Abstract: With the increasing “agencification” of policy making in the European Union (EU), normative questions regarding the legitimacy of EU agencies have become ever more important. This article analyses the role of expertise and legitimacy with regard to the European Chemicals Agency ECHA. Based on the REACH regulation, so-called Substances of Very High Concern (SVHCs) are subject to authorisation. The authorisation procedure aims to ensure the good functioning of the internal market, while assuring that risks of SVHCs are properly controlled. Since ECHA has become operational in 2008, recurring decisions on SVHCs have been made. The question posed in this article is: to what extent can decision making in the REACH authorisation procedure be assessed as legitimate? By drawing on the notion of throughput legitimacy, this article argues that decision making processes in the authorisation procedure are characterized by insufficient legitimacy.