Compliance Brief

Compliance Brief: Europe's PFHxA Limits for Cosmetics Took Effect October 10 — the validation failure they expose

Team ValidLeaf · October 2026 · 6 min read

Compliance Brief is our series explaining newly effective rules for regulated manufacturers — what changed, what evidence the rule demands, and where quality systems fall short. This one is about a limit measured in parts per billion: since October 10, 2026, cosmetics placed on the European Union market must stay below strict caps on PFHxA, a member of the PFAS family — whether it was deliberately used or arrived as a trace impurity. The gap: most manufacturers hold paperwork about ingredients, not measurements of the finished material.

What happened

The rule itself is not new. The European Commission adopted Commission Regulation (EU) 2024/2462 on September 19, 2024, adding entry 79 to Annex XVII of REACH and restricting undecafluorohexanoic acid (PFHxA), its salts, and PFHxA-related substances. What changed this month is the calendar: the transition period for cosmetics ended, and the restriction now applies (EUR-Lex; The Beauty Briefing).

From October 10, 2026, cosmetic products — as defined in the EU cosmetics regulation, Regulation (EC) No 1223/2009 — may not be placed on the market or used at a concentration equal to or greater than 25 ppb for the sum of PFHxA and its salts, or 1,000 ppb for the sum of PFHxA-related substances, measured in the homogeneous material. The same date and limits also took effect for clothing textiles and related accessories, footwear, food-contact paper and cardboard, and mixtures sold to the general public (EUR-Lex).

Two features of the drafting matter more than the numbers. First, the limits apply to the concentration in the material, not to whether anyone meant to add the substance: PFHxA-related substances include anything that, based on its molecular structure, can degrade or transform into PFHxA — so a precursor can pull a product into scope even if PFHxA never appears on a formula sheet. Second, the restriction does not apply to articles and mixtures placed on the market before October 10, 2026 — provided a company can prove when its stock was placed (EUR-Lex).

The recitals explain why regulators acted: PFHxA far exceeds the "very persistent" criterion in REACH, is mobile in the aquatic environment, and carries potential adverse effects on human health and the environment — and while PFHxA itself is not registered or used in the Union, several PFHxA-related substances are registered and widely used. The recitals also carry a quieter warning: the agency's risk committee noted that standard analytical methods for these substances and matrices still needed development, even though methods are commercially available in general (EUR-Lex).

The United States is on a different track. The FDA's report on PFAS in cosmetics, published December 29, 2025 under the Modernization of Cosmetics Regulation Act, identified 51 PFAS intentionally added to 1,744 cosmetic products sold in the U.S. and noted there are currently no federal regulations specifically addressing PFAS in cosmetic products. That report covered intentionally added ingredients only, not contaminants (JD Supra).

An honesty note: the regulation names no brands or products, and no public record establishes which cosmetics on sale today exceed the limits. Whether a given product complies is a question only testing can answer — which is precisely the point.

The validation gap: a limit you cannot verify from an ingredient list

Most cosmetics compliance files are built at the wrong resolution for a ppb rule. A formula review works in percentages and ingredient names; entry 79 works in parts per billion and molecular behaviour. A product can pass every line of an ingredient review and still fail, because the pathways in are not on the label: PFAS can be present unintentionally through raw-material impurities or the breakdown of other PFAS ingredients, as the FDA itself explains (The Beauty Briefing). The controls that close that gap are measurement controls:

• Map the inputs that can carry PFHxA chemistry. Start with fluorinated ingredients, film formers, repellent treatments, coatings and processing aids — and ask not only "is PFHxA in this?" but "can anything in this degrade into PFHxA?" That second question is the regulation's definition, and most supplier questionnaires never ask it.
• Upgrade supplier declarations from claims to evidence. A declaration that a material is "PFAS-free" or "not intentionally added" does not answer a trace-concentration limit. Declarations should name the substances covered, the basis for the claim, and whether testing supports it — and high-risk inputs need certificates backed by actual analysis, not a checkbox.
• Qualify the analytical method before you need the result. A 25 ppb limit is only meaningful if the method's quantification limit sits comfortably below it, in your matrix, in your lab's hands. Method validation — sensitivity, recovery in the actual product base, reproducibility — separates a defensible number from a decorative one. Regulators flagged years ago that standard methods for these substances still needed development; a lab report without a validated method behind it carries little weight.
• Write the specification the way the rule is written. The restriction measures the sum in homogeneous material. Specifications stated per ingredient, or as "not intentionally added," do not map to it. Finished-product and key raw-material specifications should mirror the rule's units, sums, and material basis so a result can be compared to the limit without translation.
• Prove the sell-through boundary with records, not memory. Product placed on the market before October 10, 2026 sits outside paragraph 1 of the entry — but only if distribution records, invoices, and batch traceability can show which units were placed, and when. If the dates live in someone's recollection, the derogation is a hope, not a control.
• Control the two-market problem explicitly. The EU limits do not change what may be sold in the United States, where federal law imposes no equivalent PFHxA cap. A global SKU needs a documented decision: one formula qualified to the EU limits everywhere, or market-specific variants with change control tight enough that the wrong variant never ships to the wrong market.

This is a different failure family from the cosmetics cases we have traced before. The skin-lightening cases involved prohibited ingredients used deliberately in imported products. The Intercon soap recall was about organisms growing inside a process. This one involves no bad actor and no contamination event: a compliant-looking formula, made exactly as designed, can still breach the limit because nobody measured the finished material at the resolution the law now uses.

For cosmetics manufacturers selling into Europe, the direction of travel matters too: a testing and supplier-evidence system built for PFHxA is reusable the next time this structure is extended; a one-off scramble is not.

How a GMP Readiness Assessment catches it

This is exactly the failure pattern a GMP Readiness Assessment is built to find. Over four weeks, it reviews:

• Restricted-substance mapping — can you list every input that could carry PFHxA or a PFHxA-related substance, including precursors that degrade into it?
• Supplier evidence quality — do declarations name substances and testing bases, or do they stop at "PFAS-free" claims?
• Analytical method readiness — is there a validated method, in a qualified lab, with a quantification limit below 25 ppb in your product matrices?
• Specification alignment — do your finished-product specifications mirror the rule's sums, units, and homogeneous-material basis?
• Market-boundary records — can batch and distribution records prove what was placed on the EU market before October 10, 2026?

It closes with a gap assessment, a remediation roadmap, and starter IQ/OQ/PQ templates — so the fix starts before an enforcement lab report does.