Prop 65 and ISO Compliance: What Manufacturers Must Know

Manufacturers who sell into California tend to treat Proposition 65 as a legal problem and ISO certification as a quality problem, handled by different people, tracked in different spreadsheets, reviewed at different meetings. That split is exactly what causes the trouble. Prop 65 is fundamentally a chemical hazard disclosure requirement, and chemical hazard disclosure is something your ISO 9001 or ISO 14001 system is already supposed to be managing under supplier controls, risk-based thinking, and environmental aspect identification. When the two run separately, you end up doing the same chemical review twice, badly, in both places.

I've spent enough time inside manufacturers' quality systems to know where this breaks down. The compliance team tracks Prop 65 listed chemicals in a legal-hold binder. The quality team tracks supplier material declarations in the QMS. Neither one talks to the other until a 60-day notice letter shows up, and then everyone is scrambling to figure out whether the formulation change from eighteen months ago ever got documented anywhere at all.

What Proposition 65 Actually Requires

Proposition 65, formally the Safe Drinking Water and Toxic Enforcement Act of 1986, is codified at California Health and Safety Code Section 25249.5 et seq. It requires any business with 10 or more employees to provide a "clear and reasonable" warning before knowingly and intentionally exposing anyone in California to a chemical listed by the state as known to cause cancer or reproductive harm. The Office of Environmental Health Hazard Assessment (OEHHA) maintains and updates that list, which currently runs to more than 900 chemicals spanning solvents, heavy metals, combustion byproducts, and specific botanical and food-derived compounds.

The warning requirements themselves — label format, font size, exact wording, and where the warning must appear — are set out in Title 27 of the California Code of Regulations, Article 6 (Sections 25600 through 25607). A business can avoid the warning obligation entirely if it can demonstrate exposure falls below the "safe harbor" thresholds OEHHA has established: the No Significant Risk Level (NSRL) for listed carcinogens and the Maximum Allowable Dose Level (MADL) for listed reproductive toxicants. Proving you're under those thresholds requires exposure assessment data tied to your actual formulation and use pattern, not a general assumption that your product is fine.

Enforcement is unusual compared to most regulatory regimes because private citizens and advocacy groups can sue on the state's behalf. Health and Safety Code Section 25249.7(d) requires a 60-day notice of violation before a private party can file suit, which gives a manufacturer a narrow window to either fix the labeling or negotiate a settlement. Civil penalties run up to $2,500 per day per violation under Section 25249.7(b), and because "per violation" has been interpreted to mean per unit sold in some settlements, the exposure for a manufacturer shipping volume product can escalate fast. This is the mechanism that makes Prop 65 different from an FDA warning letter: there's no regulator deciding whether to pursue you. Any party with standing can.

Where Prop 65 Meets Your ISO System

Here's the part most manufacturers miss: the work required to comply with Prop 65 — knowing what's in your product, knowing what your suppliers put in their materials, and having a documented basis for your exposure conclusions — is not a separate discipline from what ISO 9001 and ISO 14001 already ask you to do. It's the same discipline, aimed at a California-specific list instead of a generic risk register.

ISO 9001 clause 8.4 and supplier chemical declarations

ISO 9001:2015 clause 8.4 governs control of externally provided processes, products, and services. It requires you to determine controls proportional to the risk a supplier's input poses to your ability to consistently deliver conforming product. A raw material that could trigger a Prop 65 warning obligation, or worse, a Prop 65 lawsuit, is exactly the kind of risk clause 8.4 was written to catch. If your supplier qualification process under 8.4.1 doesn't include a chemical composition declaration and a Prop 65 status attestation, you have a gap in your quality system, not just a gap in your legal compliance program.

Clause 6.1, actions to address risks and opportunities, is the other lever. A manufacturer that has genuinely implemented risk-based thinking under 6.1 should already have Prop 65 exposure sitting on its risk register next to supply continuity and process capability. In practice, I still see quality systems where 6.1 risk assessments are limited to process and product nonconformity and never touch regulatory exposure at all. That's a narrower reading of the clause than the standard supports.

ISO 14001 clause 6.1.2 and chemical inventories

ISO 14001:2015 clause 6.1.2 requires you to identify environmental aspects of your activities, products, and services, and to determine which of those aspects have or can have a significant environmental impact. A chemical inventory built to satisfy 6.1.2 and a chemical inventory built to check products against the OEHHA Prop 65 list are, functionally, the same exercise run against two different reference lists. Clause 8.1, operational planning and control, then asks you to control those aspects — which for a Prop 65-relevant chemical means controlling formulation, labeling, and communication down the supply chain, not just controlling emissions or waste.

Manufacturers who hold both ISO 9001 and ISO 14001 certifications and still manage Prop 65 as a standalone legal function are maintaining a chemical inventory three times over: once for environmental aspects, once for supplier quality, once for the legal team's warning determinations. Merging those into a single chemical master list, cross-referenced against both the OEHHA list and your significant-aspects register, cuts the redundant work and closes the gap where a formulation change slips through one system but not the other.

Industry overlays: medical devices and cosmetics

For medical device manufacturers, ISO 13485:2016 clause 7.3 (design and development) requires documented design inputs and outputs, which is the natural place to capture and carry forward a Prop 65 exposure assessment as the device design matures rather than discovering the problem after the design is frozen. For cosmetics manufacturers, ISO 22716:2007, the international cosmetics GMP standard, governs raw material control and specifications in a way that dovetails directly with California's cosmetics-specific Prop 65 enforcement history — cosmetics have been one of the most litigated product categories under Prop 65, particularly for lead in color additives and formaldehyde-releasing preservatives.

