Mixture in mixture (MiM): how to notify what your supplier won't disclose

Most formulators do not buy pure substances. They buy surfactant blends, pigment preparations, fragrance compounds, polymer dispersions — formulated products with a trade name, a safety data sheet, and a supplier who has no intention of handing over the recipe. Annex VIII to CLP still expects your poison centre notification to describe the composition of your mixture, including those purchased blends. The regulation calls such a component a mixture in mixture, or MiM, and Part B Section 3.2.2 sets out a precise fallback ladder for the case where you cannot see inside it.

What counts as a MiM

Annex VIII treats every component of your mixture as either a substance or a mixture in mixture. When the raw material you dose into the batch is itself a formulated product — a preservative blend, a masterbatch, a purchased base — it is a MiM, and the notification must identify it as one. The default expectation is maximal: if you have access to the MiM’s full composition, you report its substances exactly as you would report your own, with identifiers and concentrations meeting the normal PCN information requirements. The special MiM provisions only unlock when you genuinely do not have access to the full composition — which, in practice, is most of the time.

The Annex VIII hierarchy, in order of preference

Part B Section 3.2.2 gives three routes for a MiM whose recipe you cannot see. They are not interchangeable — each is conditioned on what already exists in the poison centre system:

1. The MiM is notified and its data has reached your appointed body. If the supplier created a UFIfor the MiM and the appointed body has received the MiM’s information in a prior submission, you identify the MiM by its product identifier, its concentration in your mixture, and its UFI. Nothing more. The responder handling an emergency resolves your notification to the MiM’s UFI and pulls the supplier’s composition from there.
2. The MiM has a UFI, but your appointed body has never received it. The UFI alone is worthless to a poison centre that cannot resolve it. You provide the product identifier, concentration and UFI, plusthe compositional information from the MiM’s safety data sheet and any other components you know of, plusthe supplier’s name, email address and telephone number.
3. No UFI exists.Same as the second route, minus the UFI: product identifier, concentration, the SDS composition data (Section 3, compiled under Annex II to REACH), any other known components, and the supplier’s name, email address and telephone number.

The condition in the first route is stricter than it looks. “Received by the appointed body” is market-specific: a MiM notified by its supplier for the German market has not been received by the French appointed body. If you notify in France against that UFI alone, the reference dangles. Before leaning on a supplier’s UFI, confirm not just that a notification exists but that it covers every member state you sell into.

The 100% MiM case: rebranding and importing

The MiM mechanism also solves a problem that has nothing to do with formulation: placing someone else’s product on the market under your own name. A rebrander is a duty holder — putting your brand on a mixture means submitting your own notification, even if you never open the drum. Since you do not know the recipe, you notify a mixture consisting of 100% of the MiM, identified by the supplier’s UFI. Your notification carries your own UFI on the label; the composition behind it is one line deep.

ECHA’s Annex VIII guidance (v6.0, October 2025) extends the same pattern to imports. A non-EU supplier who refuses to disclose the recipe to their EU importer can establish or contract an EU-based legal entity, make a voluntary submission of the full composition with a first UFI, and hand only that UFI to the importer. The importer — the actual duty holder — then submits their own notification referencing 100% of the MiM under the supplier’s UFI. Confidentiality is preserved, and the poison centre can still traverse the chain to the full composition. The guidance recommends putting the arrangement in a contract, because the importer remains legally responsible either way.

What to ask your supplier, in writing

Every MiM route depends on supplier cooperation, so the request letter is a compliance document. Ask for, in this order of preference:

• The full composition, under a confidentiality agreement if needed. It gives you the cleanest submission and immunity from the cascade problems below. Most suppliers will decline; ask anyway.
• The MiM’s UFI, with written confirmation that a poison centre notification containing it has been submitted, and — critically — the list of member states it covers.
• A current SDS whose Section 3 is complete under Annex II to REACH, since that is exactly the data set Annex VIII falls back on when no usable UFI exists.
• Named emergency contact details — a person or function with name, email address and telephone number, which the notification format requires verbatim for routes two and three.
• A change-notice commitment: the supplier informs you before the MiM’s UFI or composition changes, and states whether a UFI change is commercial (composition identical) or compositional.

What inspectors and appointed bodies check

MiM handling is where notifications fail quietly. ECHA’s validation rules block a submission that identifies a MiM without either a UFI or the SDS-derived composition and supplier contact details — the format enforces the Section 3.2.2 ladder mechanically. What validation cannot catch is the market-coverage gap: a MiM UFI that was never notified in your member state passes your dossier checks but leaves the appointed body with an unresolvable reference, and that surfaces when the record is actually used or inspected. Inspectors in the 2025 enforcement pilot cross-checked labels and notifications on 1,597 mixtures; a notification that cannot be traced through to usable composition data is a finding, not a formality.

Practical defence: keep the supplier confirmations with the notification record, re-confirm market coverage whenever you enter a new member state, and treat every supplier UFI change as a triage event — commercial or compositional, documented either way. When the answer is compositional, the update path is described in how to update a PCN.

Ufi Number builds MiM components into dossiers exactly along the Annex VIII ladder — supplier UFI where you have one, SDS data and supplier contacts where you do not — so the fallback logic is enforced before submission rather than discovered at validation.