Safety data sheet requirements in the EU: is a download enough?
As of · sourced from primary law · not legal advice · Auf Deutsch lesen
This English version was prepared with AI from the German page. No native speaker or lawyer has read it. Found a mistake? Write to office@proofpass.eu.
The short answer
Usually not. Under Article 31(8) REACH you provide the safety data sheet to the recipient free of charge, on paper or electronically, at the latest with the first delivery. On the widely held reading that means supplying it actively, for example as an email attachment or a personal link. A download area the customer has to search does not on its own usually count as supplying it.
Art. 31(8) REACH
What Article 31 REACH requires
Whoever supplies a hazardous substance or mixture provides the recipient with a safety data sheet (Article 31(1)). Supplier means anyone who places the product on the market: manufacturer, importer, downstream user and distributor.
The data sheet is free of charge. You may send it on paper or electronically. It has to be with the recipient at the latest with the first delivery (paragraph 8). The language is the official language of the Member State where the product is placed on the market (paragraph 5), so an English data sheet alone does not serve a customer in Germany or Austria.
Why a download area often is not enough
The Regulation speaks of providing the data sheet to the recipient. On the widely held reading the recipient should receive it without having to look for it. A PDF on your website is a good addition. It does not replace supplying it.
In practice these routes count as supplying the data sheet:
- Email to the recipient with the data sheet attached
- Email with a personal link that leads straight to the valid document
- Printout with the delivery (delivery note, consignment)
- Email with a direct link, if no login or registration is needed and you actively point to new versions (ECHA guidance, ch. 2.13)
Proof: who received which version, and when
REACH prescribes no particular proof. At an inspection, or after an accident at the customer, the question still comes up whether and when you supplied the data sheet. Keep a log per recipient: which document, which version, when sent, when opened.
The log also helps with Article 31(9). A revised version goes to every recipient you supplied in the previous twelve months. Without a distribution list you will hardly manage that completely.
Common mistakes
- The data sheet sits only on the website and the customer never hears of it
- The link leads to a page that no longer exists after a relaunch
- Customers get an outdated version because the shop still holds the old PDF
- Distributors do not pass on the manufacturer’s data sheet, although the duty applies at every stage of the supply chain
Frequently asked questions
May I send the safety data sheet by email?
Yes. Article 31(8) REACH allows electronic supply. The recipient must actually receive it, free of charge and at the latest with the first delivery.
Do I have to give distributors a data sheet?
Yes. A recipient is anyone you supply, including a distributor, who passes it on to their own customers. The general public is excepted if sufficient information for protective measures is available some other way (Article 31(4)).
Must I send the data sheet again with every delivery?
No. Supply at the latest with the first delivery is enough. After that you send each new version to everyone you supplied in the previous twelve months.
Is a QR code on the label enough?
A QR code helps users on site. On the widely held reading it does not replace supplying the data sheet to the recipient, because the customer has to act.
With ProofPass
ProofPass sends every version to the distribution list with a personal link and logs sent, opened and downloaded with a timestamp. The log exports as CSV for an audit.
The dashboard and the sign-up form are in German.
Sources
As of 3 November 2026. The legal text in force prevails. This page is not legal advice; sources are given above.