CBAM Compliance in 2026: A Practical Playbook for Importers and Suppliers

Where CBAM stands in 2026

The Carbon Border Adjustment Mechanism (CBAM) moved from transitional to definitive on 1 January 2026. Importers of iron and steel, cement, aluminium, fertilisers, electricity and hydrogen into the EU now have to surrender CBAM certificates for embedded emissions — not just report them. The financial exposure is real, and the data quality bar has stepped up sharply.

Three practical changes compared to the transitional period:

1. Default values no longer free-ride. Only actual supplier data, verified by an accredited verifier, avoids the punitive default. Default values have been recalibrated upward.
2. Quarterly declarations with annual reconciliation, surrendered through the CBAM Registry by a single authorised CBAM declarant per importer.
3. Verification of embedded emissions is mandatory for the annual declaration, performed by an EU-accredited verifier under the CBAM Implementing Regulation.

The CBAM data model in practice

A working CBAM data model needs four layers:

• Goods layer — CN code, quantity, country of origin per shipment
• Installation layer — production installation identity, operator, location, production route
• Emissions layer — direct emissions, indirect emissions, precursor emissions per tonne of output
• Verification layer — verifier identity, verification report reference, validity period

Spreadsheets break down at the installation–emissions join. Most importers under 20–30 suppliers can survive on Excel through 2026; above that, a purpose-built CBAM module is the only realistic path.

Supplier data collection — the hard part

The technical specification is the easy part. Getting the data from non-EU suppliers — who have no direct EU regulatory exposure — is the hard part.

Patterns that work in 2026:

1. Contractual clauses referencing CBAM Annex IV data requirements in new and renewed contracts
2. Tiered supplier engagement: top 80% of CBAM-exposed spend on white-glove onboarding, long tail on self-service portals
3. Pre-filled questionnaires in the supplier's native language, with worked examples per production route
4. Joint verification calendars that align supplier audit cycles with the importer's declaration cycle
5. Default-value escalation paths for suppliers that cannot or will not provide actual data — including resourcing impact on the importer

Embedded-emissions methodology — the three production routes

CBAM recognises specific production routes per sector. For steel, the most common are:

• Basic oxygen furnace (BOF) — integrated route, high direct emissions
• Electric arc furnace (EAF) — scrap-based, lower direct, higher indirect
• Direct reduced iron (DRI) — gas- or hydrogen-based, varying intensity

The route classification drives system boundary, monitoring methodology and verification scope. Misclassification is the most common verification finding in early definitive-period audits.

Software stack for CBAM in 2026

A defensible CBAM stack typically combines:

• ERP / customs broker — shipment-level CN code and origin (already in place)
• Supplier portal — questionnaires, document upload, supplier-facing methodology guidance
• CBAM engine — installation registry, emissions calculation, default-value comparison, declaration generation
• Verification workflow — verifier collaboration, evidence binder, version control
• CBAM Registry connector — automated submission of quarterly reports

Some EHS / ESG platforms (Sphera, Cority, Sweep, Watershed) bundle CBAM modules; CBAM-pure-play tools (CarbonChain, CRBNZRO, Optera-style) compete on supplier UX and verification workflow.

CBAM and your wider ESG programme

CBAM data does not live in isolation. The same embedded-emissions data feeds:

• CSRD ESRS E1 climate disclosures
• Scope 3 Category 1 purchased goods and services accounting
• SBTi target-tracking
• Customer-facing product carbon footprints

The 2026 architecture builds CBAM on top of the same supplier-emissions data lake — not as a parallel system.

90-day get-ready checklist

• Month 1. Authorised CBAM declarant assigned. CBAM-exposed SKU list locked. Top 20 suppliers tiered. Verification provider RFP started.
• Month 2. Supplier portal live. Pre-filled questionnaires dispatched. Quarterly declaration dry-run with prior-period data. Verification provider contracted.
• Month 3. First definitive-period declaration submitted. Default-value escalation paths documented. CSRD / SBTi data re-use confirmed.

FAQ

Who is the authorised CBAM declarant? A single legal person per importer, authorised by the national competent authority. They alone can submit declarations and surrender certificates.

Can we still use default values? Yes, but they are calibrated upward and create financial penalty exposure. Use only as a stopgap.

Does CBAM apply to finished goods? Currently only to the in-scope sectors (iron and steel, cement, aluminium, fertilisers, electricity, hydrogen) and a limited list of downstream products. The scope is expected to widen in subsequent reviews.

How does CBAM interact with EU ETS? CBAM offsets the ETS price embedded in EU production. Free allowances under the ETS are phased out for CBAM sectors over 2026–2034.

Do we need a verifier from the country of import? No — the verifier must be accredited under the EU CBAM regime, not necessarily based in the country of import.

What is the realistic cost of compliance? SMB importers with 5–20 CBAM-exposed suppliers typically run at €20k–€60k per year fully loaded. Large importers with hundreds of suppliers and complex supply chains land at €250k–€1M+.

Related reading

• CBAM Compliance Software 2026
• CSRD Compliance Software
• CSRD Software Comparison 2026
• Scope 3 Emissions Software
• Carbon Accounting Software
• Best ESG Software