Supplier declarations with AI: RoHS, REACH SVHC and SCIP data checked against the BOM

What the AI takes off the compliance desk

AI can collect RoHS and REACH declarations from your suppliers, read them into fixed fields, check them against your bill of materials and the current EU lists, and draft answers to the compliance questionnaires your customers send. The reading and drafting are done by an AI model on your own server; the decision whether a part is covered, outdated or missing is made by rules your compliance team maintains, and a person signs every answer. For a company with a few hundred suppliers, the computing load is small: by our estimate a week of declarations takes about an hour on one NVIDIA RTX PRO 4500 Blackwell Server Edition card.

This page is for the managing director and the head of product compliance, quality or purchasing at a maker of electrical and electronic equipment, components, cables or machines, and for the IT team that runs the server. The first half explains the task and the law in plain terms; the technical notes follow.

The three sets of rules behind the paperwork

Three EU texts produce most of the declarations a component maker collects and answers. They are summarised here as general information, read on EUR-Lex and ECHA pages on 25 October 2026; your legal counsel confirms how they apply to your products.

EUR-Lex texts of Directive 2011/65/EU, Delegated Directive (EU) 2015/863 and Directive (EU) 2018/851; ECHA pages on Candidate List obligations and on SCIP; all read 25 October 2026.

RoHS. The directive restricts lead, mercury, hexavalent chromium, PBB and PBDE at 0.1 per cent and cadmium at 0.01 per cent, by weight in homogeneous materials. A homogeneous material is, in the directive's words, "one material of uniform composition throughout", so the limit applies to a solder joint or a plastic housing, not to the whole device. Delegated Directive (EU) 2015/863 added four phthalates, DEHP, BBP, DBP and DIBP, at 0.1 per cent from 22 July 2019, and from 22 July 2021 for medical devices and monitoring and control instruments. Exemptions are listed in annexes, and under Article 5(2) each has a validity of up to five years, or up to seven for those two categories. The manufacturer keeps the technical documentation and the EU declaration of conformity for ten years after the equipment is placed on the market.

REACH. The Candidate List names substances of very high concern (SVHC). ECHA's page states that suppliers of articles containing a Candidate List substance above 0.1 per cent weight by weight "have to provide sufficient information to allow safe use of the article to their customers", and that a consumer's request must be answered within 45 days. Producers and importers must notify ECHA when the substance in their articles totals over one tonne a year, no later than six months after it is added to the list. The list grows over time: the EU's transition pathways portal reported 253 entries on 12 March 2026, after two additions. A declaration that says "free of all SVHC" is only as current as the list it refers to.

SCIP. Since 5 January 2021, the Waste Framework Directive, as amended in 2018, requires suppliers of such articles to send the Article 33 information to ECHA, which publishes it in the SCIP database. On 10 December 2025 the Commission proposed (COM(2025) 986) that suppliers should no longer submit data, arguing that the database "in its current form is not fulfilling its intended objectives", while data already reported stays with ECHA. The European Parliament's Legislative Observatory showed the procedure 2025/0394(COD) as "awaiting committee decision" on 25 October 2026, with an indicative plenary date of 14 December 2026. Until a change is adopted and in force, the obligation stands.

Declarations of preferential origin, the other common supplier declaration, follow customs law and are not covered on this page.

Why supplier declarations and customer questionnaires pile up

A maker of control cabinets, sensors or machines buys thousands of parts from hundreds of suppliers. Each supplier answers in its own form: a one-page RoHS statement, a REACH letter that lists SVHC above 0.1 per cent, a spreadsheet of substances per part number, a full material declaration with every substance in every homogeneous material, or a link to a portal. Many cover a list of part numbers, some only a product family. They age: the Candidate List grows, RoHS exemptions expire, parts change.

Then the questions come from the other side. Customers send their own questionnaires, often per part number, sometimes for every product you supply, and they may ask again after a Candidate List update. Answering means finding the right declarations for every part in the bill of materials (BOM), checking that they are current, and adding up what the product contains. That is reading and matching work, which is what language models do well, as long as the matching itself follows rules.

How AI automates the declaration check, step by step

1. Intake. Declarations arrive by email, from supplier portals or as answers to your own requests. The system files each one with the supplier and the date received.
2. Reading. An OCR model turns scans into text and tables; PDFs with a text layer and spreadsheets skip this step. A text model reads the result and fills a fixed form: supplier, part numbers covered, date, the RoHS statement and any exemptions claimed, the Candidate List version or date the declaration refers to, and each SVHC named with its CAS or EC number, concentration and the part or material it sits in. The form is a JSON schema that the inference software enforces, as our guide to vision-language models for document AI describes.
3. Rules. A program compares the form with three tables your compliance team keeps current: the BOM from the ERP or PLM system, the Candidate List downloaded from ECHA, and the RoHS exemptions with their expiry dates. It flags part numbers in the BOM with no declaration, declarations that refer to an older Candidate List than the current one, exemptions past their expiry, SVHC above 0.1 per cent that need Article 33 information or a SCIP entry, and conflicts between two declarations for the same part.
4. Requests. For every flag, the system drafts a request to the supplier in the supplier's language, which a person sends. Answers go back to step 1.
5. Customer answers. For a customer questionnaire, the system looks up every part concerned in the verified records, not in the model's memory, and drafts the answer with a reference to each declaration used. A person checks and signs it.

