Regulation (EU) 2026/909: twelve ingredient decisions, four deadlines — and two that already apply

• Regulation (EU) 2026/909 of 27 April 2026 amends four annexes at once — II, III, V and VI — of Regulation (EC) No 1223/2009. Twelve substances or substance groups, one prohibition, one substance moving from banned to conditionally allowed, and ten sets of new conditions.
• Two of the twelve already apply. The four new hair dye entries and the new preservative entry carry no transitional period: they have been in force since 18 May 2026.
• Everything else stops being placeable on the market on 1 January 2027, and stops being sellable on 1 July 2028 — except two Citral isomers, which get 1 August 2028. Yes, really: the same Annex III entry carries two different end dates.
• The heavyweight is aluminium: a brand-new entry 379 that caps aluminium-containing ingredients across 18 product categories, from 0.15 % in inhalable hair leave-on products to 43.31 % in eye shadow.
• A corrigendum of 8 May 2026 changed the Annex II reference number for Triphenyl Phosphate from 1752 to 1767. If you ingested the text published on 28 April, your entry number is wrong.

1. What Regulation (EU) 2026/909 actually is

On 27 April 2026 the European Commission adopted Regulation (EU) 2026/909, published in the Official Journal on 28 April 2026. Article 2 sets entry into force at "the twentieth day following that of its publication" — that is, 18 May 2026.

Its full title is a list, and that tells you what kind of regulation it is:

"…as regards the use of Benzyl Salicylate, Triphenyl Phosphate, Ammonium Silver Zinc Aluminium Silicate, Aluminium, water-soluble zinc salts, Acetylated Vetiver Oil, Citral, HC Blue No 18, HC Red No 18, HC Yellow No 16, Hydroxypropyl-p-phenylenediamine and its dihydrochloride salt, and DHHB in cosmetic products"

This is not a thematic reform like Regulation 2023/1545 on fragrance allergens, which did one thing at scale. It is a maintenance regulation: a batch of unrelated SCCS opinions, accumulated over six years, cleared in a single act. The oldest opinion it implements dates from June 2019 (acetylated vetiver oil); the newest from February 2025 (DHHB).

That structure has a practical consequence. There is no single story to remember and no single deadline to diarise. There are four different transitional footnotes, and which one applies to you depends on which row of which annex your ingredient sits in.

2. The three legal moves

Strip away the chemistry and the regulation does exactly three things:

It prohibits one substance. Triphenyl Phosphate joins Annex II, the list of substances banned in cosmetics.

It un-bans one substance, conditionally. Silver zinc zeolite was already prohibited under Annex II entry 1597. The regulation does not delete that entry — it rewrites it to read "Silver zinc zeolite with the exception of silver zinc zeolite under the conditions set out in entry 61 in Annex V", and simultaneously creates that Annex V entry. The substance now appears in the banned list and the permitted preservatives list at the same time. Movement in this direction is rare.

It sets conditions on ten more. Six existing or new Annex III entries get concentration limits, plus one Annex VI UV filter gets a purity requirement.

3. The calendar: four footnotes, three end dates

This is the part that gets summarised wrong everywhere, so here is the regulation's own text.

Four footnotes are attached to substance names in the annex tables. They are not interchangeable:

And the rows carrying no footnote at all: the four hair dye entries (381–384) and Annex V entry 61. Those apply from entry into force — 18 May 2026, already in the past.

Why? Recital 43 says it plainly:

"To enable the cosmetics industry to use hair dyes and preservatives in cosmetic products, the relevant amendments to Annexes III and V should apply without delay. It is appropriate however, to provide for a reasonable period of time in order to allow for the industry to adapt to the new requirements on the use of other substances restricted in this Regulation…"

Read that carefully, because the intuitive reading is backwards. The hair dye and preservative entries apply immediately because they open a door, not because they close one. Those substances had no Annex III or Annex V entry before; without one, a hair dye has no legal basis for use. Granting permission needs no transition period — there is nothing to phase out. The restrictive changes are the ones that got until 2027.

The Citral isomer trap

Annex III entry 70 lists three substances under the common name Citral:

One entry, one set of concentration limits, one labelling rule — and two different sell-through dates depending on which isomer your supplier declared.

