six things: the accreditation, and whether its scope covers the cited method; the sample description, which must match your part number and drawing revision; the methods, which should be the IEC 62321 series; the results table, read against the limits rather than the word pass; the report number, which SGS, TUV, Intertek, and Bureau Veritas all verify on their websites in about two minutes; and the date, because a report from before July 2019 misses the four phthalates.

The check that catches the most fakes is free: read the results against the alloy. A machined bracket in C36000 free-cutting brass carries about 3 percent lead by design; that is what makes it machine. When a report for a brass part came back with lead marked not detected, either the sample was not the part or the report was borrowed from another job. I returned the file and asked for a retest with the sample photographed beside the part number. It is the same habit I recommend in our material certificate walkthrough.

Screen the parts as well as the paper

Paper tells you what the lab saw. XRF screening tells you what is in your lot this month. Handheld XRF reads elemental composition in seconds and costs 30 to 80 dollars per sample at a third-party lab, or 15,000 to 40,000 dollars for your own unit. I fold it into first article and incoming lots, three to five parts each. It is screening, not proof: XRF reads total chromium, so it cannot tell trivalent from hexavalent, it biases toward the surface, and it will not chase phthalates. Its job is catching drift between paper and parts, the failure mode that ends in a customs hold.

The natural home for this is the first article. Our post on why first article inspection matters for procurement treats it as the moment a supplier proves the process, and a compliance spot check costs minutes next to the dimensional report already on your desk. Automotive programs fold the same evidence into the PPAP submission checklist.

Red flags I have learned to stop on

These are the patterns that make me stop reading and start asking questions:

• A certificate with no lab name and no report number.
• A report that tests only six substances; the phthalates joined the list in July 2019.
• A sample described as generic stainless steel with no part number.
• A report number that fails verification on the lab's own website.
• Lead marked not detected on a brass part, or cadmium not detected where you know it was plated.
• An XRF scan offered as complete proof of compliance for a plated part.

One red flag is a conversation. Two is a retest at the supplier's cost. Three changes how I read every other document in the file, and usually the relationship.

What it costs, and who pays

A third-party RoHS test on one homogeneous material runs 150 to 400 dollars. A plated bracket is two to three materials once you count base metal, plating, and passivation, so a complete file lands around 300 to 1,200 dollars per part family. A complex assembly that needs full wet chemistry can reach 1,500 to 3,000 dollars. The supplier's standard file for an existing material is usually free. The money conversation starts when you require third-party testing on a new material; settle that in the RFQ.

Set that against the alternative. A container held at an EU port while you retest, rework, and fly replacements in runs 15,000 to 60,000 dollars between detention, air freight, and the customer's line-down clock, before anyone mentions a fine, which member states set separately. In automotive programs that clock runs in minutes. I have sat on the phone during one of those weeks. The verification file is cheaper, and it is the only version of this story where nobody is apologizing.

The checklist I run before placing the order

The whole routine fits on one page:

1. Name the rules in the RFQ and the PO: RoHS 2, Directive 2011/65/EU as amended, and REACH, Regulation (EC) 1907/2006.
2. Require the four documents: signed declaration of conformity, IEC 62321 reports per material from an ISO/IEC 17025 lab, SVHC declaration with list version, material disclosure where needed.
3. Match every report to a part number and drawing revision before you file it.
4. Verify report numbers on the lab's website and read results against the alloy.
5. Add an XRF spot check to the first article plan and to incoming sampling.
6. State the refresh cycle: re-declare annually and within 30 days of a candidate list update.
7. Decide up front who pays for third-party retests, and write it into the PO.

None of this takes more than a day of setup, and it decides whether a customs question becomes a filing exercise or a crisis. Our full process, from DFM to shipment documents, is on how we work; shorter questions live in the FAQ.

Frequently asked questions

How long is a RoHS test report valid?

There is no official expiry. A report ages with the regulation: the REACH candidate list updates twice a year, and phthalates joined the RoHS list in July 2019. I treat reports as current for one to two years.

What is the difference between a RoHS declaration and a test report?

A declaration is the supplier's signed statement of compliance. A test report is lab data on a sample, run under IEC 62321 methods at an accredited lab. A declaration with no reports is an opinion with a signature.

How much does RoHS testing cost for a metal part?

A third-party test on one homogeneous material runs 150 to 400 dollars. A plated bracket counts as two to three materials, so a full file is typically 300 to 1,200 dollars per part family.

Does REACH apply to metal parts, or only to chemicals?

It applies to articles too. Above 0.1 percent by weight, a candidate list substance triggers Article 33 information duties down the supply chain and SCIP notification for EU importers. Declarations need dates and versions.

Is brass RoHS compliant with its lead content?

Free-cutting brass carries about 3 percent lead, and an Annex III exemption has covered lead in copper alloys up to 4 percent. Exemptions shift with reviews, so check the current annex and cite the exemption number.