A customer asks for our full formulation: what must we disclose?

This guide covers what a supplier of an industrial chemical mixture owes a business customer under the safety data sheet rules of the US, the EU and Canada. It does not cover filings to regulators, food contact or cosmetic ingredient lists, or a supply contract that already obliges disclosure. It gives no legal conclusion; counsel decides those cases.

Which formulation details does an SDS have to disclose to the customer?

A safety data sheet has to disclose the identity and concentration of hazardous ingredients above set thresholds, not the full formulation. In the US, section 3 of the SDS for a mixture gives the chemical name, CAS number or other unique identifier, and the exact percentage or a concentration range of every ingredient classified as a health hazard that is present above its cut-off or concentration limit, or that presents a health risk below it (OSHA 29 CFR 1910.1200 Appendix D, 2026). Ranges are allowed for a trade secret claim, for batch-to-batch variability or for a group of substantially similar mixtures (OSHA 29 CFR 1910.1200 Appendix D, 2026).

In the EU, a classified mixture lists substances that present a health or environmental hazard above the lowest applicable limit, substances with a Union workplace exposure limit, and, at or above 0.1%, PBT, vPvB and certain other listed substances of very high concern (REACH Annex II, section 3.2.1, consolidated 2026). A non-classified mixture lists hazardous substances and substances with a Union workplace exposure limit at or above 1% by weight in non-gaseous mixtures, and sensitisers, category 2 carcinogens and reproductive toxicants from 0.1% (0.01% for category 1A sensitisers) (REACH Annex II, section 3.2.2, consolidated 2026). Under REACH Annex II, a supplier may choose to list every substance, but nothing in it requires that. Ingredients below these thresholds and outside these lists, their ratio, grades, sources and the process are not required in section 3 by either the US or the EU rules.

Which parts of a formulation can stay a trade secret?

The parts of a formulation that can stay a trade secret on a safety data sheet are the specific chemical identity and the exact concentration of an ingredient, and only under each jurisdiction's procedure. Under US OSHA, the supplier may withhold them from section 3 only if the claim can be supported, the properties and effects of the hazardous chemical are disclosed, and the SDS states that the information is withheld (OSHA 29 CFR 1910.1200(i)(1), 2026). A withheld concentration must still appear as the narrowest of the prescribed ranges, such as 10% to 30%, under 29 CFR 1910.1200(i)(1)(iv)-(v) (OSHA, 2026). OSHA's rule also says nothing in it requires disclosing process information that is a trade secret (OSHA 29 CFR 1910.1200(i)(13), 2026).

In the EU, the route is a request to the European Chemicals Agency (ECHA) to use an alternative chemical name for a qualifying substance in a mixture, where disclosure would put the confidential nature of the business at risk; the name is deemed allowed if ECHA raises no objection within six weeks (CLP Regulation (EC) No 1272/2008, Article 24, as amended by Regulation (EU) 2024/2865, 2024). In Canada, the supplier files a claim for exemption under the Hazardous Materials Information Review Act, and the SDS shows that a claim was filed, its date and its registry number (Hazardous Products Regulations s. 5.7(3), current to 2026). In every case the hazard information itself stays on the sheet.

When should a supplier share formulation details under an NDA?

A supplier should share formulation details beyond the safety data sheet only under a signed non-disclosure agreement (NDA), and only when the customer's decision cannot be made with data instead. Typical cases are a joint development, a customer qualification that needs exact identities for its own regulatory filing, or a toll manufacturing setup where the customer will handle every raw material. A customer who wants to know whether the product suits its process rarely needs the recipe.

The NDA matters for the law as well as the relationship. EU law treats information as a trade secret only while it is secret, has commercial value because it is secret and "has been subject to reasonable steps under the circumstances" to keep it secret (Directive (EU) 2016/943, Article 2(1), 2016). A recipe sent by email without an agreement weakens that argument; this is an inference from the definition, not a court finding. US OSHA uses the same tool: a health professional who obtains a withheld identity in a non-emergency must first sign a written confidentiality agreement (OSHA 29 CFR 1910.1200(i)(3)(v), 2026).

Before signing, fix four terms: the purpose the information may be used for, the named people who may see it, how long it stays confidential, and what happens to the documents afterwards. Disclose the smallest set of identities and ranges that serves that purpose.

How do you answer a full formulation request with regulatory status and compatibility data instead?