A one-month difference will not decide anyone's business. But it is a perfect illustration of why "is this ingredient allowed?" is the wrong question to ask a regulatory database. The honest answer here is not yes or no; it is "allowed up to a limit that depends on your product category, declarable above a threshold that depends on whether you rinse it off, and non-sellable from a date that depends on which isomer it is." A data model that stores one boolean per ingredient cannot hold that answer. Neither can a spreadsheet.

4. Substance by substance

Benzyl Salicylate — Annex III entry 75, now capped

Benzyl Salicylate was already in Annex III as one of the fragrance allergens subject to individual labelling. That obligation does not change: it is still declared above 0.001 % in leave-on and 0.01 % in rinse-off products.

What is new is that it now has concentration ceilings on top of the labelling duty. Following data calls on endocrine-disruption concerns in 2019 and 2021, the SCCS concluded on 26 October 2023 that the substance is safe up to the maximum concentrations proposed by industry, and those became the legal limits:

Note what just happened to your compliance checklist: this substance is now declarable and capped. Two independent obligations, two different thresholds, one ingredient. The same is true of Citral.

Citral — Annex III entry 70, now capped

Same pattern. Citral remains declarable as "Citral" above the usual 0.001 % / 0.01 % thresholds, and gains ceilings derived from an SCCS opinion of 29 July 2024 that applied the QRA2 sensitisation methodology:

The deodorant limit of 0.032 % and the anogenital-wipe limit of 0.063 % are the tight ones. If you formulate with lemon, lemongrass, litsea or any citrus-facing natural, that is where the recalculation starts. As always with naturals, the IFRA Standards reached similar territory first — they read the same toxicological science the SCCS does.

Aluminium — new Annex III entry 379, the big one

This is the largest single change in the regulation. Following an SCCS opinion of 27 March 2024 on systemic exposure to aluminium from cosmetics, a new entry covers aluminium-containing ingredients generally, with limits expressed as Al across 18 categories.

The scope is defined by exclusion. Entry 379 covers all aluminium-containing ingredients except those in entries 34, 50, 189, 190 and 192 of Annex III, entries 117, 118, 119, 121, 131 and 150 of Annex IV, entry 61 of Annex V, and entry 27a of Annex VI. In other words: unless your aluminium ingredient is a listed colorant or one of the named exceptions, it falls in here.

Two warnings attach: category (q) must not be used in sunscreen products that may lead to lung exposure by inhalation, and category (r) carries "Keep powder away from children's nose and mouth".

The categories that bite are the low ones — 0.86 % for hand leave-on, 0.89 % for body and face rinse-off, 0.15 % for inhalable hair leave-on. Colour cosmetics, by contrast, are given generous headroom.

Water-soluble zinc salts — Annex III entry 24, now age-specific

Entry 24 previously allowed 1 % (as zinc) across the board. After an SCCS opinion of 26 October 2023, oral care is now split by age:

The listed salts are zinc acetate, chloride, gluconate, glutamate, citrate and sulphate. The change that matters is not the number — it is that a product category is now defined by the age of the user. If your product data model has no field for intended age, this entry cannot be checked automatically.

Acetylated Vetiver Oil — new Annex III entry 380

Two SCCS opinions back this one: 20–21 June 2019 for leave-on and rinse-off, and 25 October 2024 for sprayable products with inhalation exposure.

And an unusual condition, worth reading twice:

"For (a) – (e): stabilised with 1 % alpha-tocopherol (applies to raw materials)."

That is a specification on the raw material, not the finished product. You cannot verify it by analysing what you sell — you verify it in the supplier documentation. Anyone building a purely formula-based checker will miss this one entirely.

Triphenyl Phosphate — prohibited

Used as a plasticiser, particularly in nail products. The SCCS concluded on 25 July 2024 that its safety could not be confirmed: insufficient data plus concerns over genotoxicity. That combination — not proven harmful, but not demonstrably safe — leads to Annex II under the precautionary logic of the Cosmetics Regulation.

It becomes unplaceable on 1 January 2027 and unsellable on 1 July 2028.

Ammonium Silver Zinc Aluminium Silicate — new Annex V entry 61

Silver zinc zeolite is classified as Toxic for Reproduction Category 2, which under Article 15 makes it prohibited by default — see our note on CMR substances in cosmetics. Industry filed a dossier arguing the limited availability of preservatives, and the SCCS concluded on 21 December 2023 that it is safe under narrow conditions:

With the condition that "the silver content in Ammonium Silver Zinc Aluminium Silicate must not exceed 2.5 %".