Prop 65 vs. ISO 9001 vs. ISO 14001: How the Requirements Compare

Building One System Instead of Two

The fix isn't complicated, but it does require someone to own the integration. In my view, the most durable approach is to fold Prop 65 chemical review into your existing document control and supplier approval procedures rather than standing up a parallel legal-compliance workflow.

A few moves make the biggest difference:

Put Prop 65 status on the supplier questionnaire. If your ISO 9001 supplier qualification form under clause 8.4.1 already asks for material safety data, add a specific attestation: does this material, at the concentration supplied, appear on or contain anything on the current OEHHA list? Require the supplier to update that attestation whenever their formulation changes, and tie it to your existing change-control procedure rather than a separate notification chain.

Route formulation changes through the same risk assessment used for clause 6.1. Any raw material or process change that would trigger a design or process risk review under your quality system should automatically trigger a Prop 65 exposure re-check. If the two reviews happen in the same meeting, with the same document trail, you eliminate the timing gap where a reformulated product ships before anyone checks it against the current chemical list — which OEHHA does update periodically, so a product that was clear two years ago is not guaranteed to be clear today.

Give the environmental aspects register and the Prop 65 chemical list a shared owner. Whoever maintains your 14001 significant-aspects register under clause 6.1.2 should be the same person, or at least sit in the same review, as whoever tracks Prop 65 exposure. Duplicate tracking with two owners is where things fall through.

Document the safe-harbor calculation, not just the conclusion. If you're relying on the NSRL or MADL safe harbor to avoid a warning, keep the actual exposure math on file, tied to the formulation record it applies to. "We checked and it's fine" is not a defensible record if a 60-day notice arrives. A dated exposure assessment referencing the specific lot or formulation is.

Common Mistakes Manufacturers Make

The most expensive mistake I see is treating a Prop 65 warning label as a one-time legal sign-off rather than a controlled document tied to a specific formulation. When the formulation changes and nobody re-runs the label decision, the product ships with either an unnecessary warning that scares off customers or a missing warning that invites a notice letter. Either way, the label decision was correct once and became wrong silently.

A close second is assuming a certificate of analysis from a supplier settles the Prop 65 question. A CoA typically confirms the material meets a specification; it rarely confirms the material is free of every substance on a list that runs past 900 entries and changes periodically. Trusting a CoA as your Prop 65 record is a gap I'd flag in any internal audit, whether the manufacturer asked me to look at Prop 65 specifically or not.

The third mistake is organizational: leaving Prop 65 with legal or regulatory affairs entirely and never looping in the quality function that already owns supplier control and change management. The two functions solving the same problem separately is slower and less reliable than one function solving it once.

A Practical Starting Checklist

1. Pull your current product and raw material list and cross-reference it against the current OEHHA Prop 65 list — treat this as a scheduled recurring task, not a one-time project.
2. Add a Prop 65 attestation field to your supplier qualification and requalification forms under ISO 9001 clause 8.4.1.
3. Confirm your change-control procedure requires a Prop 65 re-check whenever a formulation, supplier, or raw material source changes.
4. If you rely on a safe-harbor exposure calculation instead of a warning, file the calculation as a controlled record tied to the formulation it covers.
5. Assign a single owner responsible for both the ISO 14001 significant-aspects register and Prop 65 chemical tracking, or ensure the two owners meet on a fixed schedule.

None of this requires abandoning your existing quality system and building a parallel compliance function. It requires recognizing that Prop 65 asks the same underlying question your ISO system already asks — what's actually in this product, and where did it come from — and pointing the answer at one more list.

If you're building or auditing a quality system that needs to hold up under both ISO scrutiny and California's chemical disclosure regime, our ISO 9001 consulting and ISO 14001 consulting services are built around exactly this kind of cross-functional gap.

Frequently Asked Questions

Does ISO 9001 or ISO 14001 certification satisfy Prop 65 requirements? No. ISO certification and Prop 65 compliance are governed by entirely different bodies — a certification body for ISO, the California Attorney General and private plaintiffs for Prop 65 — and neither one substitutes for the other. What they share is underlying process infrastructure: supplier control, chemical tracking, and change management. A well-run ISO system makes Prop 65 compliance easier to maintain, but it does not create a legal safe harbor on its own.

Which manufacturers actually need to worry about Prop 65? Any business with 10 or more employees that sells, distributes, or manufactures a product that ends up in California, regardless of where the manufacturer itself is located. Out-of-state and even overseas manufacturers whose products reach California retail shelves or e-commerce buyers are subject to the same warning obligations as a company headquartered in Sacramento.

What's the difference between the NSRL and the MADL? The No Significant Risk Level (NSRL) applies to chemicals listed as carcinogens and represents the exposure level OEHHA has determined poses no significant cancer risk. The Maximum Allowable Dose Level (MADL) applies to chemicals listed as reproductive toxicants and represents the dose level with no observable reproductive effect. Both are defined under Title 27 of the California Code of Regulations, and falling below the applicable threshold removes the warning obligation for that specific chemical and exposure route.

Can a Prop 65 notice of violation affect an ISO certificate? Not directly. A certification body auditing against ISO 9001 or ISO 14001 is not evaluating Prop 65 compliance as a certification requirement. But if a Prop 65 notice reveals that your supplier control process (clause 8.4) or your risk-based thinking (clause 6.1) failed to catch a known chemical hazard, an auditor reviewing that same process for other reasons may reasonably ask how the gap occurred — and a documented, closed corrective action is a far better answer than silence.

How often does the Prop 65 chemical list change? OEHHA updates the list on an ongoing basis as new chemicals are added through its formal listing mechanisms, which include an independent scientific review process and reliance on findings from other authoritative bodies. Because the list is not static, a chemical review that confirmed compliance two years ago is not proof of compliance today — this is exactly why the review needs to be a recurring, scheduled task rather than a one-time determination.

Last updated: 2026-09-11