On 1 September, the EU proposed its first legal limit for the toxin behind a recall that reached at least 99 countries: the number for powdered infant formula is fixed, the number for liquid formula is a calculation every manufacturer has to run itself

What the 1 September draft actually does

Regulation (EC) No 2073/2005 is the EU's core food-safety text for microbiological criteria: it sets the food-safety and process-hygiene limits, and the sampling and testing methods, that food business operators already have to meet for pathogens such as Salmonella and Listeria. Cereulide, the toxin at the centre of the 2026 infant formula incident, does not currently appear in it at all. Standard microbiological testing looks for the Bacillus cereus bacterium, not the heat-stable toxin it can produce, which survives pasteurisation and standard processing even after the bacteria themselves are gone. The draft regulation closes that gap for the infant category the toxin proved most dangerous for: it adds cereulide as a named food-safety criterion, sets the 1 µg/kg maximum limit for dried infant formula, dried follow-on formula and dried foods for special medical purposes intended for infants under six months, and sets out the reconstitution-factor calculation manufacturers must use to check liquid, ready-to-feed versions of the same products against an equivalent limit rather than a fixed number. The European Commission opened the text for public comment on 1 September 2026, with the window closing on 29 September 2026, before the draft can be adopted through the EU's standard comitology procedure.

The numbers behind the 1 September draft

One number is the new legal ceiling itself. One is how far a single contamination event travelled before that ceiling existed. The third is how little time the trade has to comment before the text can move toward adoption.

The real subject: a single shared ingredient supplier turned into a 99-country event

What made the underlying incident spread across dozens of competing brands and markets at once was not a shared factory or a shared retailer. Press reporting traced the contamination to arachidonic acid (AHA) oil, a single ingredient sourced from one supplier in China and used, at the same time, by several unrelated infant formula manufacturers, Nestlé, Danone and Lactalis Nutrition Santé among the brands named in coverage of the recall. A finished-goods quality programme built around each manufacturer's own factory, its own finished-product testing and its own retail distribution has no reason to notice that its competitors' formula, sold under entirely different brand names in entirely different countries, shares the same upstream input. Contamination at that single supplier therefore did not stay contained to one company's supply chain, it surfaced simultaneously in products with no other connection to each other, which is exactly why a defect traced back to one ingredient batch reached at least 99 countries before it was fully understood. The EU's response treats this as a testing-method problem, adding cereulide as a named criterion rather than relying on bacterial counts that a contaminated batch can still pass. It does not, on its own, close the traceability gap that let the same raw-material risk sit invisible inside several competing brands' supply chains at once.

Why it matters for brands

The direct exposure sits with any manufacturer of infant formula, follow-on formula or foods for special medical purposes intended for infants sold into the EU, but the compliance test the draft sets is one three other groups should run against their own products before 29 September 2026. First, brands and co-packers using arachidonic acid oil or comparable specialised nutritional-fat ingredients in any infant or medical-nutrition product, in or outside the EU, since a supplier-level contamination risk does not stop at a border a finished product happens to cross. Second, any manufacturer that will have to comply with the reconstitution-factor calculation for a liquid product: because the draft states a target, not a fixed figure, for reconstituted formula, a compliance team has to be able to show its working, the exact reconstitution factor used and how it maps to the dried-product limit, in a way a regulator can independently check, not just a pass or fail result from a lab. Third, any brand whose current microbiological testing panel checks for Bacillus cereus counts but not cereulide specifically, since the draft's own premise is that the two do not always move together: a batch can carry the toxin after the bacteria that produced it are no longer detectable. A brand that can already trace a specific ingredient batch to every finished SKU it went into, across every co-packer and every brand it was sold under, is positioned to comment on the draft, and to comply with it, from operational fact. One that only tracks compliance at the level of its own factory is the one for whom the next contamination at a shared supplier arrives as a surprise rather than a controlled recall.

Two ways to read 1 September

Frequently asked questions