No transitional period. This has been usable since 18 May 2026.

DHHB — Annex VI entry 28, a purity limit

The UV filter Diethylamino Hydroxybenzoyl Hexyl Benzoate keeps its 10 % maximum. What changes is a new impurity condition:

"Di-n-hexyl phthalate (DnHexP) as an unavoidable trace impurity in DHHB must not exceed 10 ppm."

The recitals here are worth reading, because they show a decision that was not purely scientific. The SCCS concluded on 14 February 2025 that a trace level of 260 ppm is safe as an unavoidable impurity, while noting 1 ppm as an achievable target. The Commission and Member States settled on 10 ppm — recital 40 explains that manufacturing DHHB at 1 ppm raises production costs, "especially for small and medium enterprises".

So the number in the law is neither the safety threshold nor the technical optimum. It is a negotiated point between them. That is normal in regulatory practice, and it is exactly the kind of context that disappears when a database reduces an entry to "10 ppm max".

Four new hair dyes — Annex III entries 381–384

All four apply immediately, with no transition:

Each oxidative entry carries the standard hair colourant warning block: the mixing ratio, plus the full "Hair colourants can cause severe allergic reactions… This product is not intended for use on persons under the age of 16… Temporary 'black henna' tattoos may increase your risk of allergy…" text that must be printed on the label.

Note the direction of the limits for HC Yellow No 16 and HC Red No 18: one is higher in non-oxidative products, the other lower. There is no general rule to memorise here; each entry follows its own SCCS opinion (25 October 2024 and 22 January 2025 respectively).

5. The corrigendum nobody will notice

On 8 May 2026, ten days after publication, a corrigendum was issued. Its entire content:

On page 7, in the Annex, point (1)(b), first column of the table (Reference number): for "1752", read "1767".

That is the Annex II entry number for Triphenyl Phosphate. Nothing about the substance, the ban or the dates changed — only the number the entry is filed under.

It is a one-character fix, and it is also a perfect miniature of why regulatory data is harder than it looks. Anyone who parsed the Official Journal on 28 April, keyed their records on the reference number and moved on now holds 1752, which does not exist. Anyone who checked again on 8 May holds 1767. Both were reading the same regulation, ten days apart. And a corrigendum generates no headline, no newsletter and no alert from most sources — it is published quietly and expected to be found.

Reference numbers are how annex entries are joined to everything else: your PIF, your CPSR, your supplier's documentation, your internal ingredient tables. When they shift silently, the joins break silently too.

6. What a Responsible Person should do now

In rough order of urgency:

1. Check the hair dyes and the preservative first. They are already applicable. If you make hair colourants or use silver zinc zeolite, the question is not what you must change by 2027 — it is whether what you are shipping today matches entries 381–384 and Annex V 61, including the mandatory warning text.
2. Screen the portfolio for aluminium. Entry 379 is defined by exclusion, so it catches more ingredients than a name search for "aluminium" would suggest. Start with antiperspirants, toothpaste, colour cosmetics and talc.
3. Recalculate Benzyl Salicylate and Citral against the new ceilings — and keep their labelling obligation separate in your records. They are two rules, not one.
4. Ask your fragrance and raw-material suppliers for the vetiver stabilisation statement. The 1 % alpha-tocopherol condition lives in their documentation, not in your finished product.
5. Ask your DHHB supplier for a DnHexP figure in ppm, with the method. "Complies with the regulation" is not a number.
6. Diarise two dates, not one: 1 January 2027 for production, imports and launches; 1 July 2028 for stock already in the channel — 1 August 2028 for the two Citral isomers.
7. Re-key anything filed under Annex II entry 1752 to 1767.

The full checklist of what sits on the RP's desk is in our Responsible Person obligations guide.

7. Why this regulation is a stress test for your ingredient data

Every change in 2026/909 breaks a common simplification:

• "Allowed or prohibited" breaks on silver zinc zeolite, which is both — banned in Annex II, permitted under Annex V entry 61.
• "One limit per ingredient" breaks on aluminium, with 18 category-specific ceilings, and on Benzyl Salicylate with 9.
• "One date per regulation" breaks on the four footnotes, and spectacularly on Citral, where two isomers in the same entry end on different days.
• "The limit is in the finished product" breaks on acetylated vetiver oil, whose condition applies to the raw material, and on DHHB, whose limit is an impurity in the ingredient.
• "The entry number is stable" breaks on the corrigendum.
• "A product category is a product type" breaks on zinc salts, where the category is defined by the age of the user.

