RoHS

Directive European Union

RoHS, WEEE and REACH together form the EU’s material-compliance regime for electronics. RoHS restricts specified hazardous substances in electrical and electronic equipment, WEEE governs end-of-life collection and recycling, and REACH obliges declaration of substances of very high concern present above a threshold.

• Per-part obligation - Compliance is asserted at the level of an individual component or assembly, so the data has to exist for every part number.
• Flows up the supply chain - A manufacturer’s declaration depends on declarations from every supplier beneath it.
• Ongoing, not one-off - Substance lists are revised, so declarations have to be maintained.
• Widely mirrored - Comparable regimes exist in other jurisdictions, and conflict-minerals reporting adds a parallel obligation.

This regime is the most useful precedent in the catalog for predicting how hardware markets respond to a data mandate, because it has been running for two decades. It created a genuine, granular, continuously-maintained per-part data obligation across the entire electronics industry — exactly the data an agent selecting a component would want. The industry answered it with spreadsheets, supplier questionnaires and distributor portals. Twenty years on, material declarations are still not callable.

The State of Compute & Hardware APIs reads the EU Cyber Resilience Act against this precedent. The CRA is the first regulation to require an ongoing structured security data flow from hardware manufacturers to their customers. Whether it is met with a portal or an endpoint is the open question, and RoHS is the reason not to assume the answer.