A full formulation request is answered with regulatory status and compatibility data by turning it into the specific questions the customer has to settle, then answering each one with its basis and date. Most requests come from a customer form, an auditor or an engineer with a concrete worry, and the recipe is the broadest way they know to ask.

Work in this order. First, ask what decision the request supports: a regulatory declaration, a hazard assessment, a material compatibility check or a process change. Second, fix the jurisdiction and the list or rule the customer checks against, with its version date, because a statement such as "contains no substance of very high concern above 0.1% w/w", the threshold REACH Article 33 sets for articles (REACH, consolidated 2026), is only true against the Candidate List on a stated date. Third, answer each item from a document you hold: the current SDS for the customer's jurisdiction, the technical data sheet, test reports or a signed declaration from your own raw material supplier. Fourth, record for each answer the source document, its revision date and who confirmed it.

US OSHA builds the same logic into its own rule. A health professional asking for a withheld identity must explain why the properties and effects of the chemical, the exposure controls, the monitoring methods and the treatment methods would not meet the need (OSHA 29 CFR 1910.1200(i)(3)(iii), 2026). A customer request deserves the same test.

Which formulation disclosure answer fits each customer request?

The formulation disclosure answer that fits each customer request is the narrowest document that settles that request, with the exact composition kept for an NDA. The table below decides what to give for each need that usually sits behind a full formulation request.

The row used most is the second: a customer asking whether a listed substance is present needs a yes or no against a named list on a stated date, and an EU SDS already lists PBT and vPvB substances from 0.1% by weight even in a non-classified mixture (REACH Annex II, section 3.2.2, consolidated 2026).

The other rows follow the same rule of giving the narrowest document that settles the need. A compatibility question is a data question: a seal swell test, a coating adhesion test or a short trial on the customer's own material answers it better than an ingredient list the customer cannot interpret. A hazard question is answered by sections 2, 8 and 11 of the SDS, which must stay complete even when an identity is withheld. Only the last row, exact identities for joint development or the customer's own filing, calls for disclosure beyond the safety data sheet, and that happens under a signed NDA with a stated purpose.

What mistakes do suppliers make when answering a formulation request?

Suppliers answering a formulation request most often make one of five mistakes, and each one either gives away more than needed or answers less than the customer asked. The first is sending the recipe by email to close the request quickly, with no NDA and no record of who received it. The second is sending the SDS written for another jurisdiction, so the composition section follows the wrong thresholds; a US sheet and an EU sheet for the same product can list different ingredients.

The third is a statement with no threshold or date, such as "free of SVHC", which cannot be checked and may become false when the Candidate List grows. The fourth is a legal conclusion such as "fully compliant with REACH", which the supplier cannot give for the customer's use; state the facts and the basis, and leave the compliance decision with the customer. The fifth is using a trade secret claim to hold back hazard information, which none of the three systems allows: US OSHA requires the properties and effects to be disclosed (OSHA 29 CFR 1910.1200(i)(1)(ii), 2026), and an alternative EU name is reviewed if it no longer gives enough information for workplace safety (CLP Regulation (EC) No 1272/2008, Article 24(6), as amended by Regulation (EU) 2024/2865, 2024).

Inconsistency is a quieter version of the same problem: exact percentages in one reply and ranges in another reveal more than either document alone.

Who decides a formulation disclosure request beyond the SDS rules?

A formulation disclosure request beyond the safety data sheet rules is decided by the supplier's management and counsel, not by the person answering the email. Bring in counsel when the customer cites a contract clause, when the information is needed for a regulatory filing in another jurisdiction, when an NDA is proposed by the customer on its own terms, or when the formulation came from a licensor whose agreement limits disclosure.

Bring in the original manufacturer when you are a distributor. A distributor often does not hold the full composition, and a Canadian subsequent supplier, for example, relies on the first supplier's exemption and shows it on the SDS (Hazardous Products Regulations s. 5.7, current to 2026). Answering from memory or from an older SDS revision creates a statement nobody can trace.

Lubinpla's technical inquiry reply discloses ingredients only as far as the SDS of the customer's jurisdiction does, answers each item the customer actually asked with its basis and date in a reply PDF, and names who decides instead of giving a legal conclusion.

State-level reporting is a separate track. In Oregon, a hazardous substance report can claim only the identity and percentage of chemical components as trade secrets, with eight justification items (Oregon OAR 837-085-0150, 2025).