None of these are edge cases invented to make a point — they are six of the twelve items in a single, ordinary maintenance regulation. This is simply what the Cosmetics Regulation looks like when you read it closely.

Which is also the practical argument for not maintaining this by hand. A monitoring system that watches the Official Journal catches the regulation, the corrigendum and the consolidation that follows; a person who is busy catches the regulation. You can check any of the entries discussed here against the current annexes in the CosIng search tool — and if you want the next 2026/909 to reach you the day it is published rather than the quarter after, that is what Regulatory Watch is for.

8. Frequently asked questions

When does Regulation (EU) 2026/909 apply? It entered into force on 18 May 2026. The hair dye entries (381–384) and Annex V entry 61 applied from that date. The remaining restrictions apply to products placed on the market from 1 January 2027, and to products made available on the market from 1 July 2028 (1 August 2028 for the Citral isomers Geranial and Neral).

Is Triphenyl Phosphate banned in cosmetics in the EU? Yes. Regulation (EU) 2026/909 adds it to Annex II. Non-compliant products cannot be placed on the EU market from 1 January 2027, nor made available from 1 July 2028. Its Annex II reference number is 1767 following the corrigendum of 8 May 2026.

What is the aluminium limit in cosmetics in the EU? There is no single figure: new Annex III entry 379 sets 18 category-specific maxima expressed as Al, from 0.15 % in inhalable hair leave-on products to 43.31 % in eye shadow. Antiperspirants are capped at 7.73 % (non-aerosol) and 3.24 % (aerosol), toothpaste at 3.18 %.

What is the new limit for Benzyl Salicylate? It ranges from 0.004 % in oral products to 4 % in fragrance products, across nine categories. The existing labelling obligation above 0.001 % (leave-on) and 0.01 % (rinse-off) is unchanged and applies in addition.

Does Citral have a new concentration limit? Yes — nine category-specific limits, from 0.032 % in deodorants and antiperspirants to 1.2 % in hair leave-on and rinse-off products. It also remains individually declarable as "Citral" above the usual thresholds.

What is the DnHexP limit in DHHB? 10 ppm, as an unavoidable trace impurity. The SCCS had considered 260 ppm safe and 1 ppm technically achievable; the 10 ppm figure was agreed with Member States taking production costs for SMEs into account.

Which substances have no transitional period? HC Blue No 18, Hydroxypropyl-p-phenylenediamine and its dihydrochloride salt, HC Yellow No 16, HC Red No 18 (Annex III entries 381–384), and Ammonium Silver Zinc Aluminium Silicate (Annex V entry 61). They apply since 18 May 2026 because they permit uses that previously had no legal basis.

Why do Geranial and Neral have a different deadline from Citral? Because they carry a different footnote in the annex table. Citral (3,7-Dimethyl-2,6-octadienal) carries footnote (**), ending 1 July 2028; the (E) and (Z) isomers carry (***), ending 1 August 2028. All three sit in the same Annex III entry 70 and share the same concentration limits.

Can silver zinc zeolite be used in cosmetics now? Only as a preservative in deodorant sprays and powder foundations, at 1 % maximum, with silver content in the ingredient not exceeding 2.5 %. Outside those conditions it remains prohibited under Annex II entry 1597.

Where is the official text? Regulation (EU) 2026/909 on EUR-Lex, and the corrigendum of 8 May 2026. Always check the consolidated version of Regulation (EC) No 1223/2009 for the annexes as they currently stand.

9. In short

Regulation (EU) 2026/909 is not a headline reform. It is a routine batch of twelve ingredient decisions — and precisely because it is routine, it is the honest picture of what regulatory compliance actually involves: four transitional footnotes instead of one deadline, a limit that depends on the age of the toothpaste user, a condition that lives in your supplier's raw material spec, an impurity ceiling set partly by SME economics, two isomers parting ways on 1 July and 1 August 2028, and a corrigendum ten days later that renumbers an annex entry without changing a word of substance.

Understanding the regulation takes an afternoon. Keeping every one of those details true across a catalogue, a supply chain and two years of transitional dates is the part that does not scale by hand.

That is the part BD-API automates.