Safety data sheet proof of delivery: sample log

As of 3 November 2026 · sourced from primary law · not legal advice · Auf Deutsch lesen

This English version was prepared with AI from the German page. No native speaker or lawyer has read it. Found a mistake? Write to office@proofpass.eu.

REACH requires supply, but no particular evidence

Article 31(8) REACH only says that the data sheet “shall be provided free of charge on paper or electronically no later than the date on which the substance or mixture is first supplied”. It mentions no logs, receipts or read confirmations. Proof of delivery is therefore your own safeguard.

The Regulation does not explain what “provided” means. The ECHA guidance, in chapter 2.13, understands it as an active duty. The Forum of national enforcement authorities notes on that basis that merely putting a data sheet on a website is not enough. That is a widely held reading, not the text of the law. Guidance does not bind courts, and we found no judgment on this question.

So your evidence should answer three questions:

Who received the data sheet? Company and address at the time of sending.
Which version was it? Product, language, version and the “Revision” date.
When and how did it go out? Date and route, so that you meet the date of the first supply.

Under the ECHA guidance a link counts only on six conditions

The ECHA guidance accepts an email with an attachment in a generally readable format without reservation. It does not accept an email with a link to a general website where the data sheet first has to be looked for. For a direct link it gives an illustrative list that most national enforcement authorities agree with:

Condition under the ECHA guidance, ch. 2.13	What you check
The link leads directly to the SDS of the product supplied	Click from the mail: does the right data sheet open, without a search?
It works reliably and stays active as permanently as possible	Does it hang on the website that moves at the next relaunch?
If permanence is not possible: the customer is warned and can download	Does the mail say how long the link is valid?
If the link changes, the customer actively receives the new one	Who sends the new addresses after a move?
New versions are actively communicated	Does a mail go out with every revision?
No obstacle to access, so no login and no registration	Test in another browser without an account

Each piece of evidence shows something different

No evidence shows that someone read the data sheet. Nobody asks for that either. You want to show that you did your part. The assessment in the table is ours, not an official one.

Picture the hard case: a recipient says they never received the version with the new classification. What counts then is whether you can produce recipient, date and the exact file. The same goes for an authority: under Article 36(1) REACH you submit the required information or make it available without delay upon request.

Evidence	Shows	Does not show	Good for
Sent mail with attachment, archived	Recipient, time, exact file	Whether the mail arrived or was opened	The normal case
Personal link with retrieval log	Sending and retrieval per recipient	Who in the company clicked	Many recipients, large attachments
Read confirmation of the mail	Opening, if the recipient agrees	If it is missing, that proves nothing	Only as a supplement
Printout with the delivery note	Receipt of the consignment, if signed for	The version, unless it is on the note	Customers without email, paper requests
Acknowledgement of receipt from the customer	Receipt, by the customer in person	Nothing essential	Individual cases, because it takes effort
Download statistics of the website	That someone loaded the file	Who it was, whether it was your recipient	Not as proof

Sample log: eight columns are enough

The log works as a spreadsheet just as well as in a system. One row per recipient and version; overwrite nothing. An example with the invented company Musterlack GmbH:

The “Version” column matters most. Without it you cannot show later which information the customer had. Put the file you sent into the archive unchanged, with version and date in the file name. Retention under Article 36 REACH is at least ten years after you last manufactured, imported, supplied or used the substance or mixture.

Recipient	Product	Version, language	Revision	Route	Sent	Response	Open
Paint retailer A, purchasing@…	Wood varnish satin	3.0, de	12 Jan 2027	Mail, attachment	12 Jan 2027	none	no
Decorator B, office@…	Wood varnish satin	3.0, de	12 Jan 2027	Personal link	12 Jan 2027	retrieved 13 Jan 2027	no
Joinery C, office@…	Wood varnish satin	3.0, de	12 Jan 2027	Mail, attachment	12 Jan 2027	Undeliverable	yes: get new address
Works depot D, delivery note 4471	Wood varnish satin	3.0, de	12 Jan 2027	Paper	14 Jan 2027	signed for 15 Jan 2027	no

How to set up the proof

You can work through this order at once, also without software:

Pull the recipients per product from your ERP system or your invoices.
Ask each recipient for a shared mailbox, such as purchasing@ or safety@. People change.
Set up a fixed sender for SDS mails and keep the sent mails.
Create the spreadsheet with the eight columns and assign its upkeep to one person.
Tie supply to the first order: no new customer without a row in the log.
Check the “Open” column once a month and resolve what was undeliverable.
Handle paper requests and note the version on the delivery note.

What is not regulated

Four points stay open. A competent adviser can assess them for your business.

Form and content of a proof: REACH names none.
How long you keep the proof itself: Article 36(1) speaks of “all the information he requires to carry out his duties under this Regulation”; the log is not mentioned. We recommend the same ten years.
Undeliverable mails: the text says nothing about them. Treat them as not supplied and try again.
Data protection: the distribution list holds business contacts. Define purpose and retention, and tell recipients if you log the opening of a link.

Switzerland: same direction, its own law

Switzerland applies its Chemicals Ordinance (ChemV), not REACH. Article 21 ChemV requires the data sheet to be passed on no later than the first supply. According to the guide of the Swiss notification authority for chemicals (ch. 2.6, as of May 2022) there is no duty to keep records. The supplier should still be able to trace what was passed on in the last twelve months. A direct link by email expressly counts there as electronic transmission. The EU basics are in the guide on when a safety data sheet is required, the supply routes in the safety data sheets module.

Frequently asked questions

Do I have to prove that the customer read the safety data sheet?

No. Article 31(8) REACH requires that it is provided, not that it is read. What makes sense is evidence that the right version went out in time.

Is the sent mail enough as proof?

In most cases yes, if recipient, date and attachment are preserved and you archive the file. REACH contains no duty to do more. No evidence gives absolute certainty in a dispute.

May a link sit behind a customer login?

Not according to the list in the ECHA guidance: login and registration count as an obstacle. A customer portal can exist in addition. Supply then works better as an attachment or as a link without sign-in.

Do I have to supply it again with every delivery?

No. According to the ECHA guidance the same recipient needs no further copy as long as the data sheet has not been revised. The proof of the first supply therefore stays important for a long time.

As of 3 November 2026. The legal text in force prevails. This page is not legal advice; sources are given above.

Safety data sheet: proof of delivery. What really counts as evidence, with a sample log