REACH
EU regulation for chemical registration, evaluation, authorisation, restriction
ISO 28000
International standard for supply chain security management systems.
Quick Verdict
REACH mandates chemical risk management for EU market access, requiring registration and restrictions. ISO 28000 provides voluntary security framework for resilient supply chains. Companies adopt REACH for compliance, ISO 28000 for certification and risk reduction.
REACH
Regulation (EC) No 1907/2006 (REACH)
Key Features
- Shifts burden to industry for chemical registration >1 tonne/year
- Authorisation regime for SVHCs driving substitution post-sunset
- EU-wide restrictions via Annex XVII for unacceptable risks
- Dual evaluation by ECHA and Member States
- Mandatory SVHC communication in articles >0.1% w/w
ISO 28000
ISO 28000:2022 Security management systems Requirements
Key Features
- Risk-based supply chain security management framework
- PDCA cycle with ISO High Level Structure alignment
- Comprehensive third-party and supplier governance
- Integrated incident response and recovery plans
- Scalable for all organization sizes and sectors
Detailed Analysis
A comprehensive look at the specific requirements, scope, and impact of each standard.
REACH Details
What It Is
REACH (Regulation (EC) No 1907/2006) is a directly applicable EU regulation establishing a comprehensive framework for managing chemical risks. It shifts responsibility to industry for registration, evaluation, authorisation, and restriction of chemicals, covering substances, mixtures, and certain articles to protect health and environment while promoting innovation.
Key Components
- Four pillars: Registration (>1 tonne/year dossiers), Evaluation (dossier/substance checks), Authorisation (Annex XIV SVHCs), Restriction (Annex XVII bans/limits).
- 17 technical annexes detailing data requirements, SDS rules, exemptions.
- Built on risk-based assessments, tonnage bands, supply-chain communication.
- No certification; compliance enforced nationally with ECHA coordination.
Why Organizations Use It
Legal obligation for EU market access; avoids fines, seizures, market bans. Enhances risk management, substitution innovation, supply-chain transparency. Builds stakeholder trust, supports ESG, ensures continuity amid evolving lists (Candidate List, Annexes).
Implementation Overview
Phased: gap analysis, substance inventory, dossiers via IUCLID/REACH-IT, SDS management, monitoring. Applies to manufacturers/importers/downstream users across sectors; ongoing audits, no central certification but national enforcement readiness essential.
ISO 28000 Details
What It Is
ISO 28000:2022 is an international management system standard titled Security and resilience — Security management systems — Requirements. It provides a risk-based framework for establishing, implementing, maintaining, and improving a security management system (SMS) focused on supply chain protection against threats like theft, sabotage, and disruptions.
Key Components
- Clauses 4-10 follow ISO High Level Structure (HLS) and PDCA cycle.
- Core areas: context analysis, leadership, risk assessment, operations, performance evaluation, improvement.
- Emphasizes supply chain mapping, third-party controls, incident response.
- Supports third-party certification via accredited bodies per ISO 28003.
Why Organizations Use It
- Mitigates operational risks, reduces incident costs, enables trade facilitation.
- Meets contractual/regulatory expectations (e.g., C-TPAT equivalents).
- Builds stakeholder trust, competitive edge in procurement.
- Integrates with ISO 27001, ISO 22301 for efficiency.
Implementation Overview
- Phased approach: gap analysis, risk assessment, control deployment, audits.
- Scalable for SMEs to multinationals in logistics, manufacturing, etc.
- Involves training, supplier engagement; certification optional but common.
Key Differences
| Aspect | REACH | ISO 28000 |
|---|---|---|
| Scope | Chemicals registration, evaluation, authorisation, restriction | Supply chain security management system |
| Industry | Chemicals, manufacturing, importers EU-wide | Logistics, manufacturing, all sectors globally |
| Nature | Mandatory EU regulation with penalties | Voluntary ISO certification standard |
| Testing | Dossier submission, ECHA evaluation | Internal audits, certification body audits |
| Penalties | Fines, market bans by Member States | Loss of certification, no legal penalties |
Scope
Industry
Nature
Testing
Penalties
Frequently Asked Questions
Common questions about REACH and ISO 28000
REACH FAQ
ISO 28000 FAQ
You Might also be Interested in These Articles...
CMMC Scoping Mastery for Defense Supply Chains: Enclave Mapping, Subcontractor Flow-Down, and CUI Inventory Blueprint
Master CMMC scoping for DIB: delineate FCI/CUI boundaries, segment enclaves, manage subcontractor flow-down. Prevent 80% assessment failures with SSP templates,
NIST CSF 2.0 Implementation Tiers Roadmap: Step-by-Step Guide from Partial to Adaptive Cybersecurity Maturity
Master NIST CSF 2.0 Implementation Tiers with a step-by-step roadmap. Assess your tier, build gap analyses, and advance from Partial (Tier 1) to Adaptive (Tier
SOC 2 Audit Survival Guide: Auditor Questions, Red Flags, and Evidence Prep for First-Time Pass
Ace your SOC 2 audit with predicted auditor questions, model answers, red flags, and evidence checklists from CPA best practices & SignWell's journey. Reduce st
Run Maturity Assessments with GRADUM
Transform your compliance journey with our AI-powered assessment platform
Assess your organization's maturity across multiple standards and regulations including ISO 27001, DORA, NIS2, NIST, GDPR, and hundreds more. Get actionable insights and track your progress with collaborative, AI-powered evaluations.
Check out these other Gradum.io Standards Comparison Pages
ISO 37001 vs ISO 28000
Compare ISO 37001 vs ISO 28000: Anti-bribery systems vs supply chain security. Key differences, benefits & implementation for compliance. Find your best fit now!
GMP vs PIPEDA
Discover GMP vs PIPEDA: Pharma manufacturing standards meet Canada's privacy law. Unlock compliance strategies, risk insights. Expert comparison awaits!
CSA vs ISO 56002
Compare CSA (Z1000/Z1002 OHS) vs ISO 56002 innovation systems. Uncover PDCA alignment, leadership, risk mgmt & implementation for safety & growth. Boost compliance now!