The model never decides that a part is compliant. It reads documents and writes drafts; the rules and your staff decide. That keeps the result reproducible, and it matters because a declaration you pass on to a customer carries your company's name. Our guide on customer audits and supplier questionnaires covers the wider questionnaire work, and the same server can answer ESG questionnaires.

We supply servers with RTX PRO 4500 Server Edition cards for this kind of document work; send us a sample of declarations and your number of suppliers and parts, and our team replies with a configuration.

Why it should run in-house

The BOM is the reason. A compliance check needs the full list of parts, suppliers and quantities of a product, which many companies treat as confidential and which customer contracts may protect. Declarations themselves are less sensitive, but they only become useful when matched with the BOM, and that matching is best done where the BOM already lives. Our guide on trade secrets, NDAs and AI tools goes through the contractual side.

The second reason is load. Declarations come in waves after each Candidate List update, and a local server works through such a wave without per-document charges or limits.

How big the model and the server need to be

Declarations are short, structured documents, so a 14B model is enough for reading them into fields and drafting requests. Qwen3-14B in FP8 has 16.33 GB of weight files under Apache 2.0, about 15.2 GiB, and its card claims support for more than 100 languages and dialects, useful for suppliers who answer in their own language. GLM-OCR, an OCR model of 0.9B parameters by its card under MIT, reads the scans. Both fit one RTX PRO 4500 Server Edition with 32 GB.

Our estimates. Users-per-card rule: 90 per cent of the 31.9 GiB the driver reports, less 3 GiB, less 15.2 GiB of weights; cache sizes from Qwen3-14B's config (40 layers, 8 KV heads of 128). Rate from StorageReview's review of the RTX PRO 4500 Blackwell Server Edition (14 October 2026, vLLM 0.27.1): Ministral 3 14B FP8 with 8K input and 1K output flattens at about 180 output tokens per second from eight streams (its GPU overview page, modified 20 October 2026, lists 190; we plan with the lower figure); weekly volume and tokens per declaration are example values.

Qwen3-14B reads 32,768 tokens natively by its card, enough for a long full material declaration in one pass; longer ones are split by part number. Customer questionnaires add little load, since most of the work is looking up records. The weekly load leaves the server free most of the time, which is the argument for one company AI server: the same cards read EN 10204 certificates, draft safety data sheets and run an internal assistant.

Server options

Power by our estimate: cards at 165 W, two AMD EPYC 9135 for two cards or two EPYC 9355 for four, plus 15 per cent for the rest of the server, as in our guide to four RTX PRO 4500 Server Edition cards in 2U.

NVIDIA's product page lists the RTX PRO 4500 Blackwell Server Edition with 32 GB of GDDR7 at 800 GB/s, 165 W and a passive single-slot design. A two-card server with two AMD EPYC processors and at least 128 GB of DDR5 ECC memory, twice the GPU memory as NVIDIA's guide for certified systems asks, draws about 0.84 kW by our estimate and fits one 230 V 16 A feed, which carries 2.94 kW at 80 per cent. The four-card build at about 1.4 kW fits the same feed. Both belong in a server room or rack; a measurement on the delivered system confirms the power. Where a server with RTX PRO 6000 Blackwell Server Edition cards already runs, a 48 GB MIG instance of one card holds both models, as our page on RTX PRO 6000 MIG profiles explains.

We set up the models, the rule tables and the connection to your ERP or PLM system through our Private AI/ML service; tell us how you collect declarations today and which systems hold the BOM, and we propose a pilot with one product line.

Notes for the IT team

1. Data model. Keep three tables under version control: declarations (supplier, parts, date, list version, substances, exemptions, source file and page), the Candidate List as downloaded from ECHA with its date, and the RoHS exemptions with expiry dates. The rules join them with the BOM.
2. Serving. vLLM serves the OCR and text models with an OpenAI-compatible API and structured outputs; its documentation describes --gpu-memory-utilization as a per-instance limit, so both engines can share a card if needed. Switch Qwen3's thinking off with enable_thinking for form filling.
3. BOM link. Read BOMs from the ERP or PLM by export or interface; write flags and declaration references back as attributes per part. Your ERP or PLM provider sets up that interface.
4. Audit trail. Store model and rule versions with every result, and keep the original files. The ten-year retention in RoHS Article 7 applies to the manufacturer's technical documentation; your retention policy for supplier evidence follows your legal counsel's advice.
5. Access. Run the engines on an internal network behind a gateway with keys and a query log, as our guide to an LLM gateway with keys and a query log explains, and treat text from supplier documents as data, never as instructions, as in our guide to prompt injection and LLM security.
6. Software on delivery. The server arrives on request with the operating system, the NVIDIA driver, CUDA and a container runtime; the RTX PRO 4500 Server Edition needs a driver of the R595 branch or later.

What we supply

You can buy this system from us: our team sizes the configuration to your workload and budget and replies within one business day. We build the servers to order with RTX PRO 4500 Server Edition or RTX PRO 6000 Server Edition cards, assembled and tested before delivery, delivered anywhere in the EU on one EU contract and invoice, with manufacturer warranty on every component handled through us; quantities and lead time are confirmed in writing with the quote. Our Private AI/ML service, with our engineering partner Vixen.UNO, deploys the models, the rule tables and the connections to your systems. Our guide to buying a four-card RTX PRO 4500 Server Edition server lists the build.

FAQ